Configuration as a Code: Managing Hundreds of GitHub Organizations to Streamline...

### Overview In this talk, Mikaël Barbero, Head of Security at the Eclipse Foundation, introduces "autodog," an open-source command-line tool developed to manage GitHub configurations as code across more than 150 GitHub organizations and thousands of repositories. The initiative stemmed from an OpenSSF Alpha-Omega project audit, which revealed low OpenSSF Scorecard scores—particularly an absence of branch protection rules across many repositories. Managing this volume of repositories manually was unfeasible, necessitating automated tooling capable of enforcing organization-wide defaults while respecting project autonomy.

### Key Requirements To meet the Eclipse Foundation's governance and operational scale, the solution needed to address several specific requirements: - **Hierarchical Defaults and Overrides:** Establish baseline secure configurations while giving individual projects the flexibility to override specific settings for unique use cases. - **Comprehensive Setting Coverage:** Manage standard repository and organization settings, webhooks, branch protection rules, and settings lacking public GitHub APIs. - **Non-Disruptive Adoption:** Snapshot and import existing repository and organization configurations at initial setup without forcing unexpected configuration changes. - **Confidentiality:** Prevent leakage of sensitive configurations (e.g., branch protections not visible to unauthenticated users) by isolating configuration files within dedicated private repositories. - **Self-Service and Visibility:** Allow project committers to inspect current settings and propose modifications via pull requests rather than relying solely on help-desk support tickets.

### Technical Details & Architecture - **Configuration Engine:** autodog is built in Python 3 and uses Jsonnet as a side-effect-free data templating language. Base configurations define standard organization and repository defaults (e.g., required 2FA, commit sign-off, Dependabot alerts). Sub-organizations import these defaults using `jsonnet-bundler` (`jb`) to pull dependencies from a vendor directory, allowing projects to define only their specific overrides. - **GitHub Interfaces:** autodog retrieves and modifies settings using GitHub’s REST API, GraphQL API (specifically for branch protection rules), and automated headless browser interaction via Playwright. Playwright is used to scrape and toggle settings absent from public APIs, such as the organization-level setting `member can change repository visibility`. - **Workflow Commands:** Mirroring Terraform's operational model, autodog features commands including `validate` (enforcing undocumented and documented GitHub API constraints offline), `plan` (rendering configuration diffs between local Jsonnet files and remote state), `apply` (pushing configuration changes remotely), and `push config` (committing local definitions to the organization’s private `.eclipsefdn` repository). - **Credential Management:** autodog supports external credential providers such as `pass` (GnuPG-based local password store) and Bitwarden to supply personal access tokens, account credentials, and TOTP seeds needed for automated browser logins.

### Takeaways Automating GitHub configuration as code allows security teams to propagate security baselines—such as push protections or branch protections—across hundreds of organizations simultaneously without breaking downstream projects. Providing clear visibility into settings increases committer trust and self-service capabilities without introducing pushback during deployment. Future enhancements planned for autodog include packaging it into a GitHub App to streamline execution, eliminate manual token maintenance, and provide continuous monitoring and alerting for configuration drift.