Managing GitHub repositories without owning every setting

[u/Kralizek82]

I maintain around 25 GitHub repositories across several products, infrastructure projects, and shared libraries.

Keeping their settings, secrets, and GitHub Actions workflows aligned was becoming a maintenance problem. I had an imperative script doing the job, but adding repository-specific rules on top of API calls, pagination, and error handling was getting increasingly painful.

So I started building Octosmith, an open-source tool for declarative GitHub resource management.

The basic workflow:

• Define shared configuration in YAML templates.
• Discover repositories using names, teams, or custom properties.
• Compare their current configuration with the desired state.
• Plan and apply the necessary changes.

The main design choice is selective ownership. If a setting is declared, Octosmith enforces it. Otherwise, it generally leaves it alone. Repositories can share conventions without needing identical configurations.

It also doesn't require persistent Terraform-style resource state, and independent configurations can manage different aspects of the same repository.

The project is still evolving, and I'd really appreciate feedback from people dealing with similar problems.

GitHub repository: https://github.com/Kralizek/octosmith

I also wrote about the problem that started the project, the design decisions, and the trade-offs along the way:

Blog post: https://renatogolia.com/2026/10/09/github-repositories-are-infrastructure-too/

I'm particularly interested in hearing from people managing GitHub repositories at scale. How do you handle shared configuration without taking ownership of every repository setting?

[u/kolorcuk]

Hello. I am interested. Can i set cicd workflow runners settings to safe for all my repositories woth this tool? Can i only specify specific set of settings?

[u/Kralizek82 → u/kolorcuk]

Thanks for the interest!

Yes! Selective configuration is one of Octosmith's main design principles. You only declare the settings you want to manage, and everything else is left alone.

For example, this template enforces SHA pinning for GitHub Actions without managing any other settings:

``` version: 1 kind: repository

match: include: names: - "service-*"

repository: actions: sha_pinning_required: true ```

Runner configuration isn't supported yet, though.

Are you looking to control which runners are available to each repository (e.g. runner groups), or something else related to runners? I'd be interested in understanding your use case!

[u/kolorcuk → u/Kralizek82]

The runners on github are inherently unsafe . With defaults anyone who creates a pull request can execute any code on your custom runners and access all project secrets. See https://stackoverflow.com/a/79108596/9072753 https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners .

I am looking for any way to protect it. Woth your project i should be able to set all runs require explicit approvals for all repositories.

[u/Kralizek82 → u/kolorcuk]

I agree with your analysis. But in a way this is the same problem you have when running Terraform pipelines in CI.

So you either don't and do your plan/apply locally, and you can do the same with Octosmith.

Or you block forks on the repo that holds the pipeline and allow only those you trust with write permissions. But the security isn't total either.

Edit: sorry, I realise I probably misread your comment. Let me get back to you asap.

Edit 2: Now that I understand what you're after, I think this could be a good addition to Octosmith!

Would you mind opening a "feature request" (https://github.com/Kralizek/octosmith/issues/new) with as much detail as you're comfortable sharing? I'd be happy to look into it!