Skip to content

Repository files navigation

.github — Org defaults · governance & settings-as-code

main License OpenSSF Scorecard Ask DeepWiki

Settings-as-code GitHub Actions Python

.github — Lentago Labs org defaults and fleet governance

This is the Lentago Labs organization's special .github repository. It serves two roles: GitHub reads org-level defaults from here, and it houses the settings-as-code tooling that governs the rest of the fleet. It is also the control plane you learn from: one JSON edit here, applied, moves branch protection, required checks, and labels across every repo — governance as change management, where the merged PR is the change record.

📚 Ask this codebase (DeepWiki)

Ask DeepWiki

DeepWiki maintains an AI-generated wiki over this repository — architecture pages, diagrams, and a Q&A box grounded in the actual code. Every public Lentago Labs repo is indexed (deepwiki.com/lentago); it is the fastest way to orient before reading source. It is AI-generated: trust it to orient you, verify against the code before you act on it.

Good first questions:

  • How does fleet-ops/required-checks.json prevent a required GitHub Actions check from deadlocking PRs on repos where its workflow never runs?
  • What is the current division of labor between fleet-ops/fleet-apply.sh and the terraform/ module for managing Lentago Labs repo settings?
  • How is the weekly fleet-report.md generated, and what does the ci/validate.py check enforce about it staying reproducible?

🧭 What this repo demonstrates

The patterns an ops team can lift wholesale — each row links to where it actually runs.

Pattern How it shows up here
Fleet settings-as-code — one edit, every repo fleet-ops/required-checks.json + the terraform/ module that reads it: edit one JSON map, apply, and every repo's branch rules move — no per-repo clicking
Declarative IaC, migrated incrementally terraform/ reads the same JSON and owns repo existence/identity/rulesets; PR #82 moved settings onto the GitHub provider with no big-bang cutover
The always-on required-check gate .github/workflows/ci.yml has no on:-level path filter — a path-filtered required check never triggers on non-matching PRs and deadlocks the merge forever
DRY CI via shared workflows docs-check.yml and claude.yml uses: reusables from shared-workflows instead of copy-pasted YAML
Drift detection for config ci/validate.py asserts the JSON manifests, generated brand assets, and generated reports all stay reproducible from source — hand-edits fail the PR
Agent-authored, human-merged PRs PR #80 was opened by the lentago-claude-runner bot against required checks and merged by a human — the worker never merges itself
Automated periodic reporting fleet-reports.yml runs metrics/generate-fleet-reports.py on a schedule to refresh fleet-report.md and incidents.md
Config-driven identity brand/generate.py emits every repo's banner and card from brand/fleet.json — IaC applied to branding, CI-enforced against hand-edits

Org profile

profile/README.md renders as the organization profile page at github.com/lentago. profile/assets/banner.svg is its header.

Community-health defaults

CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, and LICENSE live at the repo root and apply org-wide to any Lentago Labs repo that doesn't define its own. Issue and PR templates are not yet set.

Fleet governance

The fleet's GitHub settings as Terraform, via the integrations/github provider. Owns repository existence and identity, merge-button options, the topic spine, the per-repo main branch ruleset, required status checks, and the Tidewater label palette — across every repo in the org.

Adding a repo to fleet-ops/repos.json and applying creates it, scaffolded from repo-template and wired to fleet policy from its first second. Removing one is refused by prevent_destroy rather than deleting a live repository. Applies are operator-run today; apply-on-merge is phase 2. See terraform/README.md.

The configuration Terraform reads, plus the imperative sweeps that have no declarative equivalent.

  • repos.json — per-repo identity: description, homepage, visibility, features, signature topics, model-routing labels. The source of truth for which repos the fleet contains.
  • required-checks.json — per-repo map of the status checks that must pass before merge.
  • labels.json — the Tidewater issue-label palette. Colors and descriptions for the labels it names; per-repo labels it doesn't name are left alone.
  • fleet-apply.sh — the pre-Terraform drift checker, still the tool for the two jobs Terraform can't express: --prune-branches (merged-branch residue) and the preflight that a required check-run context actually reports before anything requires it. Its settings-applying flags are superseded by terraform/.
  • repo-ruleset.json — the branch-ruleset template fleet-apply.sh used; the same shape now lives in terraform/rulesets.tf.
  • org-ruleset.json — org-level ruleset definition, parked (needs a paid plan).

Periodically regenerated reports published in this repo.

  • fleet-report.md — the weekly fleet report: open issues by repo, a 30-day merge/close activity snapshot, and an instruction-as-code language census. Auto- refreshed every Monday by a GitHub Actions workflow.
  • incidents.md — the public incident register, linking to post-mortems under fleet-reports/incidents/. New reports are harvested from session transcripts via the local /incident-digest playbook.
  • generate-fleet-reports.py — generates both fleet-report.md and incidents.md.
  • language-census.md — a periodic cloc-based language breakdown across all in-scope org repos.
  • validate.py — the check that gates PRs here. Asserts that fleet-ops/*.json match the shape fleet-apply.sh and the Terraform module consume, that those manifests and brand/fleet.json agree on which repos exist, that brand/generated/ is reproducible from brand/fleet.json rather than hand-edited, that the report generator's classifiers route known paths correctly, and that fleet-reports/incidents.md is reproducible from its sources rather than hand-edited. Run it the way CI does: python3 ci/validate.py.

Brand assets, and the generator that turns them into per-repo identity.

  • avatars/ — the Lentago Labs mark in SVG and PNG variants (square and circular, teal and limestone colourways).
  • marks/ — the 64-grid genus marks, one per fleet system, plus the lentago blossom that every other repo falls back to.
  • fleet.json + generate.py — per-repo identity as config: emits each repo's README banner, badge row, and 1280×640 social-preview card into brand/generated/. render.sh rasterizes the cards with the real brand typefaces. Generated output is CI-enforced against hand-editing.

Social previews are the one surface with no API — they're uploaded per repo under Settings → General → Social preview.

Architecture decisions

docs/adr/ records the architectural decisions behind this repo and its fleet governance — the merge gate, the Terraform migration, per-repo rulesets, and more — reconstructed from repo history and fleet records.

🛠️ Make a change yourself

This is a lab — the systems are real, the stakes are not. Pick a vector:

Add a fleet-wide required status check. Edit fleet-ops/required-checks.json to add a check context for one repo or all of them, and open a PR — ci/validate.py validates the JSON shape before it can merge. Once merged, an operator applies the change with the terraform/ module, which reads that same JSON and owns rulesets, required checks, and labels (applies are operator-run with an admin token in phase 1 — see terraform/README.md; fleet-apply.sh still contributes the required-context preflight, proving a check context actually reports before anything requires it). This is the same JSON-then-apply flow used repeatedly to roll checks across the fleet. Proof this works: PR #68 — fleet-ops: require docs-check on every active repo, PR #29 — fleet-ops: manage per-repo required status checks, PR #73 — fleet-ops: require claytonia's terraform gate.

Migrate a settings surface to Terraform. Extend the terraform/*.tf modules, which read the same fleet-ops/*.json, and open a PR — .github/workflows/terraform.yml runs fmt + validate on it. The apply is still operator-run locally today (phase 1); apply-on-merge is the planned phase 2 tracked in terraform/README.md, so don't expect a merge here to mutate GitHub settings yet. Proof this works: PR #82 — Manage the fleet's GitHub settings with the Terraform GitHub provider, PR #83 — terraform: rename the validate job to tf-validate.

Let the agent fleet fix a broken workflow. Dispatch a job to the claytonia agent fleet (or trigger it from a monitoring signal); a worker opens a PR against this repo, the required checks run, and a human reviews and merges. The worker never merges itself — that gate is the whole point. Proof this works: PR #80 — fix: pin cloc to v2.06 in fleet-reports workflow, authored by the lentago-claude-runner bot and merged by a human.


Fleet CI conventions and the reusable workflows other repos call live in shared-workflows, not here. The workflows under .github/workflows/ are this repo's own — they gate its PRs and refresh the fleet reports.


🌱 Lentago Labs is a team learning lab — real systems, non-critical stakes, modern operations patterns demonstrated in the open. Start at the org profile, and read this repo on DeepWiki.


Built in collaboration with Claude (Anthropic) — directed and reviewed by an infrastructure operator, not a software engineer.

About

Org-level defaults and fleet governance for Lentago Labs: the profile README rendered at github.com/lentago, community-health defaults, the fleet-ops settings-as-code tooling (per-repo rulesets, required status checks, merge and topic enforcement), and the weekly fleet report + public incident register.

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages