Configuration as a Code: Managing Hundreds of GitHub Organizations to Streamline Supply Chain Security
summary
Eclipse Foundation builds and runs autodog, a Python3 command-line system that snapshots and enforces GitHub org and repo settings across roughly 150 organizations and 1,000+ repositories. It uses jsonnet + jsonnet-bundler for inheritable config, REST/GraphQL for API changes and Playwright for settings only available in the web UI, supports pass and Bitwarden creds, does non‑disruptive import/validate/plan/apply flows, creates repos from defaults, and successfully rolls security defaults (like branch protection) out en masse.
AI-written summary · about
chapters (16)
- 0:00Managing GitHub at Eclipse
- 1:48Why AutoDog was created
- 5:20What AutoDog is
- 7:05AutoDog config structure
- 9:55Live demo secure defaults
- 13:23Validating config changes
- 16:13New repos with secure defaults
- 19:30AutoDog architecture deep dive
- 23:23Jsonnet for reusable configs
- 25:10GitHub API limitations
- 27:10Credentials and security
- 29:17Onboarding orgs with AutoDog
- 31:00Importing existing settings
- 33:10Scaling security governance
- 34:19Future plans and GitHub app
- 35:03Key takeaways
related talks
47mPolicing Open-Source Projects at Scale
31mGitHub as a self-sustaining product for large-scale environments
39mA Guide to Securing GitHub Based on Lessons Learned
38mFortifying Your Codebase with GitHub
59mTutorial: Automating Configuration and Management of your GitHub...
17mNo More Walled Gardens: Removing Barriers with SCM...
40mA Guide to Securing GitHub Based on Lessons Learned
36mWhale Care 101 - How We Organize A 200+ Devs Project