FactoryManagedOrg

An organisation or user account the Software Factory manages: the switch on the Factory organisations page. The account must already be connected, through the Vulnetix GitHub App or a forge connection, and active. Which of its repositories the App can reach is chosen on GitHub when the App is installed; this document does not change that, and status reports it (installationId, repositorySelection, repoCount). metadata.name is the account lower-cased, with every run of characters other than a to z and 0 to 9 replaced by one hyphen: acme-platform for acme-platform, codeberg-org-acme for codeberg.org/acme. Applying also keeps the scope.orgs setting of the factory settings document in step. Deleting the document stops managing the account; the record is kept, so managing it again restores it.

apiVersion	vulnetix.com/v1
kind	FactoryManagedOrg
Group	Repo scope
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists FactoryManagedOrg in its kinds. See Management tokens.
Terraform resource	vulnetix_factory_managed_org, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/FactoryManagedOrg.schema.json
Newest schema	latest/FactoryManagedOrg.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema FactoryManagedOrg

Minimal

Only the fields the kind requires. From examples/FactoryManagedOrg/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/FactoryManagedOrg.schema.json
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: acme-platform
spec:
  account: acme-platform

HCL (resource vulnetix_factory_managed_org)

# Only the arguments the kind requires. From config-schemas examples/FactoryManagedOrg/minimal.yaml.

resource "vulnetix_factory_managed_org" "acme_platform" {
  name    = "acme-platform"
  account = "acme-platform"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/FactoryManagedOrg.schema.json
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: acme-platform
spec:
  account: acme-platform
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/FactoryManagedOrg/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/FactoryManagedOrg.schema.json
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: acme-platform
  labels:
    team: platform
  annotations:
    ticket: https://tracker.example.com/PLAT-77
spec:
  account: Acme-Platform
---
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: codeberg-org-acme
spec:
  account: codeberg.org/acme

HCL (resource vulnetix_factory_managed_org)

# Every argument the kind supports. From config-schemas examples/FactoryManagedOrg/advanced.yaml.

resource "vulnetix_factory_managed_org" "acme_platform" {
  name    = "acme-platform"
  account = "Acme-Platform"
  labels = {
    team = "platform"
  }
  annotations = {
    ticket = "https://tracker.example.com/PLAT-77"
  }
}

resource "vulnetix_factory_managed_org" "codeberg_org_acme" {
  name    = "codeberg-org-acme"
  account = "codeberg.org/acme"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/FactoryManagedOrg.schema.json
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: acme-platform
  labels:
    team: platform
  annotations:
    ticket: https://tracker.example.com/PLAT-77
spec:
  account: Acme-Platform
---
apiVersion: vulnetix.com/v1
kind: FactoryManagedOrg
metadata:
  name: codeberg-org-acme
spec:
  account: codeberg.org/acme
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly FactoryManagedOrg	Always FactoryManagedOrg.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.account	string	yes		pattern ^[^\s/]+(/[^\s/]+)*$; length 1 to 300	The account’s login as the forge shows it: a GitHub organisation or user (acme-platform), or host/account for an account on another forge (codeberg.org/acme). Matched without regard to case.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. installationId, accountType, repositorySelection, repoCount and installationStatus, read only. The phases the engine reports are explained under status phases.

How apply treats it

• metadata.name is derived from spec.account (lower case, runs of other characters become one hyphen). A document whose name is not derived from its account is refused, because read finds the row by it.
• spec.account is the login (host/account for a forge connection), lower-cased. Plan needs the account to be connected and active.
• Apply writes the row, scope.orgs in the settings document, and a setting event. The status reports the installation id, account type, repository selection, repository count and installation status. Which repositories the GitHub App reaches stays on GitHub and is read only here.
• Delete switches management off. The row is kept.

Terraform and OpenTofu

The resource is vulnetix_factory_managed_org in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_factory_managed_org.

Import an object that already exists by its name:

# Import an existing FactoryManagedOrg by its name (metadata.name).
terraform import vulnetix_factory_managed_org.acme_platform acme-platform

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.