RepositorySettings

The Software Factory’s controls for one repository: the settings panel of the Factory repositories page. The repository must be one the factory can see, through a managed organisation or another signal. metadata.name is the repository lower-cased, with every run of characters other than a to z and 0 to 9 replaced by one hyphen: acme-payments-api for acme/payments-api. A field left out means its default. The asset fields (labels, owner and criticality) describe the repository as an asset of the business: they are stored per repository, shown on the Repositories page, and become the labels, owner and criticality variables of the CEL finding context, so a risk, suppression, jail or gate rule can select on them. They need the saas migration 20261228000000_repository_asset; until it is applied a document that sets one is refused. Deleting the document removes the repository’s own settings, so it runs at the tenant’s autonomy.default again, removes its monthly token cap and clears its asset fields; the record of the change is kept in the audit trail.

apiVersion	vulnetix.com/v1
kind	RepositorySettings
Group	Repo scope
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists RepositorySettings in its kinds. See Management tokens.
Terraform resource	vulnetix_repository_settings, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/RepositorySettings.schema.json
Newest schema	latest/RepositorySettings.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema RepositorySettings

Minimal

Only the fields the kind requires. From examples/RepositorySettings/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RepositorySettings.schema.json
apiVersion: vulnetix.com/v1
kind: RepositorySettings
metadata:
  name: acme-payments-api
spec:
  repository: acme/payments-api
  autonomy: draft_pr

HCL (resource vulnetix_repository_settings)

# Only the arguments the kind requires. From config-schemas examples/RepositorySettings/minimal.yaml.

resource "vulnetix_repository_settings" "acme_payments_api" {
  name       = "acme-payments-api"
  autonomy   = "draft_pr"
  repository = "acme/payments-api"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RepositorySettings.schema.json
apiVersion: vulnetix.com/v1
kind: RepositorySettings
metadata:
  name: acme-payments-api
spec:
  repository: acme/payments-api
  autonomy: draft_pr
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/RepositorySettings/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RepositorySettings.schema.json
apiVersion: vulnetix.com/v1
kind: RepositorySettings
metadata:
  name: acme-payments-api
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/PAY-1501
spec:
  repository: acme/payments-api
  autonomy: suggest
  kanbanMode: skip_review
  monthlyTokenCap: 2000000
  protectedBranches: true
  teaPublish: true
  defaultsOff:
    - lint-sweep
    - test-sweep
  labels:
    tier: prod
    data: pii
    pci: in-scope
  owner:
    kind: team
    name: payments
  criticality: critical

HCL (resource vulnetix_repository_settings)

# Every argument the kind supports. From config-schemas examples/RepositorySettings/advanced.yaml.

resource "vulnetix_repository_settings" "acme_payments_api" {
  name = "acme-payments-api"
  asset_labels = {
    data = "pii"
    pci  = "in-scope"
    tier = "prod"
  }
  autonomy          = "suggest"
  criticality       = "critical"
  defaults_off      = ["lint-sweep", "test-sweep"]
  kanban_mode       = "skip_review"
  monthly_token_cap = 2000000
  owner = {
    kind = "team"
    name = "payments"
  }
  protected_branches = true
  repository         = "acme/payments-api"
  tea_publish        = true
  labels = {
    team = "payments"
  }
  annotations = {
    ticket = "https://tracker.example.com/PAY-1501"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RepositorySettings.schema.json
apiVersion: vulnetix.com/v1
kind: RepositorySettings
metadata:
  name: acme-payments-api
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/PAY-1501
spec:
  repository: acme/payments-api
  autonomy: suggest
  kanbanMode: skip_review
  monthlyTokenCap: 2000000
  protectedBranches: true
  teaPublish: true
  defaultsOff:
    - lint-sweep
    - test-sweep
  labels:
    tier: prod
    data: pii
    pci: in-scope
  owner:
    kind: team
    name: payments
  criticality: critical
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly RepositorySettings	Always RepositorySettings.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.repository	string	yes		pattern ^[^\s/]+(/[^\s/]+)+$	The repository: owner/name on github.com, or host/owner/name on another forge (codeberg.org/acme/api). Matched without regard to case.
spec.autonomy	string	yes		observe, suggest, draft_pr, auto_merge_low_risk	How far the factory goes on its own in this repository, from observe (the least) through suggest and draft_pr to auto_merge_low_risk (the most, shown as approve when ready). It may not be above the tenant’s autonomy.max setting; the plan is refused when it is.
spec.kanbanMode	string	no	off	all, skip_review, off	Which kanban cards are mirrored to issues in this repository. all: every card. skip_review: a card waits until it leaves Review. off: none. It also sets the mode of the repository’s existing kanban bindings.
spec.monthlyTokenCap	integer	no		1 to 1000000000000000	The most tokens the factory may spend on this repository in a month. Left out, there is no cap of its own. Setting it creates the repository’s budget on the Budgets page; removing it removes that budget.
spec.protectedBranches	boolean	no	true		Never push to the default branch or a protected branch. Only an owner or an admin may set it to false.
spec.teaPublish	boolean	no	false		Publish the repository’s releases to TEA.
spec.defaultsOff	array of string	no	[]	items unique; each item: pr-review, ci-fix, test-sweep, lint-sweep, issue-to-pr, approve-ready, conflict-fix	The default workflows this repository opts out of, by key. Every default the tenant has on applies to the rest.
spec.labels	object	no	{}	0 to 50 keys; map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Key/value labels on the repository as an asset, such as tier: prod or data: pii. At most 50. Keys are lower case letters, digits and . _ / - (at most 63 characters, starting and ending with a letter or digit); values are at most 256 characters. In CEL: labels[‘tier’] == ‘prod’. A label dropped from the document is removed from the repository.
spec.owner	object	no		no other keys	Who owns the repository: a team, a user or an email address. In CEL, owner is the name.
spec.owner.kind	string	yes		team, user, email	team: a team name. user: a user name on the forge or in Vulnetix. email: an email address.
spec.owner.name	string	yes		length 1 to 320	The team name, the user name or the email address.
spec.criticality	string	no		low, medium, high, critical	How much the business depends on the repository: low, medium, high or critical. Left out, the repository is unclassified and criticality is empty in CEL. It is the mission and well-being input of the SSVC decision.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• metadata.name is derived from spec.repository, as for FactoryManagedOrg, and a name that does not match is refused.
• autonomy is required. Other fields default.
• Plan refuses a repository the factory does not see, an autonomy above autonomy.max, and protectedBranches: false from a caller who is not an owner or admin.
• Apply also writes the repository’s token cap budget row for monthlyTokenCap and the Kanban binding mode.
• Delete marks the row deleted, so the repository runs at autonomy.default. It removes the cap budget, clears the asset record and records an audit entry.

Asset labels, owner and criticality

labels, owner and criticality are the repository’s asset record: how the business sees it. A document owns them, so a field left out clears it. They are also set on the Repositories page, and rules select on them: they are variables of the CEL finding context, so the same finding can be urgent in one repository and routine in another; see where each expression is evaluated. The record is stored apart from the factory settings row, so classifying a repository never creates one.

• At most 50 labels. A key is lower case letters, digits and . _ / -, at most 63 characters, starting and ending with a letter or digit. A value is at most 256 characters.
• An owner has a kind (team, user, email) and a name of at most 320 characters. An email owner must be a bare address and is stored lower case.
• They need saas migration 20261228000000_repository_asset. Until it is applied they read as empty, and plan refuses a document that sets one and names the migration.

Terraform and OpenTofu

The resource is vulnetix_repository_settings in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_repository_settings.

Import an object that already exists by its name:

# Import an existing RepositorySettings by its name (metadata.name).
terraform import vulnetix_repository_settings.acme_payments_api acme-payments-api

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.