Future and roadmap

[martinm82]

Hi all,

We are currently investigating the best way to manage our GitHub organization and its underlying repositories (and not only). We started some time ago with Terraform and the GitHub provider (https://registry.terraform.io/providers/integrations/github/5.8.0). Since we want to provide users the best and easiest way of managing/configuring their repositories we continued looking for further alternatives and found this Probot app (kudos to the maintainers and authors for creating this great app. It's really a great app, easy to setup and use 💯)

What are the future plans of this app. Is the app mainly focusing on the repositories or are there plans as well to support managing organization/enterprise settings, app integrations, creating of apps, etc.?

I am asking because we are looking into managing everything (enterprise, organization, repositories) and for now we have several ways to solve this:

Plain REST API using Typescript, Octokit and co.
Terraform GitHub Provider (a layer on top of the first one)
Terragrunt on top of Terraform to improve UX and provide a Yaml based interface for users. This would require some additional effort to implement (especially the overriding feature that comes out of the box in safe-settings).
cdktf which puts one more layer on top of Terraform but gives us more flexibility for missing features that we could implement in Typescript/Python/etc.
safe-settings for repositories + one of the options above
Knowing a bit the direction in which this project will go in the (near) future would help us making a decision.

Looking forward for you feedback.

[decyjphr]

Limitations of the current app that would be addressed if it is native in GitHub.

• There is an operational overhead for the installation and maintenance.
• The GitHub apps have a rate limit - 12500, or for enterprises, 15000 requests/hour
• The permissions available to a GitHub app allow it to only manage settings for repositories and its resources. As pointed out by @martinm82, it doesn't manage settings for Enterprise or org.
  • It can be installed as a public app and have one instance manage policies for all the repos in all the orgs within an enterprise but that model is better suited for enterprise server, and the above limitations remain.
  • New settings that could potentially be added to safe-settings
    • Settings for code-scanning, secret scanning, and dependabot alerts (Which alerts fail checks, cannot be dismissed, etc.)
    • Settings for apps
    • Managing CODEOWNERS
• Safe-settings cannot act when certain settings are changed and it is not aware of it. This happens because there are no Webhook events for those actions.
• It is an open-source application and not officially supported by GitHub.

[martinm82]

Thanks for the input. Is there anything we can do to get more attention from GitHub side?

[decyjphr]

There is an internal effort at Github to provide these natively. But it is being scoped and it is not yet a roadmap item. Your GitHub rep would be able to take your feedback to the product/engineering teams.