KabaForge13 β Repository administration and security
This chapter covers the Settings tab: who can do what, what is protected, and the life cycle of a repository.
Collaborators and permissions
Add people under Settings β Collaborators:
| Permission | What they can do |
|---|---|
| Read | View, open issues, comment |
| Write | Push commits, create branches, merge pull requests |
| Admin | Settings, collaborators, branch rules |
In organisation repositories, grant access to a team rather than a person; when people change, you update one place.
Protecting main
Settings β Branches β Add rule β recommended as soon as more than one person works in the repository:
- Block direct pushes β every change goes through a pull request.
- Require approvals β at least one review before merging.
- Block force pushes β history cannot be rewritten.
- Status checks β no merge while Actions are not green (chapter 12).
Visibility and life cycle
- Visibility β you can switch between Public and Private at any time.
- Rename β the old address breaks; update links you have shared.
- Transfer ownership β move the repository to another user or organisation.
- Archive β the repository becomes read-only; this is the right way to freeze instead of delete.
- Delete β under Danger Zone, requires typing the name and cannot be undone.
If you are unsure, do not delete β archive.
Webhooks
Settings β Webhooks posts JSON to an address you choose when something happens (commit, issue, pull request). Use it for chat notifications or to trigger your own deployment script. Every webhook keeps a recent deliveries log β look there when debugging.
Deploy keys
If a server only needs to read the repository, do not give it your personal SSH key: add a repository-specific, read-only key under Settings β Deploy Keys. Even if that server is compromised, the blast radius is one repository.
Your tokens and keys
- Avatar β Settings β Applications β create and revoke tokens (chapter 10).
- Avatar β Settings β SSH Keys β the machines you use.
- Delete tokens you no longer use and keys from old machines; that is your exposure surface.
- Account password, two-factor authentication and sessions live on the KabaForce ID side (chapter 01).
Good habits
- Never put secrets in a repository; if one slips in, change the secret itself (chapter 08).
- Think about history before making a private repository public β old commits become visible too.
- Remove a departing person's collaborator access and tokens the same day.