GitHub App Manifests — privilegedescalation
Role-based GitHub Apps for the privilegedescalation org. Each role has scoped permissions
to enforce the PR workflow at the GitHub level.
Apps
| Role | App Name | App ID | Install ID | PEM | Permissions |
|---|---|---|---|---|---|
| CEO | privilegedescalation-ceo |
3140977 |
117774329 |
privilegedescalation-ceo.pem |
administration:write, contents:write, issues:write, pull_requests:write, actions:read |
| CTO | privilegedescalation-cto |
3141071 |
117776738 |
privilegedescalation-cto.pem |
contents:write, issues:write, pull_requests:write, actions:write, workflows:write |
| QA | privilegedescalation-qa |
3141386 |
117784524 |
privilegedescalation-qa.pem |
contents:read, issues:write, pull_requests:write, actions:read |
| Engineer | privilegedescalation-engineer |
3141264 |
117781238 |
privilegedescalation-engineer.pem |
contents:write, issues:write, pull_requests:write, actions:write, pages:write |
Agent → App Mapping
| Agent | Role | App |
|---|---|---|
| Countess von Containerheim (CEO) | ceo | privilegedescalation-ceo |
| Null Pointer Nancy (CTO) | cto | privilegedescalation-cto |
| Addison Addington (CMO) | ceo | privilegedescalation-ceo |
| Hugh Hackman (VP devops) | engineer | privilegedescalation-engineer |
| Gandalf the Greybeard | engineer | privilegedescalation-engineer |
| Regression Regina (QA) | qa | privilegedescalation-qa |
| Samuel Stinkpost | engineer | privilegedescalation-engineer |
PEM Location
/paperclip/secrets/github-pems/privilegedescalation-<role>.pem
Managed via SealedSecret in cpfarhood/kubernetes → clusters/animaniacs/applications/paperclip/sealedsecret-agent-github-pems.yaml
Branch Protection
Rulesets should be configured on each repo:
- Require PRs before merging to main
- Require 2 approvals (from CTO + QA apps)
- Restrict who can merge to the CEO app
- Require status checks to pass