GitHub Access Governance with Pulumi.
_This is a submission for thePulumi Deploy and Document Challenge: Get Creative with Pulumi and GitHub_
## Introduction
Managing user access in GitHub at scale is not easy, especially when you have to handle multiple repositories, teams, and permissions across an organization. It becomes even more challenging when you need to ensure security and compliance.
That's where Pulumi comes in. It's a powerful Infrastructure as Code (IaC) tool that allows you to define and enforce access policies using familiar programming languages like Python, TypeScript, and Go. Instead of manually managing permissions, you can automate everything with code, making it more efficient and scalable.
## What I Built
I wanted to build a fully automated system where permissions could be managed easily without logging into GitHub every time.
With this project, you can define all your user roles and repository access in a simple YAML file, and Pulumi, along with Python & GitHub Actions, will take care of the rest!
This is useful for startups, enterprises, open-source projects, or anyone who wants hassle-free, scalable GitHub access management.
## Live Demo Preparation
**_Note:_** _Make sure pulumi installation is done before. if not kindly refer_ https://www.pulumi.com/docs/iac/download-install
Follow these steps to see the project in action:
### 1️⃣ **Clone the Repository**
git clone https://github.com/Ajanhari/pulumi-github-access-governance.git
cd pulumi-github-access-governance
### 2️⃣ **Set Up Pulumi and Install Dependencies**
pip install pulumi pulumi-github pyyaml
### 3️⃣ **Configure Pulumi for Your GitHub Organization**
# Login to Pulumi locally
pulumi login --local
# Set GitHub Personal Access Token (Replace with actual token)
pulumi config set --secret githubToken "<YOUR_GITHUB_PERSONAL_ACCESS_TOKEN>"
# Initialize a new Pulumi stack named "dev"
pulumi stack init dev
# Set GitHub organization/owner (Replace 'YourOrgName' with your actual org)
pulumi config set github:owner "YourOrgName"
# Set GitHub API Base URL
pulumi config set github:baseUrl "https://api.github.com"
### 4️⃣ **Modify`users.yaml` to Assign Roles**
Edit the file and add/remove users based on your requirements.
repositories:
repo1:
admin:
- Ajanthan
- Sachin
maintain:
- maintainer1
write:
- Varun
- dev2
triage: []
read: []
repo2:
admin:
- Ajanthan
- Sachin
write:
- Varun
### 5️⃣ **Deploy Changes**
pulumi up --yes
### 6️⃣ **Verify in GitHub**
Check your GitHub repository settings to confirm the updated access permissions.
### 7️⃣ **Automate with GitHub Actions**
Push the updated `users.yaml` file to the repository and let GitHub Actions handle the provisioning.
git add users.yaml
git commit -m "Updated user roles"
git push origin main
GitHub Actions will automatically apply the changes.
## Project Repo
https://github.com/Ajanhari/pulumi-github-access-governance
## Advantages
* **Centralized User Management** – Assign access in one YAML file.
* **Automated Access Control** – No manual intervention required.
* **Scalability** – Works for hundreds of repositories.
* **Compliance & Security** – Logs changes via GitHub Actions.
## Final Thoughts
If you're managing multiple GitHub repositories and looking for a way to automate access governance, Pulumi is definitely worth exploring. It brings the power of Infrastructure as Code to GitHub, making permission management easier, scalable, and more reliable.