Matrix of sub-orgs?

[gbudge]

Hi All,

I'm hoping I can get some help or suggestions for the following.

I have lots of repos that are owned by different teams and of these repos, there's a high degree of technology stack overlaps so things like the PR checks are identical, but there are some repos that are unique to a particular squad.

Problem

I want to enforce consistency of the repo configurations like this:

1. Baseline configuration, applied to all repos.
2. Tech stack specific configuration, applied to repos using that stack.
3. Squad-based access using GitHub Teams, applied to their repos only.

Example

I've tried to explain this better using a matrix.

Repo	Tech Stack	Team 1	Team 2	Reviews	Check 1	Check 2	Check 3	Check 4
app1-aws	CloudFormation	Managers	Squad1	3	Snyk	cfn-lint	Wiz
app1-web	HTML5+JS	Managers	Squad1	2	Snyk	ES Lint	SonarQube	Prettier
app1-eks	Helm	Managers	Squad1	2	Snyk	helm lint
app2-cli	Python	Managers	Squad2	2	Snyk	Pylance	SonarQube
app3-aws	CloudFormation	Managers	Squad3	3	Snyk	cfn-lint	Wiz
app3-web	Java	Managers	Squad3	2	Snyk	PMD	SonarQube
app3-eks	Helm	Managers	Squad3	2	Snyk	helm lint

Envisaged Configuration

Ideally I would like to define a set of configuration files that essentially are unioned together against each repo, making it easy to manage as repos and teams change over time.

baseline.yml + <tech-stack>.yml + <squad>.yml

Baseline Configuration

# baseline.yml
suborgrepos:
  - app1-aws
  - app1-web
  - app1-eks
  - app2-cli
  - app3-aws
  - app3-web
  - app3-eks
teams:
  # grant Managers team
rulesets:
  # require Snyk

Tech Stack Configuration

# cloudformtion.yml
suborgrepos:
  - app1-aws
  - app3-aws
rulesets:
  # require cfn-lint, wiz
  # require 3 reviews

# helm.yml
suborgrepos:
  - app1-eks
  - app3-eks
rulesets:
  # require helm lint
  # require 2 reviews

# python.yml
suborgrepos:
  - app2-cli
rulesets:
  # require pylance and sonarqube
  # require 2 reviews

# java.yml
suborgrepos:
  - app3-web
rulesets:
  # require pmd and sonarqube
  # require 2 reviews

Squad Configuration

# squad1.yml
suborgteams:
  - squad1
teams:
  # grant squad1 team

# squad2.yml
suborgteams:
  - squad1
teams:
  # grant squad2 team

# squad3.yml
suborgteams:
  - squad3
teams:
  # grant squad3 team

Question

Is this at all possible with SafeSettings?

I know this is a long post, but hopefully I've explained it adequately.

@decyjphr do you know?

[decyjphr]

@gbudge Safe-settings currently does not support multiple sub-org configs targeting a repo. It treats such conditions as an error and reports it. So it is only possible to do this by having individual suborg configs -- 7 of them! -- for each combination.

I do think that this is not a technical limitation. But the difficulty is to create the logic that could combine and apply the most restrictive combination of the settings to the repo.