Setting up an organization's access policy in SourceCraft

Using an access policy, you can set restrictions for an organization and its resources as code (Configuration as Code). The configuration is stored in the .sourcecraft/policies.yaml file on the default branch of a special repository named .sourcecraft.

Warning

Access policies are available only with a paid subscription.

Configuration of .sourcecraft/policies.yaml

The example includes all restrictions and specifies a list of allowed networks. Replace the demonstration networks in the ip_allowlist with your organization's networks:

policies:
  admin_only_repository_creation: true
  anonymous_public_access_disabled: true
  public_visibility_changes_disabled: true
  non_federative_invitations_disabled: true
  ip_allowlist:
    - 192.0.2.0/24
    - 2001:db8::/32

The policies section contains a list of allowed networks and the following logical parameters:

Parameter

Restricted if the value is set to true

admin_only_repository_creation

Only organization administrators can create repositories.

anonymous_public_access_disabled

Unauthenticated access to the organization's public resources is prohibited both in the browser and when using Git over HTTP(S).

public_visibility_changes_disabled

It is prohibited to set public visibility for the organization, its projects and repositories, including when creating resources.

non_federative_invitations_disabled

Invitations to non-federated users (those without a federation ID) ​​are prohibited, including invitations via email and nickname. For more information, see SAML-compatible identity federations.

To enable the restriction, set the parameter to true. To disable, set to false. By default, all restrictions are disabled.

Note

Once enabled, restrictive policies apply only to new resources and actions.

For example, after enabling the public_visibility_changes_disabled policy, previously created public repositories will remain public.

Similarly, after enabling the non_federative_invitations_disabled policy, previously added non-federated users are not removed from the organization.

List of allowed networks

The policies.ip_allowlist parameter specifies the list of client networks from which access to the organization's resources is permitted. IPv4 and IPv6 networks in CIDR format are supported. Networks are converted to canonical form; duplicate records are rejected.

Warning

Before enabling filtering, ensure that the list contains the network from which you are connecting. Organization administrators are not exempt from IP address verification.

If the ip_allowlist parameter is missing or contains an empty list, IP address filtering is disabled. To disable previously configured filtering, set ip_allowlist: [] within the policies section and save the changes to the default branch.

Specifics of using the list:

  • The list is updated after changes pushed to the default branch are processed. In the event of an update error, the previous rules are retained.
  • Requests originating from configured internal service networks and specific system background operations are exempt from the check.
  • Requests using signed URLs undergo IP address verification, with the exception of Git LFS signed URLs. Using the Git LFS link you have already received, you can get the file from an IP address outside the list of allowed networks. You cannot get a new link from such an address.
  • Previously cached public RAW files and repository archives may remain available until the cache expires; this can take up to five minutes.
  • If the organization does not renew its paid subscription, access ceases to be restricted.

Network restrictions for CI/CD, AI coworkers, and security scanning

IP address filtering applies to CI/CD. If worker networks are not included in the allowlist, CI/CD stops working. Along with CI/CD, AI coworkers and security scanning stop working.

To run CI/CD on custom workers, add to the policies.ip_allowlist the networks from which these workers access SourceCraft.

To restore CI/CD operations on workers provided by SourceCraft, as well as AI workers and security scanning, add the public IP address ranges of Yandex Virtual Private Cloud to the policies.ip_allowlist. SourceCraft workers use addresses from these ranges.

Warning

These ranges are also used by virtual machines belonging to other Yandex Cloud users. If entire ranges are added, requests from such virtual machines will pass the allowlist check. This weakens the network restriction on access to the organization's resources.

To set up an organization's access policy in SourceCraft:

  1. Create the .sourcecraft repository.
  2. Configure the access policy.
  3. Check the configuration.

Creating the .sourcecraft repository

If the organization does not yet have the .sourcecraft repository, create it. To configure policies, you will need access to this repository and the ability to make changes to its default branch.

Configure the access policy

  1. Open the SourceCraft home page.
  2. Go to the Organizations tab and select an organization.
  3. On the organization page, under  Settings, go to the  Configurations section.
  4. Click Blank configuration on the Organization policies card.
  5. Fill in the .sourcecraft/policies.yaml file based on the configuration example, selecting the appropriate restrictions.
  6. In the top-right corner, click Commit changes.
  7. In the window that opens, configure the procedure for changes:
    • In the Commit message field, give a comment that will describe the changes you make.
    • Under Commit branch, select the default branch.
    • Under After commit action, select Just commit.
  8. Confirm your changes.

  1. Clone the .sourcecraft repository and navigate to its folder.

  2. Switch to the default branch:

    git switch <default_branch>

  3. Create a folder and a configuration file:

    mkdir -p .sourcecraft
nano .sourcecraft/policies.yaml

  4. Fill in the file based on the configuration example, selecting the appropriate restrictions, and save it.

  5. Add the file to the Git index, commit, and push the changes to the default branch:

    git add .sourcecraft/policies.yaml
git commit -m "Configure organization access policies"
git push origin <default_branch>

If the changes pass code review, save the configuration in a separate branch and create a pull request. The policies will be applied after merging into the .sourcecraft repository's default branch.

Checking the configuration

  1. On the organization's page, open Settings → Configurations.
  2. Find the Organization policies card and ensure that the Active status is displayed. If the configuration contains errors, fix the file and save the changes to the default branch.

To change the policies, edit the .sourcecraft/policies.yaml file in the .sourcecraft repository and save the changes to the default branch.

Useful links

Previous
Changing organization settings
Next
Sending and accepting an invitation to an organization