From 435995cc5207e4391415e99de76781ca7ef6d5f3 Mon Sep 17 00:00:00 2001 From: XV Date: Wed, 30 Sep 2026 12:25:37 -0400 Subject: [PATCH] Prevent unapproved GitHub charges --- openwiki/gh-settings.md | 4 +- plugins/gh-settings/skills/sync/SKILL.md | 4 ++ .../skills/sync/references/standard.md | 48 +++++++++++++++++-- 3 files changed, 51 insertions(+), 5 deletions(-) diff --git a/openwiki/gh-settings.md b/openwiki/gh-settings.md index 90fca04..34bbe74 100644 --- a/openwiki/gh-settings.md +++ b/openwiki/gh-settings.md @@ -20,7 +20,9 @@ metadata, and canonical governance standard. It has no executable runtime. Use the [skill](../plugins/gh-settings/skills/sync/SKILL.md) for task scope and the [standard](../plugins/gh-settings/skills/sync/references/standard.md) for team -policy. The standard covers scope and authority, security profiles, dependency +policy. For free-feature and cost-control requests, read the standard's +[Prevent Additional Charges](../plugins/gh-settings/skills/sync/references/standard.md#prevent-additional-charges) +section. The standard covers scope and authority, security profiles, dependency submission, Dependabot defaults, rulesets, merge policy, other settings, and reconciliation. Load the sections relevant to the requested profile; a complete governance audit uses the whole standard. diff --git a/plugins/gh-settings/skills/sync/SKILL.md b/plugins/gh-settings/skills/sync/SKILL.md index 06f66be..a59e071 100644 --- a/plugins/gh-settings/skills/sync/SKILL.md +++ b/plugins/gh-settings/skills/sync/SKILL.md @@ -10,6 +10,10 @@ scope and authority sections plus the controls needed for the requested profile; read the full standard for a comprehensive governance audit. Check current GitHub documentation for control availability and billing. +For free-feature or cost-control requests, also read the standard's +`Prevent Additional Charges` section. Preventing unapproved charges is an +acceptance condition, not a conclusion from feature toggles alone. + Organization-wide work puts controls at the highest sufficient authorized scope. Repository-scoped work keeps parent state read-only. Preserve the distinction between enforced parent policy and repository-overridable defaults. diff --git a/plugins/gh-settings/skills/sync/references/standard.md b/plugins/gh-settings/skills/sync/references/standard.md index be688d3..dabd9d8 100644 --- a/plugins/gh-settings/skills/sync/references/standard.md +++ b/plugins/gh-settings/skills/sync/references/standard.md @@ -42,10 +42,45 @@ push protection, and paid dependent features unless separately authorized. Keep malware alerts within their supported ecosystems and delegated dismissal disabled when it requires a paid product. -Code Quality is separate from CodeQL and Code Security. Check its account allowance, -repository access, and enforcement when in scope. A `No repositories` policy must -not start scans or incur charges; leave it disabled and report a gap if GitHub -cannot enforce that state without enablement. +Code Quality is separate from CodeQL and Code Security. For a no-extra-cost +profile, keep it disabled on public and private repositories. At Enterprise scope, +verify organization access is unavailable and repository administrators cannot +enable it. Where organization controls remain available, require `No repositories` +with `Enforce access`; the default alone does not disable repository opt-ins. +Read back effective repository analysis as off. Never enable the product to expose +a hidden control or complete verification. + +### Prevent Additional Charges + +Preserve the authorized base subscription and seat allowance. The acg-box baseline +allows one GHEC seat and no additional paid products or metered charges unless the +user changes that profile. Keep confirmed free features. Trials, discounts, +included quotas, and public visibility do not prove that a feature and its +dependent Actions, storage, or AI workloads cannot incur charges. + +Within the authorized scope, disable unapproved paid products and use parent +enforcement to prevent lower scopes from enabling them again. For retained metered +services, verify a supported zero-paid-spend stop while preserving included free +usage where supported. Report an uncovered cost risk instead of enabling a feature +with uncertain billing to maximize security coverage. + +Budgets supplement product controls. Verify current product/SKU support, units, +scope, exclusions, and stop-usage enforcement. Alert-only budgets do not cap use; +GHEC license budgets cannot prevent additional seats. Do not assume Code Quality +supports a budget or that a GHAS budget disables existing paid enablement. Recheck +provider capabilities instead of treating historical API limitations as permanent. + +For account-wide cost audits, inspect consumed licenses and billable usage, +including outside collaborators and invitations that can add seats. Cost control +does not authorize removing people or repository access. Report excess seats and +the proposed access change unless that exact change is already authorized. + +Verify effective product state, restrictions on re-enablement, and current-period +net charges separately. Account for reporting delay, usage before a budget existed, +and license charges that continue after disablement or user removal. Current +consumed seats do not establish the period's billable seats. Report remaining +charges and gaps; do not promise a monthly total or zero future charges from +current settings, absent usage records, or partial-period totals alone. ### Automatic Dependency Submission @@ -168,5 +203,10 @@ Use current official documentation for the controls involved: - [Actions permissions](https://docs.github.com/en/rest/actions/permissions); and - [GraphQL](https://docs.github.com/en/graphql/reference). +For cost controls, consult [budgets and alerts](https://docs.github.com/en/billing/concepts/budgets-and-alerts), +[Code Quality disablement](https://docs.github.com/en/code-security/how-tos/maintain-quality-code/disable-code-quality), +[Enterprise Code Quality policy](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise), +and [enterprise license billing](https://docs.github.com/en/enterprise-cloud@latest/billing/concepts/enterprise-billing/usage-based-licenses). + Consult the relevant product documentation for billing, default precedence, attachment compatibility, and automatic dependency submission prerequisites.