Skip to content

Running the platform from your own organization

The platform is built to run outside NRIT's GitHub organization: a managed service provider stands up customer landing zones in its own organization, with its own runners, identities, and repositories. Three things make that work, and only one of them involves NRIT.

What is public

  • The entrypoint nrit-solutions/tf-pr-ops: the reusable workflows, the dispatch action, and the caller examples, tagged with the engine version. Your callers reference it directly; GitHub needs no access grant for a public repository.
  • The template nrit-solutions/nrit-alz-customer-template, Apache-2.0. The bootstrap generates each customer repository from it (template_repository in the tfvars, which defaults to it).
  • The bootstrap and everything the docs describe. The bootstrap runs against your Azure tenant and your GitHub organization with your own operator token (repo and admin:org there; nothing on NRIT's side).

What NRIT issues: the engine App

The engine core, nrit-tf-pr-ops, is private. Every job checks it out at the pinned version and downloads the prebuilt tfpr binary from its release, with a short-lived token minted from a GitHub App. NRIT creates one App per organization, installs it on the NRIT organization with Contents: read on the core only, and hands you its client id and private key. You set them on every customer repository as ENGINE_APP_CLIENT_ID and ENGINE_APP_PRIVATE_KEY; the bootstrap does that from engine_app_client_id and TF_VAR_engine_app_private_key.

Nothing is installed on your organization for this. The App can only read the core, and revoking your organization's access is uninstalling the App on NRIT's side. Rotation is a second key on the same App: NRIT issues it, you update the secret, NRIT deletes the old key.

What stays yours

  • The checks App. The engine's check rows, the merge gate included, are written under a GitHub App you create in your own organization, so they carry your heading. See the checks App.
  • The runners App for the self-hosted posture, also yours. See the runners GitHub App.
  • The customer repositories, their state, identities, and runners. Every pin in them is an explicit commit; nothing changes behind your back.

Order of work

  1. Ask NRIT for your engine App credentials.
  2. Create the checks App in your organization, and the runners App if you run the self-hosted posture.
  3. Follow First plan to first apply with your own organization, tenant, and token. The only NRIT value in the tfvars is the engine App client id.