Config Protection Plugin

A UbiquityOS plugin that protects configuration files from unauthorized modifications by restoring only the protected files changed by users without admin or billing_manager access.

How It Works

1. Listens for push events on the repository default branch.
2. Detects protected config paths such as .ubiquity-os.config.yml and .github/ubiquity-os.config.yml.
3. Verifies the committer's privileges by checking repository collaborator permission and organization billing role access.
4. Creates a focused revert commit that restores only the protected config files touched by the unauthorized push.

Why This Version Is Safer

• It preserves unrelated files from the same push instead of rolling the whole tree back to the parent commit.
• It checks billing_manager through organization role membership rather than assuming the regular membership API exposes that role directly.
• It includes regression tests for authorized writes, unauthorized writes, and partial file restoration behavior.

Configuration

Setting	Type	Default	Description
protectedConfigPaths	string[]	.ubiquity-os.config.yml, .ubiquity-os.config.yaml, ubiquity-os.config.yml, ubiquity-os.config.yaml, .github/ubiquity-os.config.yml, .github/ubiquity-os.config.yaml	Config paths the plugin will guard
allowedRoles	string[]	admin, billing_manager	Roles allowed to change protected config files

Example Configuration

protectedConfigPaths:
  - .ubiquity-os.config.yml
  - .github/ubiquity-os.config.yml
allowedRoles:
  - admin
  - billing_manager

Events

• push - monitors default-branch pushes for protected config changes

Revert Behavior

When an unauthorized modification is detected:

1. The plugin loads the unauthorized commit and its parent commit.
2. It resolves the current default-branch head.
3. It reconstructs only the protected files from the parent tree.
4. It creates a new commit on top of the current default-branch head.
5. It updates the branch reference to the new revert commit.

Local Verification

npm test -- --runInBand
npm run build