Decommission GitHub management script

.github/dependabot.yml

@@ -11,7 +11,7 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "uv"
-    directory: "/"
+    directory: "/repoupdater"
     schedule:
       interval: "weekly"
       day: "wednesday"

README.md

@@ -1,112 +1,10 @@
 # OpenSAFELY Sysadmin Tools
 
-This repository contains the documentation and scripts used to manage
-the OpenSAFELY Github organisation's users, teams, repos and
-permissions.
+A collection of sysadmin things.
 
-Github's organisation features are somewhat limited. Repositories are
-flat, no grouping, so each repo needs explicitly adding to a team, at an
-explicit permissions level. This makes managing this via the UI
-laborious and and error prone.
-
-This repo include config and scripts to manage the teams and repos via
-the Github API.
-
-The high level goal to protect against injection of code via github into
-any part of the OpenSAFELY systems. To reduce risk, we to separate the
-sensitive infrastructure repos out from the ever-growing list of
-study repos, and restrict write access to the senstive repos to a
-smaller technical team.  As there is no repository grouping, this is
-done via explicit config stored in this repo.
-
-There are two teams. Researchers have admin access to all study repos.
-Developers have admin access to all protected infrastructure repos, and
-are also in Researchers team.
-
-All master/main branches are protected, even for admins. This disables
-force-pushes from anywhere.
-
-Additionally, protected repos require code review, and signing. This
-prevents pushes to master/main without a review.
-
-# Readonly Classic PATs
-
-At the time this system was implemented, Github only had classic PATs. And
-whilst these supported a readonly scope for public repos, if you wanted private
-repo access, you *had* to have write access too. However, it was not acceptable
-for job-server or job-runner to have write access.
-
-So, in order to acheive a readonly opensafely org PAT, we:
-
-a) lowered the base permissions for the opensafely org to read (they were admin!)
-b) added the machinery described above to elevate approved users permissions to be able to *write*.
-c) created an opensafely-readonly bot account, that was *not* included in the machinery above
-c) use this bot use to create PATs for job-server and job-runner.
-
-Over time, this readonly user has also been used to create issues in various
-private repo, so is also a collaborator on specific repos in ebmdatalab org as well.
-
-# System prerequisites
-
-## Just
-
-We use [`just`](https://github.com/casey/just) as our command runner. It's
-a single file binary available for many platforms so should be easy to
-install.
-
-```sh
-# macOS
-brew install just
-
-# Linux
-# Install from https://github.com/casey/just/releases
-
-# Add completion for your shell. E.g. for bash:
-source <(just --completions bash)
-
-# Show all available commands
-just #  shortcut for just --list
-```
-
-## uv
-
-Follow installation instructions from the [uv documentation](https://docs.astral.sh/uv/getting-started/installation/) for your OS.
-
-## Python
-
-You'll need an appropriate version of Python on your PATH. Check the
-`.python-version` file for the required version.
-
-# Setup
-
-Create virtual environment, .env file and install requirements.
-```
-just devenv
-```
-
-* Create a GitHub personal access token with admin:org permissions, and update
-  it the `ORG_TOKEN` variable in the `.env` file.
-
-
-# Run
-
-Ensure you have a GH PAT with org admin permissions in `.env`
-
-`just manage-github` will run the command in dryrun mode, printing changes it would have made
-
-`just manage-github --exec` will actually apply the changes.
-
-
-# Cron Job
-
-The management script is designed to run periodically. However, it uses a very
-privileged secret, so it currently runs from Simon's home machine.
-
-Run set up a cronjob yourself, you can use `cronjob.sh`. First, edit the `tokenfile` variable to
-point a file with a GH PAT that has admin org permissions.
-
-Then, set it to run every hour at n minutes past the hour via `crontab -e` or similar.
-e.g. to run at 17m past each hour:
-
-`17 * * * * /path/to/cronjob.sh >> /path/to/logfile.log 2>&1`
+This contains:
 
+* documentation in `adr/`
+* `repoupdater` a utility to help manage multiple repositories in
+  `repoupdater/`
+* configuration for small services in `services/`