Audit only¶

This configuration defines compliance checks but no defaults, types, or repository overrides. It is suitable when visibility should precede policy enforcement.

Configuration¶

octoform.yml

# octoform used purely as a compliance report, with no `defaults` or `types`
# at all. `audit` never needed them — it checks against `audit:` rules, which
# are the only thing declared here — so this is a legitimate, complete way to
# use octoform: inventory and flag drift, apply nothing, ever.
#
# Try it against your own organisation or account — replace `org-name` below:
#   export GITHUB_TOKEN=...
#   octoform audit --config octoform.yml

owner: org-name

audit:
  require_type: false # nothing sets a type in this file, so do not flag its absence
  require_description: { visibility: public }
  require_topics: { visibility: public }
  max_topics: 20

Download YAML

What it reports¶

Public repositories without a description.
Public repositories without topics.
Repositories with more than 20 topics.
No missing type finding, because require_type is explicitly disabled.

Run octoform audit --config octoform.yml. The audit command observes and reports; it does not build an apply queue. Because this file also declares no desired policy, invoking apply cannot infer mutations from the audit rules.

When to use it¶

Use this shape to establish a fleet baseline, introduce scheduled reporting, or discover metadata debt before deciding which settings Octoform should own.