Docs

Appearance

kobe-bot Setup and Verification ​

Purpose: Setup and verification guide for the kobe-bot GitHub member account used by Kobe for automated commits and PR operations.

Owner: Rory Audience: Rory

Purpose of kobe-bot ​

kobe-bot is a GitHub member account (not owner) in the Cirius-Group-Inc org. It is the identity Kobe uses when making automated commits and opening PRs. Keeping automated commits separate from Rory's personal account enables clean audit trails — you can tell at a glance which commits were AI-assisted.

Account details:

  • GitHub username: kobe-bot
  • Org role: Member (not Owner)
  • Credentials: Keeper → Service Accounts → kobe-bot GitHub (username, password, TOTP seed)

Required Repository Access ​

RepositoryAccess LevelReason
bedrock-docsWriteKobe opens docs PRs
ops-automationWriteKobe opens ops PRs
bedrock-hubWriteKobe opens SecOps PRs
azure-infraReadContext only — Kobe never pushes
aws-infraReadContext only — Kobe never pushes
azure-dde-infraReadContext only — Kobe never pushes
palo-alto-configsNoneHandled by Rory directly

Verification Checklist ​

Run through this checklist whenever kobe-bot behavior seems off or after a GitHub org change.

1. Confirm org membership ​

GitHub → Cirius-Group-Inc → People → search kobe-bot

Expected: kobe-bot appears with role Member (not Owner)

2. Confirm repo access levels ​

For each writable repo (bedrock-docs, ops-automation, bedrock-hub):

  • Repo → Settings → Collaborators and teams → search kobe-bot
  • Expected: Write access

For read-only repos (azure-infra, aws-infra, azure-dde-infra):

  • Expected: Read access or access via team membership

3. Confirm branch protection on main ​

For each writable repo → Settings → Branches → main:

  • Require a pull request before merging: enabled
  • Require status checks to pass: enabled (CI must pass)
  • Do not allow bypassing the above settings: enabled
  • Allow auto-merge: enabled (kobe-bot PRs auto-merge after CI passes)

Test: attempt to push directly from kobe-bot to main → should be rejected with "protected branch" error.

4. Confirm kobe-bot is NOT an org owner ​

GitHub → Cirius-Group-Inc → Settings → Members → check kobe-bot role. Must be Member.

If kobe-bot ever appears as Owner, downgrade immediately:

  • Org Settings → Members → kobe-bot → Change role → Member

5. Confirm a recent kobe-bot PR exists ​

In any writable repo → Pull Requests → Closed → filter by author kobe-bot. Verify at least one PR was successfully merged recently.

6. Confirm auto-merge is working ​

A kobe-bot PR that passed CI should auto-merge without Rory clicking anything. Check: recent merged kobe-bot PRs — were they merged by the auto-merge bot or by Rory manually?

If Rory is manually merging kobe-bot PRs: check .github/workflows/auto-merge.yml is present and the workflow has write permissions on the repo.

Personal Access Token (PAT) ​

kobe-bot authenticates to GitHub via a PAT stored in Azure Key Vault:

  • Key Vault: cirius-openai-kv-prod
  • Secret name: github-kobe-bot-pat
  • PAT scopes: repo (read + write), workflow

Rotation cadence: Annually in January.

Rotation procedure:

  1. Sign in to GitHub as kobe-bot (credentials in Keeper)
  2. Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token
  3. Scopes: Contents: Read and write, Pull requests: Read and write, Workflows: Read and write
  4. Set expiry to January of next year
  5. Update Key Vault:
    bash
    az keyvault secret set \
  --vault-name cirius-openai-kv-prod \
  --name github-kobe-bot-pat \
  --value "<new-token>"
  6. Test: trigger a Container Apps Job run and verify a kobe-bot commit succeeds in the next cycle
  7. Revoke the old PAT in GitHub settings after confirming the new one works

If kobe-bot Is Locked Out ​

  1. Sign in to GitHub using the kobe-bot credentials in Keeper (password + TOTP)
  2. If 2FA is unavailable: use the recovery codes in Keeper → kobe-bot GitHub → Recovery codes
  3. If the account is suspended by GitHub: contact GitHub Support via Rory's GitHub account

Security Notes ​

  • kobe-bot has repo scope PAT — it can read all repos it has access to. Do not grant it access to repos with secrets unless necessary
  • kobe-bot commits will appear in audit logs as kobe-bot — this is expected and correct
  • If a kobe-bot commit contains something unexpected, check the Container Apps Job logs for that run — the orchestrator logs what each agent did
  • kobe-bot should never be given org admin permissions, billing access, or access to GitHub Secrets at the org level
  • runbooks/github-org-management.md — general GitHub org management
  • cicd/pipeline-overview.md — CI/CD pipeline that kobe-bot PRs go through
  • cicd/auto-merge.md — auto-merge workflow configuration

Internal use only — Cirius Group