Share Bundles with Projects
A repo grant makes the bundles in an OCI repository usable by projects. Without a grant, a project cannot add a component from that bundle, even if its members can see the bundle in the catalog.
Grants match recipient projects by attribute, not by name. Tag projects once, write one grant, and every current and future project with matching attributes picks it up.
Default access for new repositories​
New repositories are restricted until a grant exists. To make every new repository usable by all projects automatically, set Default Bundle Access to ALL_PROJECTS in your organization settings. Each new repository then receives an org-wide repo:pull grant, which you can revoke like any other grant. Existing repositories are not affected.
To share individual repositories, or to share with a subset of projects, follow the steps below.
Prerequisites​
repo:granton the repository (org admins have it; otherwise add it to a group policy).- A project-scoped custom attribute if you want to target projects by tag (e.g.
team). Skip this to share by project ID or org-wide.
1. Tag the recipient projects​
Open each project that should receive the bundle, go to its Settings, and set the attribute (e.g. team = payments).
Prefer the CLI?
mass project update ecomm -a team=payments
2. Create the grant​
Find the bundle under Repositories, go to the Permissions tab, and click Add Permission. Set the recipient conditions.
Recipient conditions​
Each condition is a key and one or more values. A project matches when it has every key with one of the listed values. Add more conditions to narrow the match, add more values to widen it. Use * as the value to match any project that has the key at all.
| Share with | Key | Values |
|---|---|---|
Projects with the custom attribute team equal to payments | team | payments |
Projects with the custom attribute team equal to payments or checkout | team | payments checkout |
Only the project with the id ecomm | md-project | ecomm |
Any project that has the custom team attribute set | team | * |
| Every project in the org | * | * |
Grants can also be managed through the GraphQL API and the Terraform provider. Full matching rules are in Access Control.
3. Verify​
In a recipient project, open the Bundles panel on the canvas and add a component from the shared bundle. If the bundle is missing or the add fails, check:
- The project's attributes match the grant's conditions.
- Your group has
repo:viewon the repository (grants control use; policies control view).
Revoke​
Grants are immutable. To change one, delete it from the repository's Grants tab and create a new one.