GitOps Configuration

GitOps (federated) configuration lets your team maintain its own config repository. This provides more autonomy while still respecting organization security boundaries.

When to Use GitOps

• Medium to large teams
• Frequent configuration changes
• Teams want PR-based review process
• Need version history for compliance
• Different teams need different update cycles

How It Works

GitOps Federation Flow

Setting Up

1. Create your team’s config repository

   Create a new repository (public or private) to hold your team’s config.

   • Directorybackend-team-scc-config/

     • team-config.json
     • README.md

2. Create team-config.json

   team-config.json

   {
     "schema_version": "1.0.0",
     "enabled_plugins": [
       "scc-safety-net@sandboxed-code-official",
       "java-analyzer@internal-marketplace"
     ]
   }

3. Ask org admin to configure federation

   The org config needs to point to your repository:

   org-config.json (org admin adds this)

   {
     "profiles": {
       "backend": {
         "config_source": {
           "source": "github",
           "owner": "acme",
           "repo": "backend-team-scc-config"
         },
         "trust": {
           "inherit_org_marketplaces": true,
           "allow_additional_marketplaces": false
         }
       }
     }
   }

4. Validate your config

   scc team validate --file team-config.json

Source Types

GitHub

"config_source": {
  "source": "github",
  "owner": "org-name",
  "repo": "team-config-repo",
  "branch": "main",
  "path": "team-config.json"
}

For private repos, org admin configures token auth.

GitLab

"config_source": {
  "source": "git",
  "url": "git@gitlab.example.com:team/config.git",
  "branch": "main"
}

HTTPS Endpoint

"config_source": {
  "source": "url",
  "url": "https://config.example.com/team/backend.json",
  "headers": {
    "Authorization": "Bearer ${CONFIG_TOKEN}"
  }
}

Trust Settings

Org admin controls what your federated config can do:

inherit_org_marketplaces

"trust": {
  "inherit_org_marketplaces": true
}

• true: Your team can use all org-approved marketplaces
• false: Your team only uses marketplaces you define

allow_additional_marketplaces

"trust": {
  "allow_additional_marketplaces": true,
  "marketplace_source_patterns": [
    "github.com/acme/**"
  ]
}

• true: Your team can add custom marketplaces (within patterns)
• false: Your team can only use org-defined marketplaces

Note

Even with allow_additional_marketplaces: true, plugins from those marketplaces still cannot match organization blocked_plugins patterns.

Config File Structure

team-config.json

{
  "schema_version": "1.0.0",

  "enabled_plugins": [
    "plugin-name@marketplace"
  ],

  "disabled_plugins": [
    "legacy-tool@marketplace"
  ],

  "marketplaces": {
    "team-marketplace": {
      "source": "github",
      "owner": "acme",
      "repo": "team-plugins"
    }
  }
}

Note

Federated team configs only support enabled_plugins, disabled_plugins, and marketplaces. MCP servers and session settings must be configured at the organization level.

Workflow: Making Changes

1. Create a branch

   git checkout -b add-new-plugin

2. Edit team-config.json

   "enabled_plugins": [
     "scc-safety-net@sandboxed-code-official",
     "new-tool@marketplace"  // ← Added
   ]

3. Validate locally

   scc team validate --file team-config.json

4. Create PR and get review

5. Merge to main

6. Developers get update

   scc update
   # or automatic on next session start

Caching and Updates

Team configs are cached locally:

Setting	Default	Description
Cache TTL	24 hours	How long before re-fetching
Force refresh	scc update	Immediately fetch latest
Offline mode	Uses cache	Works without network

Tip

If developers report stale config, have them run scc update to force refresh.

Troubleshooting

”Trust validation failed”

Your config tries to use something the org doesn’t permit:

scc team validate backend

Common causes:

• Adding a marketplace when allow_additional_marketplaces: false
• Plugin matches org’s blocked_plugins pattern

”Config fetch failed”

• Check repository URL is correct
• Verify authentication token is valid (for private repos)
• Ensure branch exists

”Stale config”

Force refresh:

scc update --force

Or clear cache:

rm -rf ~/.cache/scc/team-config/
scc update