[aramprice]

Set default_branch: main for five repositories owned by the Foundational Infrastructure WG’s VM deployment lifecycle (BOSH) subgroup. The four standard generated protection selectors follow main; the existing APT protect: false exception is preserved.

Keep this PR in draft until all five native GitHub renames and required operator verification are complete. Source PRs may merge first; deployed write sources selecting main must be applied only after that branch exists. No deployed Concourse configuration or pause state was changed by this work.

Repository	Source PR	Cutover issue
bosh-apt-resources	cloudfoundry/bosh-apt-resources#4	cloudfoundry/bosh-apt-resources#5
bosh-aws-cpi-release	cloudfoundry/bosh-aws-cpi-release#235	cloudfoundry/bosh-aws-cpi-release#236
bosh-cpi-certification	cloudfoundry/bosh-cpi-certification#24	cloudfoundry/bosh-cpi-certification#25
jumpbox-deployment	cloudfoundry/jumpbox-deployment#41	cloudfoundry/jumpbox-deployment#42
windows-utilities-release	cloudfoundry/windows-utilities-release#27	cloudfoundry/windows-utilities-release#28

Consumer PRs:

• cloudfoundry/bosh-linux-stemcell-builder (ubuntu-jammy)
• cloudfoundry/bosh-bootloader
• cloudfoundry/buildpacks-ci
• cloudfoundry/bosh-azure-cpi-release
• cloudfoundry/bosh-vsphere-cpi-release
• cloudfoundry/bosh-alicloud-cpi-release
• cloudfoundry/bosh-alicloud-light-stemcell-builder
• cloudfoundry/wg-app-platform-runtime-ci
• cloudfoundry/docs-bosh — documentation-only, non-gating
• cloudfoundry/bosh-linux-stemcell-builder (ubuntu-noble)
• cloudfoundry/bosh-linux-stemcell-builder (ubuntu-resolute)

Get-only sources omit branch to follow the repository default before and after rename. Jumpbox write sources retain explicit main and require coordinated operator cutover. AWS CPI/certification share dependencies; Windows consumers require App Platform Runtime owner coordination. Detailed ordering, inactive-consumer treatment, verification and rollback are recorded in the five issues.

Validation: repository ownership/schema validation and generation comparison passed. Only the five default branch values and four corresponding generated protection include selectors change; other generated org/team/policy data are identical. All source/consumer diffs passed whitespace checks; stemcell templates rendered and passed local strict pipeline validation. Legacy pipeline templates retain the same baseline validation errors.

After merge, a successful Peribolos synchronization containing this configuration must eventually finish before everything is complete. Do not wait on or require any particular individual run.

GitHub check note: the Alicloud consumer scan fails Go Vulnerability Check (Go standard-library vulnerability findings) and Dependency Audit (nancy) (cannot resolve sonatype-nexus-community/nancy-github-action@v1). Unmodified master already fails both jobs. The consumer PR changes only two Git branch selectors, with no Go source, dependency, or workflow edits. These checks need separate owner attention; they have not been bypassed or rerun.