chore(iam): remove OpenTofu docs GitHub App OIDC role - #32
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
xnoto
added a commit
to makeitworkcloud/tfroot-github
that referenced
this pull request
Aug 30, 2026
## Summary - extend the existing SOPS-backed `chart_updater_github_app_private_key` recipient list to the five OpenTofu caller roots: `tfroot-aws`, `tfroot-cloudflare`, `tfroot-gcp`, `tfroot-github`, `tfroot-libvirt` - **also fixes a pre-existing main breakage**: the `www_access_key_id` / `www_secret_access_key` lookups drifted from the actual SOPS key names (`www_aws_access_key_id` / `www_aws_secret_access_key`, matching the `onion_aws_*` naming), which failed every plan on `main` with `Invalid index` and blocked the post-#44 apply. The values never left `secrets/secrets.yaml`; only the `main.tf` references were wrong. No SOPS or secret-value changes. - no secret name (`name =`) changes, so existing Actions secrets are untouched ## Context This finishes the migration started in #42. The shared OpenTofu workflow's generated-docs commit path (makeitworkcloud/shared-workflows#33) now consumes `CHART_UPDATER_GITHUB_APP_PRIVATE_KEY` as an Actions secret, matching how `charts` already uses it, so each caller repository needs the secret provisioned. The chart updater GitHub App installation already covers the organization. Per `docs/chart-updater-github-app.md`, adding source repositories broadens private-key distribution and requires explicit review. Once this and the companion PRs merge and apply, the AWS Secrets Manager copy becomes genuinely unreferenced; removing the `github-actions-opentofu-docs` role is tracked in makeitworkcloud/tfroot-aws#32 (draft). ## Validation - PR CI plan is the validation authority; confirm it creates exactly five new `github_actions_secret.secrets` instances plus the already-pending `github_branch_protection.relaxed_protections["agent-knowledge"]` from #44, and modifies nothing else. - Reviewed the diff: no decrypted values or plaintext material included. ## Rollout Merge and let the environment-gated apply complete **before** merging the five caller PRs, so the Actions secret exists when callers start mapping it. Merge order: shared-workflows#33 first, then this PR, then the caller PRs.
xnoto
marked this pull request as ready for review
August 30, 2026 18:51
Summary
github-actions-opentofu-docsIAM role and its inline Secrets Manager read policyContext
The shared OpenTofu workflow's generated-docs commit path no longer uses AWS: makeitworkcloud/shared-workflows#33 sources the chart updater GitHub App key from the caller-mapped
CHART_UPDATER_GITHUB_APP_PRIVATE_KEYActions secret, provisioned by makeitworkcloud/tfroot-github#45. After those land, nothing references this role or the legacy Secrets Manager copy, matchingtfroot-github/docs/chart-updater-github-app.md.This mirrors #30, which removed the charts-facing role. The manually created Secrets Manager secret (
xnoto-s-chart-updater-github-app-private-key-*) is intentionally not deleted here; per the runbook its deletion is a separate approved cleanup after the agreed rollback window.Rollout dependency
Draft until all of the following have merged and applied:
Destroying this role before then breaks generated-docs commits on same-repository PRs.
Validation