Skip to content

docs: scope GCP root agent guidance #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 1 commit into from
Aug 28, 2026
Merged

docs: scope GCP root agent guidance #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 3 additions & 36 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,40 +1,7 @@
# Agent Instructions

## Repository Purpose
OpenTofu root for Make IT Work Cloud Google Cloud infrastructure.

OpenTofu root module for Make IT Work Cloud Google Cloud infrastructure.
Use Application Default Credentials for bootstrap and GitHub Actions Workload Identity Federation for automation; never create, store, or use service-account keys. Bootstrap state migration to GCS is a reviewed live operation, not a server-side task.

## Git Workflow

Use a feature branch and open a pull request rather than pushing directly to
`main`. A push to `main` can invoke apply after tests pass and configured
environment gates approve it. Do not push any branch unless explicitly
requested.

## Authentication and State

Use Application Default Credentials for local bootstrap and GitHub Actions
Workload Identity Federation for automation. Do not create, store, or use
service-account key files.

The first apply uses local state to create the project, state bucket, SOPS KMS
key, and automation identity. Migrate to the GCS backend only after that apply.
Never commit OpenTofu state, plans, provider logs, decrypted SOPS data, or API
key strings.

## Pre-commit Configuration

Pre-commit configuration is centralized at
`https://raw.githubusercontent.com/makeitworkcloud/images/main/tfroot-runner/pre-commit-config.yaml`.
The root `.pre-commit-config.yaml` is generated and ignored; do not edit it.

For local development, run:
```bash
make test
```

## CI/CD

This repo uses the shared `opentofu.yml` workflow from `shared-workflows`.
The runner uses the `tfroot-runner` image, which already includes the canonical
pre-commit hooks and tooling.
Use GitHub MCP and PR CI plans as validation authority. `main` is an apply path after configured environment approval: use scoped branches and PRs, never direct pushes. Shared workflow and runner ownership belongs to `shared-workflows` and `images/tfroot-runner`. Keep SOPS data encrypted; never expose state, API keys, credentials, or sensitive plan output.
Loading