Skip to content

fix: remove protected-branch file writes - #34

Merged
xnoto merged 3 commits into
mainfrom
fix/remove-protected-branch-file-writes
Aug 28, 2026
Merged

fix: remove protected-branch file writes#34
xnoto merged 3 commits into
mainfrom
fix/remove-protected-branch-file-writes

Conversation

@xnoto

@xnoto xnoto commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • remove github_repository_file resources that attempted to write directly to protected default branches
  • restore generated Terraform documentation to match the resource set

Root cause

The GitHub provider's github_repository_file resource writes directly to a repository branch. All targeted default branches require pull requests and status checks, so the production apply was rejected with HTTP 409 before any of the 18 file resources could be created or updated.

Validation

  • reviewed the remediation diff; it contains no credentials, state, decrypted values, or sensitive plan output
  • PR CI will validate that the next production apply no longer attempts the protected-branch writes

Follow-up

Implement desired-file distribution as a PR-based workflow rather than a direct OpenTofu repository-file resource. No branch-protection bypass will be used.

@xnoto
xnoto requested a review from a team as a code owner August 28, 2026 03:18
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

OpenTofu CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

@github-actions

Copy link
Copy Markdown
Contributor

OpenTofu Plan

@xnoto
xnoto merged commit e756d33 into main Aug 28, 2026
3 checks passed
@xnoto
xnoto deleted the fix/remove-protected-branch-file-writes branch August 28, 2026 03:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant