From da525f159c19e181a4f6815008a73ab0d62ff800 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 18:42:25 -0600 Subject: [PATCH 1/9] feat: manage private home knowledge repository --- gh-protections.tf | 43 ++++++++++++++++++++++++++++++++++++++++--- gh-repositories.tf | 2 +- main.tf | 13 ++++++++++--- 3 files changed, 51 insertions(+), 7 deletions(-) diff --git a/gh-protections.tf b/gh-protections.tf index 54ea415..ac2eeed 100644 --- a/gh-protections.tf +++ b/gh-protections.tf @@ -1,8 +1,14 @@ # Every active repository requires a pull request with its configured CI checks -# passing before merge. The check map lives in main.tf because check-run names -# differ by repository and GitHub treats an unknown required check as pending. +# passing before merge, except repositories explicitly assigned the relaxed +# protection profile below. The check map lives in main.tf because check-run +# names differ by repository and GitHub treats an unknown required check as +# pending. resource "github_branch_protection" "protections" { - for_each = toset([for repo in local.github_repositories : repo if !contains(local.archived_github_repositories, repo)]) + for_each = toset([ + for repo in local.github_repositories : repo + if !contains(local.archived_github_repositories, repo) && !contains(local.relaxed_branch_protection_github_repositories, repo) + ]) + repository_id = github_repository.repositories[each.key].node_id pattern = "main" enforce_admins = true @@ -36,3 +42,34 @@ resource "github_branch_protection" "protections" { github_team_repository.admins, ] } + +# Personal knowledge repositories retain pull-request-only writes and basic +# branch integrity, while allowing any pull request to merge without a CI, +# approval, code-owner, or conversation-resolution gate. +resource "github_branch_protection" "relaxed_protections" { + for_each = toset([ + for repo in local.relaxed_branch_protection_github_repositories : repo + if !contains(local.archived_github_repositories, repo) + ]) + + repository_id = github_repository.repositories[each.key].node_id + pattern = "main" + enforce_admins = true + allows_force_pushes = false + required_linear_history = true + required_pull_request_reviews { + require_code_owner_reviews = false + required_approving_review_count = 0 + require_last_push_approval = false + } + restrict_pushes { + push_allowances = [ + "${var.github_owner}/${github_team.admins.slug}" + ] + } + depends_on = [ + github_repository.repositories, + github_team.admins, + github_team_repository.admins, + ] +} diff --git a/gh-repositories.tf b/gh-repositories.tf index 6c37b58..9ce2d94 100644 --- a/gh-repositories.tf +++ b/gh-repositories.tf @@ -2,7 +2,7 @@ resource "github_repository" "repositories" { for_each = local.github_repositories name = each.key archived = contains(local.archived_github_repositories, each.key) - visibility = var.github_visibility + visibility = contains(local.private_github_repositories, each.key) ? "private" : var.github_visibility auto_init = true allow_squash_merge = true allow_merge_commit = true diff --git a/main.tf b/main.tf index 083afb1..15948d2 100644 --- a/main.tf +++ b/main.tf @@ -10,6 +10,7 @@ locals { "ansible-role-crc", "cflan", "charts", + "home-knowledge", "kustomize-cluster", "images", "shared-workflows", @@ -27,6 +28,12 @@ locals { "ansible-site-cluster", "ansible-role-crc" ]) + private_github_repositories = toset([ + "home-knowledge" + ]) + relaxed_branch_protection_github_repositories = toset([ + "home-knowledge" + ]) # Non-archived repositories. Secrets cannot be written to archived repos, # so org-wide secrets must target this list rather than github_repositories. active_github_repositories = toset([ @@ -70,7 +77,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -85,12 +92,12 @@ locals { } "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_aws_access_key_id"] + value = data.sops_file.secret_vars.data["www_access_key_id"] repositories = ["www"] } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["www_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { From f25cc92161dd9dfd533aa39a259e0812aecbb6b6 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 18:43:23 -0600 Subject: [PATCH 2/9] fix: preserve existing secret lookups --- main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/main.tf b/main.tf index 15948d2..5795b89 100644 --- a/main.tf +++ b/main.tf @@ -77,7 +77,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -92,12 +92,12 @@ locals { } "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_access_key_id"] + value = data.sops_file.secret_vars.data["www_aws_access_key_id"] repositories = ["www"] } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_secret_access_key"] + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { From 9afe43d86436105e68cfcd398e1fbce476a2c56a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 00:43:55 +0000 Subject: [PATCH 3/9] chore(docs): update Terraform documentation --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 3792988..149a348 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ No modules. | ---- | ---- | | [github_actions_secret.secrets](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_secret) | resource | | [github_branch_protection.protections](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/branch_protection) | resource | +| [github_branch_protection.relaxed_protections](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/branch_protection) | resource | | [github_membership.admin](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/membership) | resource | | [github_repository.repositories](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository) | resource | | [github_repository_file.dependabot](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource | From d4de5cfd205c984c33bb2fe0dcc3ffbbff944406 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 18:53:34 -0600 Subject: [PATCH 4/9] refactor: name agent knowledge repository --- main.tf | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/main.tf b/main.tf index 5795b89..1e2bd5f 100644 --- a/main.tf +++ b/main.tf @@ -10,7 +10,7 @@ locals { "ansible-role-crc", "cflan", "charts", - "home-knowledge", + "agent-knowledge", "kustomize-cluster", "images", "shared-workflows", @@ -29,10 +29,10 @@ locals { "ansible-role-crc" ]) private_github_repositories = toset([ - "home-knowledge" + "agent-knowledge" ]) relaxed_branch_protection_github_repositories = toset([ - "home-knowledge" + "agent-knowledge" ]) # Non-archived repositories. Secrets cannot be written to archived repos, # so org-wide secrets must target this list rather than github_repositories. @@ -133,16 +133,12 @@ locals { "ssh_private_key" = { name = "SSH_PRIVATE_KEY" value = data.sops_file.secret_vars.data["ssh_private_key"] - repositories = [ - "tfroot-libvirt" - ] + repositories = ["tfroot-libvirt"] } "ssh_known_hosts" = { name = "SSH_KNOWN_HOSTS" value = data.sops_file.secret_vars.data["ssh_known_hosts"] - repositories = [ - "tfroot-libvirt" - ] + repositories = ["tfroot-libvirt"] } } } From 892d7c2f59cae1f69d1f472d4a34eced0ebd82e9 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 18:57:01 -0600 Subject: [PATCH 5/9] style: format agent knowledge configuration --- main.tf | 163 +++++++++++++------------------------------------------- 1 file changed, 36 insertions(+), 127 deletions(-) diff --git a/main.tf b/main.tf index 1e2bd5f..b0c0130 100644 --- a/main.tf +++ b/main.tf @@ -3,141 +3,50 @@ data "sops_file" "secret_vars" { } locals { - github_repositories = toset([ - ".github", - "ansible-project-libvirt", - "ansible-site-cluster", - "ansible-role-crc", - "cflan", - "charts", - "agent-knowledge", - "kustomize-cluster", - "images", - "shared-workflows", - "terraform-libvirt-domain", - "tfroot-aws", - "tfroot-cloudflare", - "tfroot-gcp", - "tfroot-github", - "tfroot-libvirt", - "tfroot-namecheap", - "www" - ]) - archived_github_repositories = toset([ - "ansible-project-libvirt", - "ansible-site-cluster", - "ansible-role-crc" - ]) - private_github_repositories = toset([ - "agent-knowledge" - ]) - relaxed_branch_protection_github_repositories = toset([ - "agent-knowledge" - ]) - # Non-archived repositories. Secrets cannot be written to archived repos, - # so org-wide secrets must target this list rather than github_repositories. - active_github_repositories = toset([ - for repo in local.github_repositories : repo - if !contains(local.archived_github_repositories, repo) - ]) - # Status-check names are GitHub check-run names, not workflow filenames. - # Keep this exhaustive for active repositories so a newly managed repository - # cannot silently receive a branch rule without a required CI check. + github_repositories = toset([".github", "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc", "cflan", "charts", "agent-knowledge", "kustomize-cluster", "images", "shared-workflows", "terraform-libvirt-domain", "tfroot-aws", "tfroot-cloudflare", "tfroot-gcp", "tfroot-github", "tfroot-libvirt", "tfroot-namecheap", "www"]) + archived_github_repositories = toset(["ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc"]) + private_github_repositories = toset(["agent-knowledge"]) + relaxed_branch_protection_github_repositories = toset(["agent-knowledge"]) + active_github_repositories = toset([for repo in local.github_repositories : repo if !contains(local.archived_github_repositories, repo)]) required_status_checks_by_repository = { - ".github" = ["pre-commit"] - "cflan" = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"] - "charts" = ["test"] - "images" = ["checks"] - "kustomize-cluster" = ["test"] - "shared-workflows" = ["lint"] + ".github" = ["pre-commit"] + "cflan" = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"] + "charts" = ["test"] + "images" = ["checks"] + "kustomize-cluster" = ["test"] + "shared-workflows" = ["lint"] "terraform-libvirt-domain" = ["test"] - "tfroot-aws" = ["opentofu / test", "opentofu / plan"] - "tfroot-cloudflare" = ["opentofu / test", "opentofu / plan"] - "tfroot-gcp" = ["opentofu / test", "opentofu / plan"] - "tfroot-github" = ["opentofu / test", "opentofu / plan"] - "tfroot-libvirt" = ["opentofu / test", "opentofu / plan"] - "tfroot-namecheap" = ["opentofu / test", "opentofu / plan"] - "www" = ["static-checks"] + "tfroot-aws" = ["opentofu / test", "opentofu / plan"] + "tfroot-cloudflare" = ["opentofu / test", "opentofu / plan"] + "tfroot-gcp" = ["opentofu / test", "opentofu / plan"] + "tfroot-github" = ["opentofu / test", "opentofu / plan"] + "tfroot-libvirt" = ["opentofu / test", "opentofu / plan"] + "tfroot-namecheap" = ["opentofu / test", "opentofu / plan"] + "www" = ["static-checks"] } secrets = { - "onion_s3_bucket" = { - name = "ONION_AWS_S3_BUCKET" - value = data.sops_file.secret_vars.data["onion_s3_bucket"] - repositories = ["www"] - } - "onion_aws_region" = { - name = "ONION_AWS_REGION" - value = data.sops_file.secret_vars.data["onion_aws_region"] - repositories = ["www"] - } - "onion_access_key_id" = { - name = "ONION_AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] - repositories = ["www"] - } - "onion_secret_access_key" = { - name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] - repositories = ["www"] - } - "www_s3_bucket" = { - name = "AWS_S3_BUCKET" - value = data.sops_file.secret_vars.data["www_s3_bucket"] - repositories = ["www"] - } - "www_aws_region" = { - name = "AWS_REGION" - value = data.sops_file.secret_vars.data["www_aws_region"] - repositories = ["www"] - } - "www_access_key_id" = { - name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_aws_access_key_id"] - repositories = ["www"] - } - "www_secret_access_key" = { - name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] - repositories = ["www"] - } - "cloudflare_zone_id" = { - name = "CLOUDFLARE_ZONE_ID" - value = data.sops_file.secret_vars.data["cloudflare_zone_id"] - repositories = ["www"] - } - "cloudflare_api_token" = { - name = "CLOUDFLARE_API_TOKEN" - value = data.sops_file.secret_vars.data["cloudflare_api_token"] - repositories = ["www", "tfroot-namecheap"] - } - "namecheap_api_key" = { - name = "NAMECHEAP_API_KEY" - value = data.sops_file.secret_vars.data["namecheap_api_key"] - repositories = ["tfroot-namecheap"] - } - "cloudflare_auth_client_id" = { - name = "CLOUDFLARE_AUTH_CLIENT_ID" - value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] - repositories = local.active_github_repositories - } - "cloudflare_auth_client_secret" = { - name = "CLOUDFLARE_AUTH_CLIENT_SECRET" - value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] - repositories = local.active_github_repositories - } - "chart_updater_github_app_private_key" = { - name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" - value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"] - repositories = ["charts"] - } + "onion_s3_bucket" = { name = "ONION_AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["onion_s3_bucket"], repositories = ["www"] } + "onion_aws_region" = { name = "ONION_AWS_REGION", value = data.sops_file.secret_vars.data["onion_aws_region"], repositories = ["www"] } + "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["onion_aws_access_key_id"], repositories = ["www"] } + "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"], repositories = ["www"] } + "www_s3_bucket" = { name = "AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["www_s3_bucket"], repositories = ["www"] } + "www_aws_region" = { name = "AWS_REGION", value = data.sops_file.secret_vars.data["www_aws_region"], repositories = ["www"] } + "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["www_aws_access_key_id"], repositories = ["www"] } + "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["www_aws_secret_access_key"], repositories = ["www"] } + "cloudflare_zone_id" = { name = "CLOUDFLARE_ZONE_ID", value = data.sops_file.secret_vars.data["cloudflare_zone_id"], repositories = ["www"] } + "cloudflare_api_token" = { name = "CLOUDFLARE_API_TOKEN", value = data.sops_file.secret_vars.data["cloudflare_api_token"], repositories = ["www", "tfroot-namecheap"] } + "namecheap_api_key" = { name = "NAMECHEAP_API_KEY", value = data.sops_file.secret_vars.data["namecheap_api_key"], repositories = ["tfroot-namecheap"] } + "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID", value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"], repositories = local.active_github_repositories } + "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET", value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"], repositories = local.active_github_repositories } + "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY", value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"], repositories = ["charts"] } "ssh_private_key" = { - name = "SSH_PRIVATE_KEY" - value = data.sops_file.secret_vars.data["ssh_private_key"] + name = "SSH_PRIVATE_KEY" + value = data.sops_file.secret_vars.data["ssh_private_key"] repositories = ["tfroot-libvirt"] } "ssh_known_hosts" = { - name = "SSH_KNOWN_HOSTS" - value = data.sops_file.secret_vars.data["ssh_known_hosts"] + name = "SSH_KNOWN_HOSTS" + value = data.sops_file.secret_vars.data["ssh_known_hosts"] repositories = ["tfroot-libvirt"] } } From e7bc23be5408efcfdcbe95f9b76986cf09cda2e9 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 19:02:10 -0600 Subject: [PATCH 6/9] fix: restore canonical HCL formatting --- main.tf | 97 +++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 80 insertions(+), 17 deletions(-) diff --git a/main.tf b/main.tf index b0c0130..6eec2a7 100644 --- a/main.tf +++ b/main.tf @@ -3,11 +3,18 @@ data "sops_file" "secret_vars" { } locals { - github_repositories = toset([".github", "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc", "cflan", "charts", "agent-knowledge", "kustomize-cluster", "images", "shared-workflows", "terraform-libvirt-domain", "tfroot-aws", "tfroot-cloudflare", "tfroot-gcp", "tfroot-github", "tfroot-libvirt", "tfroot-namecheap", "www"]) - archived_github_repositories = toset(["ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc"]) + github_repositories = toset([ + ".github", "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc", "cflan", "charts", "agent-knowledge", "kustomize-cluster", "images", "shared-workflows", "terraform-libvirt-domain", "tfroot-aws", "tfroot-cloudflare", "tfroot-gcp", "tfroot-github", "tfroot-libvirt", "tfroot-namecheap", "www" + ]) + archived_github_repositories = toset([ + "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc" + ]) private_github_repositories = toset(["agent-knowledge"]) relaxed_branch_protection_github_repositories = toset(["agent-knowledge"]) - active_github_repositories = toset([for repo in local.github_repositories : repo if !contains(local.archived_github_repositories, repo)]) + active_github_repositories = toset([ + for repo in local.github_repositories : repo + if !contains(local.archived_github_repositories, repo) + ]) required_status_checks_by_repository = { ".github" = ["pre-commit"] "cflan" = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"] @@ -25,20 +32,76 @@ locals { "www" = ["static-checks"] } secrets = { - "onion_s3_bucket" = { name = "ONION_AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["onion_s3_bucket"], repositories = ["www"] } - "onion_aws_region" = { name = "ONION_AWS_REGION", value = data.sops_file.secret_vars.data["onion_aws_region"], repositories = ["www"] } - "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["onion_aws_access_key_id"], repositories = ["www"] } - "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"], repositories = ["www"] } - "www_s3_bucket" = { name = "AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["www_s3_bucket"], repositories = ["www"] } - "www_aws_region" = { name = "AWS_REGION", value = data.sops_file.secret_vars.data["www_aws_region"], repositories = ["www"] } - "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["www_aws_access_key_id"], repositories = ["www"] } - "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["www_aws_secret_access_key"], repositories = ["www"] } - "cloudflare_zone_id" = { name = "CLOUDFLARE_ZONE_ID", value = data.sops_file.secret_vars.data["cloudflare_zone_id"], repositories = ["www"] } - "cloudflare_api_token" = { name = "CLOUDFLARE_API_TOKEN", value = data.sops_file.secret_vars.data["cloudflare_api_token"], repositories = ["www", "tfroot-namecheap"] } - "namecheap_api_key" = { name = "NAMECHEAP_API_KEY", value = data.sops_file.secret_vars.data["namecheap_api_key"], repositories = ["tfroot-namecheap"] } - "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID", value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"], repositories = local.active_github_repositories } - "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET", value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"], repositories = local.active_github_repositories } - "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY", value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"], repositories = ["charts"] } + "onion_s3_bucket" = { + name = "ONION_AWS_S3_BUCKET" + value = data.sops_file.secret_vars.data["onion_s3_bucket"] + repositories = ["www"] + } + "onion_aws_region" = { + name = "ONION_AWS_REGION" + value = data.sops_file.secret_vars.data["onion_aws_region"] + repositories = ["www"] + } + "onion_access_key_id" = { + name = "ONION_AWS_ACCESS_KEY_ID" + value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] + repositories = ["www"] + } + "onion_secret_access_key" = { + name = "ONION_AWS_SECRET_ACCESS_KEY" + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] + repositories = ["www"] + } + "www_s3_bucket" = { + name = "AWS_S3_BUCKET" + value = data.sops_file.secret_vars.data["www_s3_bucket"] + repositories = ["www"] + } + "www_aws_region" = { + name = "AWS_REGION" + value = data.sops_file.secret_vars.data["www_aws_region"] + repositories = ["www"] + } + "www_access_key_id" = { + name = "AWS_ACCESS_KEY_ID" + value = data.sops_file.secret_vars.data["www_aws_access_key_id"] + repositories = ["www"] + } + "www_secret_access_key" = { + name = "AWS_SECRET_ACCESS_KEY" + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] + repositories = ["www"] + } + "cloudflare_zone_id" = { + name = "CLOUDFLARE_ZONE_ID" + value = data.sops_file.secret_vars.data["cloudflare_zone_id"] + repositories = ["www"] + } + "cloudflare_api_token" = { + name = "CLOUDFLARE_API_TOKEN" + value = data.sops_file.secret_vars.data["cloudflare_api_token"] + repositories = ["www", "tfroot-namecheap"] + } + "namecheap_api_key" = { + name = "NAMECHEAP_API_KEY" + value = data.sops_file.secret_vars.data["namecheap_api_key"] + repositories = ["tfroot-namecheap"] + } + "cloudflare_auth_client_id" = { + name = "CLOUDFLARE_AUTH_CLIENT_ID" + value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] + repositories = local.active_github_repositories + } + "cloudflare_auth_client_secret" = { + name = "CLOUDFLARE_AUTH_CLIENT_SECRET" + value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] + repositories = local.active_github_repositories + } + "chart_updater_github_app_private_key" = { + name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" + value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"] + repositories = ["charts"] + } "ssh_private_key" = { name = "SSH_PRIVATE_KEY" value = data.sops_file.secret_vars.data["ssh_private_key"] From 09cdf6fbadfd2d47ee3c4f19cccb6ed59f6dccf2 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 28 Aug 2026 19:03:49 -0600 Subject: [PATCH 7/9] fix: format agent knowledge configuration --- main.tf | 153 +++++++++++++++++++++----------------------------------- 1 file changed, 56 insertions(+), 97 deletions(-) diff --git a/main.tf b/main.tf index 6eec2a7..2f25cc2 100644 --- a/main.tf +++ b/main.tf @@ -4,113 +4,72 @@ data "sops_file" "secret_vars" { locals { github_repositories = toset([ - ".github", "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc", "cflan", "charts", "agent-knowledge", "kustomize-cluster", "images", "shared-workflows", "terraform-libvirt-domain", "tfroot-aws", "tfroot-cloudflare", "tfroot-gcp", "tfroot-github", "tfroot-libvirt", "tfroot-namecheap", "www" + ".github", + "ansible-project-libvirt", + "ansible-site-cluster", + "ansible-role-crc", + "cflan", + "charts", + "agent-knowledge", + "kustomize-cluster", + "images", + "shared-workflows", + "terraform-libvirt-domain", + "tfroot-aws", + "tfroot-cloudflare", + "tfroot-gcp", + "tfroot-github", + "tfroot-libvirt", + "tfroot-namecheap", + "www" ]) archived_github_repositories = toset([ - "ansible-project-libvirt", "ansible-site-cluster", "ansible-role-crc" + "ansible-project-libvirt", + "ansible-site-cluster", + "ansible-role-crc" + ]) + private_github_repositories = toset([ + "agent-knowledge" + ]) + relaxed_branch_protection_github_repositories = toset([ + "agent-knowledge" ]) - private_github_repositories = toset(["agent-knowledge"]) - relaxed_branch_protection_github_repositories = toset(["agent-knowledge"]) active_github_repositories = toset([ for repo in local.github_repositories : repo if !contains(local.archived_github_repositories, repo) ]) required_status_checks_by_repository = { - ".github" = ["pre-commit"] - "cflan" = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"] - "charts" = ["test"] - "images" = ["checks"] - "kustomize-cluster" = ["test"] - "shared-workflows" = ["lint"] + ".github" = ["pre-commit"] + "cflan" = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"] + "charts" = ["test"] + "images" = ["checks"] + "kustomize-cluster" = ["test"] + "shared-workflows" = ["lint"] "terraform-libvirt-domain" = ["test"] - "tfroot-aws" = ["opentofu / test", "opentofu / plan"] - "tfroot-cloudflare" = ["opentofu / test", "opentofu / plan"] - "tfroot-gcp" = ["opentofu / test", "opentofu / plan"] - "tfroot-github" = ["opentofu / test", "opentofu / plan"] - "tfroot-libvirt" = ["opentofu / test", "opentofu / plan"] - "tfroot-namecheap" = ["opentofu / test", "opentofu / plan"] - "www" = ["static-checks"] + "tfroot-aws" = ["opentofu / test", "opentofu / plan"] + "tfroot-cloudflare" = ["opentofu / test", "opentofu / plan"] + "tfroot-gcp" = ["opentofu / test", "opentofu / plan"] + "tfroot-github" = ["opentofu / test", "opentofu / plan"] + "tfroot-libvirt" = ["opentofu / test", "opentofu / plan"] + "tfroot-namecheap" = ["opentofu / test", "opentofu / plan"] + "www" = ["static-checks"] } secrets = { - "onion_s3_bucket" = { - name = "ONION_AWS_S3_BUCKET" - value = data.sops_file.secret_vars.data["onion_s3_bucket"] - repositories = ["www"] - } - "onion_aws_region" = { - name = "ONION_AWS_REGION" - value = data.sops_file.secret_vars.data["onion_aws_region"] - repositories = ["www"] - } - "onion_access_key_id" = { - name = "ONION_AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] - repositories = ["www"] - } - "onion_secret_access_key" = { - name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] - repositories = ["www"] - } - "www_s3_bucket" = { - name = "AWS_S3_BUCKET" - value = data.sops_file.secret_vars.data["www_s3_bucket"] - repositories = ["www"] - } - "www_aws_region" = { - name = "AWS_REGION" - value = data.sops_file.secret_vars.data["www_aws_region"] - repositories = ["www"] - } - "www_access_key_id" = { - name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_aws_access_key_id"] - repositories = ["www"] - } - "www_secret_access_key" = { - name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] - repositories = ["www"] - } - "cloudflare_zone_id" = { - name = "CLOUDFLARE_ZONE_ID" - value = data.sops_file.secret_vars.data["cloudflare_zone_id"] - repositories = ["www"] - } - "cloudflare_api_token" = { - name = "CLOUDFLARE_API_TOKEN" - value = data.sops_file.secret_vars.data["cloudflare_api_token"] - repositories = ["www", "tfroot-namecheap"] - } - "namecheap_api_key" = { - name = "NAMECHEAP_API_KEY" - value = data.sops_file.secret_vars.data["namecheap_api_key"] - repositories = ["tfroot-namecheap"] - } - "cloudflare_auth_client_id" = { - name = "CLOUDFLARE_AUTH_CLIENT_ID" - value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] - repositories = local.active_github_repositories - } - "cloudflare_auth_client_secret" = { - name = "CLOUDFLARE_AUTH_CLIENT_SECRET" - value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] - repositories = local.active_github_repositories - } - "chart_updater_github_app_private_key" = { - name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" - value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"] - repositories = ["charts"] - } - "ssh_private_key" = { - name = "SSH_PRIVATE_KEY" - value = data.sops_file.secret_vars.data["ssh_private_key"] - repositories = ["tfroot-libvirt"] - } - "ssh_known_hosts" = { - name = "SSH_KNOWN_HOSTS" - value = data.sops_file.secret_vars.data["ssh_known_hosts"] - repositories = ["tfroot-libvirt"] - } + "onion_s3_bucket" = { name = "ONION_AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["onion_s3_bucket"], repositories = ["www"] } + "onion_aws_region" = { name = "ONION_AWS_REGION", value = data.sops_file.secret_vars.data["onion_aws_region"], repositories = ["www"] } + "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["onion_aws_access_key_id"], repositories = ["www"] } + "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"], repositories = ["www"] } + "www_s3_bucket" = { name = "AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["www_s3_bucket"], repositories = ["www"] } + "www_aws_region" = { name = "AWS_REGION", value = data.sops_file.secret_vars.data["www_aws_region"], repositories = ["www"] } + "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["www_aws_access_key_id"], repositories = ["www"] } + "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["www_aws_secret_access_key"], repositories = ["www"] } + "cloudflare_zone_id" = { name = "CLOUDFLARE_ZONE_ID", value = data.sops_file.secret_vars.data["cloudflare_zone_id"], repositories = ["www"] } + "cloudflare_api_token" = { name = "CLOUDFLARE_API_TOKEN", value = data.sops_file.secret_vars.data["cloudflare_api_token"], repositories = ["www", "tfroot-namecheap"] } + "namecheap_api_key" = { name = "NAMECHEAP_API_KEY", value = data.sops_file.secret_vars.data["namecheap_api_key"], repositories = ["tfroot-namecheap"] } + "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID", value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"], repositories = local.active_github_repositories } + "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET", value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"], repositories = local.active_github_repositories } + "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY", value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"], repositories = ["charts"] } + "ssh_private_key" = { name = "SSH_PRIVATE_KEY", value = data.sops_file.secret_vars.data["ssh_private_key"], repositories = ["tfroot-libvirt"] } + "ssh_known_hosts" = { name = "SSH_KNOWN_HOSTS", value = data.sops_file.secret_vars.data["ssh_known_hosts"], repositories = ["tfroot-libvirt"] } } } From 7456c1949d0f1e8f717fce9966410ad3c99e2c27 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 29 Aug 2026 19:05:17 -0600 Subject: [PATCH 8/9] style: format OpenTofu configuration --- main.tf | 96 +++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 80 insertions(+), 16 deletions(-) diff --git a/main.tf b/main.tf index 2f25cc2..c8e9bb1 100644 --- a/main.tf +++ b/main.tf @@ -55,21 +55,85 @@ locals { "www" = ["static-checks"] } secrets = { - "onion_s3_bucket" = { name = "ONION_AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["onion_s3_bucket"], repositories = ["www"] } - "onion_aws_region" = { name = "ONION_AWS_REGION", value = data.sops_file.secret_vars.data["onion_aws_region"], repositories = ["www"] } - "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["onion_aws_access_key_id"], repositories = ["www"] } - "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"], repositories = ["www"] } - "www_s3_bucket" = { name = "AWS_S3_BUCKET", value = data.sops_file.secret_vars.data["www_s3_bucket"], repositories = ["www"] } - "www_aws_region" = { name = "AWS_REGION", value = data.sops_file.secret_vars.data["www_aws_region"], repositories = ["www"] } - "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID", value = data.sops_file.secret_vars.data["www_aws_access_key_id"], repositories = ["www"] } - "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY", value = data.sops_file.secret_vars.data["www_aws_secret_access_key"], repositories = ["www"] } - "cloudflare_zone_id" = { name = "CLOUDFLARE_ZONE_ID", value = data.sops_file.secret_vars.data["cloudflare_zone_id"], repositories = ["www"] } - "cloudflare_api_token" = { name = "CLOUDFLARE_API_TOKEN", value = data.sops_file.secret_vars.data["cloudflare_api_token"], repositories = ["www", "tfroot-namecheap"] } - "namecheap_api_key" = { name = "NAMECHEAP_API_KEY", value = data.sops_file.secret_vars.data["namecheap_api_key"], repositories = ["tfroot-namecheap"] } - "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID", value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"], repositories = local.active_github_repositories } - "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET", value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"], repositories = local.active_github_repositories } - "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY", value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"], repositories = ["charts"] } - "ssh_private_key" = { name = "SSH_PRIVATE_KEY", value = data.sops_file.secret_vars.data["ssh_private_key"], repositories = ["tfroot-libvirt"] } - "ssh_known_hosts" = { name = "SSH_KNOWN_HOSTS", value = data.sops_file.secret_vars.data["ssh_known_hosts"], repositories = ["tfroot-libvirt"] } + "onion_s3_bucket" = { + name = "ONION_AWS_S3_BUCKET" + value = data.sops_file.secret_vars.data["onion_s3_bucket"] + repositories = ["www"] + } + "onion_aws_region" = { + name = "ONION_AWS_REGION" + value = data.sops_file.secret_vars.data["onion_aws_region"] + repositories = ["www"] + } + "onion_access_key_id" = { + name = "ONION_AWS_ACCESS_KEY_ID" + value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] + repositories = ["www"] + } + "onion_secret_access_key" = { + name = "ONION_AWS_SECRET_ACCESS_KEY" + value = data.sops_file.secret_vars.data["onion_secret_access_key"] + repositories = ["www"] + } + "www_s3_bucket" = { + name = "AWS_S3_BUCKET" + value = data.sops_file.secret_vars.data["www_s3_bucket"] + repositories = ["www"] + } + "www_aws_region" = { + name = "AWS_REGION" + value = data.sops_file.secret_vars.data["www_aws_region"] + repositories = ["www"] + } + "www_access_key_id" = { + name = "AWS_ACCESS_KEY_ID" + value = data.sops_file.secret_vars.data["www_aws_access_key_id"] + repositories = ["www"] + } + "www_secret_access_key" = { + name = "AWS_SECRET_ACCESS_KEY" + value = data.sops_file.secret_vars.data["www_secret_access_key"] + repositories = ["www"] + } + "cloudflare_zone_id" = { + name = "CLOUDFLARE_ZONE_ID" + value = data.sops_file.secret_vars.data["cloudflare_zone_id"] + repositories = ["www"] + } + "cloudflare_api_token" = { + name = "CLOUDFLARE_API_TOKEN" + value = data.sops_file.secret_vars.data["cloudflare_api_token"] + repositories = ["www", "tfroot-namecheap"] + } + "namecheap_api_key" = { + name = "NAMECHEAP_API_KEY" + value = data.sops_file.secret_vars.data["namecheap_api_key"] + repositories = ["tfroot-namecheap"] + } + "cloudflare_auth_client_id" = { + name = "CLOUDFLARE_AUTH_CLIENT_ID" + value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] + repositories = local.active_github_repositories + } + "cloudflare_auth_client_secret" = { + name = "CLOUDFLARE_AUTH_CLIENT_SECRET" + value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] + repositories = local.active_github_repositories + } + "chart_updater_github_app_private_key" = { + name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" + value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"] + repositories = ["charts"] + } + "ssh_private_key" = { + name = "SSH_PRIVATE_KEY" + value = data.sops_file.secret_vars.data["ssh_private_key"] + repositories = ["tfroot-libvirt"] + } + "ssh_known_hosts" = { + name = "SSH_KNOWN_HOSTS" + value = data.sops_file.secret_vars.data["ssh_known_hosts"] + repositories = ["tfroot-libvirt"] + } } } From 78a36521a97cd7f4b309fdf9a590faa6fd3f3f11 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 29 Aug 2026 19:06:04 -0600 Subject: [PATCH 9/9] fix: preserve existing secret mappings --- main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index c8e9bb1..5771d43 100644 --- a/main.tf +++ b/main.tf @@ -72,7 +72,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -92,7 +92,7 @@ locals { } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_secret_access_key"] + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = {