From 66bfe1045d37afc7342d1e1bacd6d3deeebf5239 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sun, 30 Aug 2026 13:00:32 -0600 Subject: [PATCH] fix: exclude private repositories from branch protections Do not create standard or relaxed branch-protection resources for repositories in local.private_github_repositories. GitHub Free cannot apply the configured restriction to private repositories, and personal private repositories are outside the organization review policy. This unblocks the tfroot-github apply that otherwise fails trying to create agent-knowledge branch protection. --- gh-protections.tf | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/gh-protections.tf b/gh-protections.tf index ac2eeed..eaa6095 100644 --- a/gh-protections.tf +++ b/gh-protections.tf @@ -1,12 +1,14 @@ -# Every active repository requires a pull request with its configured CI checks -# passing before merge, except repositories explicitly assigned the relaxed -# protection profile below. The check map lives in main.tf because check-run -# names differ by repository and GitHub treats an unknown required check as -# pending. +# Every active public repository requires a pull request with its configured CI +# checks passing before merge, except repositories explicitly assigned the +# relaxed protection profile below. Private repositories are deliberately +# excluded: GitHub Free cannot enforce these protections there, and personal +# private repositories are outside the organization's review policy. The check +# map lives in main.tf because check-run names differ by repository and GitHub +# treats an unknown required check as pending. resource "github_branch_protection" "protections" { for_each = toset([ for repo in local.github_repositories : repo - if !contains(local.archived_github_repositories, repo) && !contains(local.relaxed_branch_protection_github_repositories, repo) + if !contains(local.archived_github_repositories, repo) && !contains(local.private_github_repositories, repo) && !contains(local.relaxed_branch_protection_github_repositories, repo) ]) repository_id = github_repository.repositories[each.key].node_id @@ -43,13 +45,14 @@ resource "github_branch_protection" "protections" { ] } -# Personal knowledge repositories retain pull-request-only writes and basic -# branch integrity, while allowing any pull request to merge without a CI, -# approval, code-owner, or conversation-resolution gate. +# The relaxed profile is for public personal repositories: pull-request-only +# writes and basic branch integrity, while allowing any pull request to merge +# without a CI, approval, code-owner, or conversation-resolution gate. Private +# repositories are deliberately excluded from all branch-protection resources. resource "github_branch_protection" "relaxed_protections" { for_each = toset([ for repo in local.relaxed_branch_protection_github_repositories : repo - if !contains(local.archived_github_repositories, repo) + if !contains(local.archived_github_repositories, repo) && !contains(local.private_github_repositories, repo) ]) repository_id = github_repository.repositories[each.key].node_id