From 81019531ef1b04353fe5ffe0dc5109968685265c Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sun, 30 Aug 2026 15:42:07 -0600 Subject: [PATCH 1/2] fix: allow chart updater through protected merge --- gh-protections.tf | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/gh-protections.tf b/gh-protections.tf index eaa6095..a3bb78d 100644 --- a/gh-protections.tf +++ b/gh-protections.tf @@ -1,3 +1,9 @@ +# Resolve the chart updater App to its GraphQL node ID. Branch protection +# allowances cannot use the App's numeric ID or bot login directly. +data "github_app" "chart_updater" { + slug = "makeitworkbot" +} + # Every active public repository requires a pull request with its configured CI # checks passing before merge, except repositories explicitly assigned the # relaxed protection profile below. Private repositories are deliberately @@ -29,9 +35,13 @@ resource "github_branch_protection" "protections" { require_last_push_approval = false } restrict_pushes { - push_allowances = [ - "${var.github_owner}/${github_team.admins.slug}" - ] + # Push allowances do not bypass the pull-request or required-check gates. + # The chart updater App is added only for its kustomize-cluster destination + # so GitHub may complete an eligible auto-merge after `test` passes. + push_allowances = concat( + ["${var.github_owner}/${github_team.admins.slug}"], + each.key == "kustomize-cluster" ? [data.github_app.chart_updater.node_id] : [], + ) } # Seed centrally managed files before protecting a newly added repository's # main branch. Without this ordering, GitHub can reject the file commits as From 3cb79ee43c98b942368cc181cc6b43d0ce714abf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 21:42:59 +0000 Subject: [PATCH 2/2] chore(docs): update Terraform documentation --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 149a348..cbc2e9f 100644 --- a/README.md +++ b/README.md @@ -32,6 +32,7 @@ No modules. | [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource | | [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource | | [github_team_repository.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository) | resource | +| [github_app.chart_updater](https://registry.terraform.io/providers/integrations/github/latest/docs/data-sources/app) | data source | | [sops_file.secret_vars](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source | ## Inputs