feat: govern channel project and secret recipients

[xnoto]

Summary

• Adopt the existing private channel-project repository through an OpenTofu import and organization repository policy.
• Grant only the existing CLOUDFLARE_API_TOKEN and NAMECHEAP_API_KEY GitHub Actions secret mappings to channel-project.
• Exclude channel-project from the organization-wide Cloudflare Access OAuth client credential distribution.

No tracking issue; owner-approved infrastructure governance change.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan succeeded in run 177.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; this changes the source mapping for central distribution.

Impact and rollout

Producer: tfroot-github governance and encrypted-secret recipient mapping.

Consumer: the existing private channel-project repository. After a reviewed, environment-gated apply, OpenTofu will import and manage its repository settings, grant the admins team administration through existing active-repository policy, and store the two named Actions secrets. No decrypted value, SOPS file, root workflow, DNS record, registrar state, deployment, or public site changes here.

The current Cloudflare token scope is not asserted by this PR; a later channel-project Cloudflare root must validate it against the orthodox.channel zone. Rollback is to remove the repository and recipient mappings, then apply through the same reviewed root.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI agent materially produced this change; reviewers should inspect the OpenTofu plan before approval.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "channel-project"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "channel-project"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_repository.repositories["channel-project"] will be updated in-place
  # (imported from "channel-project")
  ~ resource "github_repository" "repositories" {
        allow_auto_merge                        = false
        allow_forking                           = false
        allow_merge_commit                      = true
      ~ allow_rebase_merge                      = true -> false
        allow_squash_merge                      = true
        allow_update_branch                     = false
        archived                                = false
      ~ auto_init                               = false -> true
        default_branch                          = "main"
      ~ delete_branch_on_merge                  = false -> true
        description                             = "Private monorepo for orthodox.channel applications and infrastructure."
        etag                                    = "W/\"6e72fd5598b2f778c3b077ba425963860dd9f42e7de3fe1f0fa64525815cb9c0\""
        fork                                    = "false"
        full_name                               = "makeitworkcloud/channel-project"
        git_clone_url                           = "git://github.com/makeitworkcloud/channel-project.git"
        has_discussions                         = false
        has_downloads                           = false
        has_issues                              = true
        has_projects                            = true
        has_wiki                                = false
        html_url                                = "https://github.com/makeitworkcloud/channel-project"
        http_clone_url                          = "https://github.com/makeitworkcloud/channel-project.git"
        id                                      = "channel-project"
      + ignore_vulnerability_alerts_during_read = false
        is_template                             = false
        merge_commit_message                    = "PR_TITLE"
        merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "channel-project"
        node_id                                 = "R_kgDOUMus0g"
        private                                 = true
        repo_id                                 = 1355525330
      ~ squash_merge_commit_message             = "COMMIT_MESSAGES" -> "PR_BODY"
      ~ squash_merge_commit_title               = "COMMIT_OR_PR_TITLE" -> "PR_TITLE"
        ssh_clone_url                           = "git@github.com:makeitworkcloud/channel-project.git"
        svn_url                                 = "https://github.com/makeitworkcloud/channel-project"
      ~ topics                                  = [
          + "cloudflare",
          + "dns",
          + "opentofu",
          + "video-streaming",
        ]
        visibility                              = "private"
        web_commit_signoff_required             = false
    }

  # github_team_repository.admins["channel-project"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "channel-project"
      + team_id    = "15594330"
    }

Plan: 1 to import, 3 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "channel-project"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "channel-project"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_repository.repositories["channel-project"] will be updated in-place
  # (imported from "channel-project")
  ~ resource "github_repository" "repositories" {
        allow_auto_merge                        = false
        allow_forking                           = false
        allow_merge_commit                      = true
      ~ allow_rebase_merge                      = true -> false
        allow_squash_merge                      = true
        allow_update_branch                     = false
        archived                                = false
      ~ auto_init                               = false -> true
        default_branch                          = "main"
      ~ delete_branch_on_merge                  = false -> true
        description                             = "Private monorepo for orthodox.channel applications and infrastructure."
        etag                                    = "W/\"6e72fd5598b2f778c3b077ba425963860dd9f42e7de3fe1f0fa64525815cb9c0\""
        fork                                    = "false"
        full_name                               = "makeitworkcloud/channel-project"
        git_clone_url                           = "git://github.com/makeitworkcloud/channel-project.git"
        has_discussions                         = false
        has_downloads                           = false
        has_issues                              = true
        has_projects                            = true
        has_wiki                                = false
        html_url                                = "https://github.com/makeitworkcloud/channel-project"
        http_clone_url                          = "https://github.com/makeitworkcloud/channel-project.git"
        id                                      = "channel-project"
      + ignore_vulnerability_alerts_during_read = false
        is_template                             = false
        merge_commit_message                    = "PR_TITLE"
        merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "channel-project"
        node_id                                 = "R_kgDOUMus0g"
        private                                 = true
        repo_id                                 = 1355525330
      ~ squash_merge_commit_message             = "COMMIT_MESSAGES" -> "PR_BODY"
      ~ squash_merge_commit_title               = "COMMIT_OR_PR_TITLE" -> "PR_TITLE"
        ssh_clone_url                           = "git@github.com:makeitworkcloud/channel-project.git"
        svn_url                                 = "https://github.com/makeitworkcloud/channel-project"
      ~ topics                                  = [
          + "cloudflare",
          + "dns",
          + "opentofu",
          + "video-streaming",
        ]
        visibility                              = "private"
        web_commit_signoff_required             = false
    }

  # github_team_repository.admins["channel-project"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "channel-project"
      + team_id    = "15594330"
    }

Plan: 1 to import, 3 to add, 1 to change, 0 to destroy.