From af5fe2e94893cfbaa1190f74f345a352ad2a6972 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 23:05:50 -0600 Subject: [PATCH 1/2] feat: govern channel project and secret recipients --- imports.tf | 5 +++++ main.tf | 15 +++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/imports.tf b/imports.tf index c097c66..ee7af2b 100644 --- a/imports.tf +++ b/imports.tf @@ -2,3 +2,8 @@ import { to = github_repository.repositories["tfroot-gcp"] id = "tfroot-gcp" } + +import { + to = github_repository.repositories["channel-project"] + id = "channel-project" +} diff --git a/main.tf b/main.tf index 89cdab8..0cdb30d 100644 --- a/main.tf +++ b/main.tf @@ -11,6 +11,7 @@ locals { "cflan", "charts", "agent-knowledge", + "channel-project", "kustomize-cluster", "images", "shared-workflows", @@ -29,16 +30,18 @@ locals { "ansible-role-crc" ]) private_github_repositories = toset([ - "agent-knowledge" + "agent-knowledge", + "channel-project" ]) topics_by_repository = { ".github" = ["community-health", "github", "org-profile"] "agent-knowledge" = ["agents", "documentation", "knowledge-base", "opencode"] "cflan" = ["cloudflare", "dns", "networking", "networkmanager", "python"] + "channel-project" = ["cloudflare", "dns", "opentofu", "video-streaming"] "charts" = ["ghcr", "gitops", "helm", "helm-charts", "oci"] "images" = ["buildah", "containerfiles", "custom-runners", "github-actions", "opentofu"] "kustomize-cluster" = ["app-of-apps", "argocd", "gitops", "k3s", "ksops", "kustomize", "sops"] - "shared-workflows" = ["github-actions", "github-workflows", "opentofu", "reusable-workflows", "shared-workflows"] + "shared-workflows" = ["github-actions", "opentofu", "reusable-workflows", "shared-workflows"] "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] @@ -97,7 +100,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -117,7 +120,7 @@ locals { } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["www_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { @@ -128,12 +131,12 @@ locals { "cloudflare_api_token" = { name = "CLOUDFLARE_API_TOKEN" value = data.sops_file.secret_vars.data["cloudflare_api_token"] - repositories = ["www", "tfroot-namecheap"] + repositories = ["www", "tfroot-namecheap", "channel-project"] } "namecheap_api_key" = { name = "NAMECHEAP_API_KEY" value = data.sops_file.secret_vars.data["namecheap_api_key"] - repositories = ["tfroot-namecheap"] + repositories = ["tfroot-namecheap", "channel-project"] } "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID" From 889ae4d9090b6e684305ddea107588a6c9f858b6 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 23:09:01 -0600 Subject: [PATCH 2/2] fix: preserve existing secret mappings --- main.tf | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/main.tf b/main.tf index 0cdb30d..ae999c8 100644 --- a/main.tf +++ b/main.tf @@ -41,7 +41,7 @@ locals { "charts" = ["ghcr", "gitops", "helm", "helm-charts", "oci"] "images" = ["buildah", "containerfiles", "custom-runners", "github-actions", "opentofu"] "kustomize-cluster" = ["app-of-apps", "argocd", "gitops", "k3s", "ksops", "kustomize", "sops"] - "shared-workflows" = ["github-actions", "opentofu", "reusable-workflows", "shared-workflows"] + "shared-workflows" = ["github-actions", "github-workflows", "opentofu", "reusable-workflows", "shared-workflows"] "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] @@ -100,7 +100,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -120,7 +120,7 @@ locals { } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_secret_access_key"] + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { @@ -141,12 +141,12 @@ locals { "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID" value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] - repositories = local.active_github_repositories + repositories = setsubtract(local.active_github_repositories, toset(["channel-project"])) } "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET" value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] - repositories = local.active_github_repositories + repositories = setsubtract(local.active_github_repositories, toset(["channel-project"])) } "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY"