feat: bootstrap tfroot-twilio repository

[xnoto]

Summary

Creates the organization-managed tfroot-twilio OpenTofu-root repository entry. The repository starts with temporary relaxed pull-request protection so its first bootstrap pull request can install the OpenTofu CI workflow; a follow-up governance change will enforce normal opentofu / test and opentofu / plan checks after that workflow exists.

Fixes: None — owner-approved Twilio infrastructure-as-code bootstrap.

Type of change

• Infrastructure (OpenTofu root or module)

Validation

• Required pull-request checks pass — pending.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; this change updates the canonical repository inventory, topics, protection profile, and approved GitHub App-secret recipient.

Impact and rollout

tfroot-github is the canonical producer of organization repositories and policy. On a later approved merge and environment-gated main apply, it will create the public tfroot-twilio repository, seed centrally owned files, apply the temporary bootstrap protection profile, and distribute the existing chart-updater GitHub App secret to that repository.

This pull request does not create Twilio resources, purchase numbers, configure Twilio webhooks, create a Cloudflare DNS record, or deploy the SMS bridge. The follow-up tfroot-twilio bootstrap pull request must add its own CI and SOPS/OpenTofu root contract before normal required checks replace the temporary profile.

Rollback before apply is closing this pull request. After apply, repository deletion or policy changes require a separate reviewed decision; do not remove a repository containing bootstrap history as an implicit rollback.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI agent materially produced this change; review the temporary bootstrap protection boundary and secret-recipient scope carefully.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_branch_protection.relaxed_protections["tfroot-twilio"] will be created
  + resource "github_branch_protection" "relaxed_protections" {
      + allows_deletions                = false
      + allows_force_pushes             = false
      + enforce_admins                  = true
      + id                              = (known after apply)
      + lock_branch                     = false
      + pattern                         = "main"
      + repository_id                   = (known after apply)
      + require_conversation_resolution = false
      + require_signed_commits          = false
      + required_linear_history         = true

      + required_pull_request_reviews {
          + require_code_owner_reviews      = false
          + require_last_push_approval      = false
          + required_approving_review_count = 0
        }

      + restrict_pushes {
          + blocks_creations = true
          + push_allowances  = [
              + "makeitworkcloud/admins",
            ]
        }
    }

  # github_repository.repositories["tfroot-twilio"] will be created
  + resource "github_repository" "repositories" {
      + allow_auto_merge                        = false
      + allow_forking                           = (known after apply)
      + allow_merge_commit                      = true
      + allow_rebase_merge                      = false
      + allow_squash_merge                      = true
      + archived                                = false
      + auto_init                               = true
      + default_branch                          = (known after apply)
      + delete_branch_on_merge                  = true
      + etag                                    = (known after apply)
      + fork                                    = (known after apply)
      + full_name                               = (known after apply)
      + git_clone_url                           = (known after apply)
      + html_url                                = (known after apply)
      + http_clone_url                          = (known after apply)
      + id                                      = (known after apply)
      + ignore_vulnerability_alerts_during_read = false
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
      + name                                    = "tfroot-twilio"
      + node_id                                 = (known after apply)
      + primary_language                        = (known after apply)
      + private                                 = (known after apply)
      + repo_id                                 = (known after apply)
      + source_owner                            = (known after apply)
      + source_repo                             = (known after apply)
      + squash_merge_commit_message             = "PR_BODY"
      + squash_merge_commit_title               = "PR_TITLE"
      + ssh_clone_url                           = (known after apply)
      + svn_url                                 = (known after apply)
      + topics                                  = [
          + "opentofu",
          + "s3-backend",
          + "sms",
[REDACTED: potentially sensitive plan output]
          + "tfstate",
          + "twilio",
        ]
      + visibility                              = "public"
      + vulnerability_alerts                    = (known after apply)
      + web_commit_signoff_required             = (known after apply)

      + security_and_analysis (known after apply)
    }

  # github_team_repository.admins["tfroot-twilio"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "tfroot-twilio"
      + team_id    = "15594330"
    }

Plan: 6 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-twilio"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_branch_protection.relaxed_protections["tfroot-twilio"] will be created
  + resource "github_branch_protection" "relaxed_protections" {
      + allows_deletions                = false
      + allows_force_pushes             = false
      + enforce_admins                  = true
      + id                              = (known after apply)
      + lock_branch                     = false
      + pattern                         = "main"
      + repository_id                   = (known after apply)
      + require_conversation_resolution = false
      + require_signed_commits          = false
      + required_linear_history         = true

      + required_pull_request_reviews {
          + require_code_owner_reviews      = false
          + require_last_push_approval      = false
          + required_approving_review_count = 0
        }

      + restrict_pushes {
          + blocks_creations = true
          + push_allowances  = [
              + "makeitworkcloud/admins",
            ]
        }
    }

  # github_repository.repositories["tfroot-twilio"] will be created
  + resource "github_repository" "repositories" {
      + allow_auto_merge                        = false
      + allow_forking                           = (known after apply)
      + allow_merge_commit                      = true
      + allow_rebase_merge                      = false
      + allow_squash_merge                      = true
      + archived                                = false
      + auto_init                               = true
      + default_branch                          = (known after apply)
      + delete_branch_on_merge                  = true
      + etag                                    = (known after apply)
      + fork                                    = (known after apply)
      + full_name                               = (known after apply)
      + git_clone_url                           = (known after apply)
      + html_url                                = (known after apply)
      + http_clone_url                          = (known after apply)
      + id                                      = (known after apply)
      + ignore_vulnerability_alerts_during_read = false
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
      + name                                    = "tfroot-twilio"
      + node_id                                 = (known after apply)
      + primary_language                        = (known after apply)
      + private                                 = (known after apply)
      + repo_id                                 = (known after apply)
      + source_owner                            = (known after apply)
      + source_repo                             = (known after apply)
      + squash_merge_commit_message             = "PR_BODY"
      + squash_merge_commit_title               = "PR_TITLE"
      + ssh_clone_url                           = (known after apply)
      + svn_url                                 = (known after apply)
      + topics                                  = [
          + "opentofu",
          + "s3-backend",
          + "sms",
[REDACTED: potentially sensitive plan output]
          + "tfstate",
          + "twilio",
        ]
      + visibility                              = "public"
      + vulnerability_alerts                    = (known after apply)
      + web_commit_signoff_required             = (known after apply)

      + security_and_analysis (known after apply)
    }

  # github_team_repository.admins["tfroot-twilio"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "tfroot-twilio"
      + team_id    = "15594330"
    }

Plan: 6 to add, 0 to change, 0 to destroy.