fix: govern tfroot-twilio Dependabot files

[xnoto]

Summary

Adds tfroot-twilio to the centrally managed Dependabot ecosystem map. The repository created by #54 is present and protected, but its initial rollout did not create the two centrally owned Dependabot files because the map did not yet include the new root.

Fixes: None — completes the approved tfroot-twilio repository bootstrap.

Type of change

• Infrastructure (OpenTofu root or module)

Validation

• Required pull-request checks pass — pending.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — this change adds the new root to the canonical generator input; the environment-gated apply will create the managed files.

Impact and rollout

tfroot-github remains the sole owner of .github/dependabot.yml and .github/workflows/dependabot-notify.yml for active managed repositories. On an approved merge and successful main apply, this change creates those two files in tfroot-twilio; it does not alter Twilio, Cloudflare, Kubernetes, runtime Secrets, or other repositories.

Rollback before apply is closing this pull request. After apply, removing centrally managed files requires a separate reviewed ownership decision.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI agent materially produced this change; review the generator scope before merge.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # github_repository_file.dependabot["tfroot-twilio"] will be created
  + resource "github_repository_file" "dependabot" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot configuration"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            "updates":
            - "directory": "/"
              "groups":
                "github-actions":
                  "patterns":
                  - "*"
              "package-ecosystem": "github-actions"
              "schedule":
                "interval": "daily"
            - "directory": "/"
              "groups":
                "opentofu":
                  "patterns":
                  - "*"
              "package-ecosystem": "opentofu"
              "schedule":
                "interval": "daily"
            "version": 2
        EOT
      + file                         = ".github/dependabot.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-twilio"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-twilio"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-twilio"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # github_repository_file.dependabot["tfroot-twilio"] will be created
  + resource "github_repository_file" "dependabot" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot configuration"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            "updates":
            - "directory": "/"
              "groups":
                "github-actions":
                  "patterns":
                  - "*"
              "package-ecosystem": "github-actions"
              "schedule":
                "interval": "daily"
            - "directory": "/"
              "groups":
                "opentofu":
                  "patterns":
                  - "*"
              "package-ecosystem": "opentofu"
              "schedule":
                "interval": "daily"
            "version": 2
        EOT
      + file                         = ".github/dependabot.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-twilio"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-twilio"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-twilio"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.