fix: import Twilio Dependabot files - #56
Merged
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
# github_repository_file.dependabot["tfroot-twilio"] will be imported
# (imported from "tfroot-twilio:.github/dependabot.yml:")
resource "github_repository_file" "dependabot" {
branch = "main"
commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT
commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a"
content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT
file = ".github/dependabot.yml"
id = "tfroot-twilio:.github/dependabot.yml:main"
overwrite_on_create = false
ref = "main"
repository = "tfroot-twilio"
repository_id = 1356437102
sha = "03c5f79693e6cbffc5a63baddc58014ba0232170"
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be imported
# (imported from "tfroot-twilio:.github/workflows/dependabot-notify.yml:")
resource "github_repository_file" "dependabot_notify" {
branch = "main"
commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT
commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a"
content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
file = ".github/workflows/dependabot-notify.yml"
id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:main"
overwrite_on_create = false
ref = "main"
repository = "tfroot-twilio"
repository_id = 1356437102
sha = "de2725088a33d9dc3bc14f05d3a709a093709856"
}
Plan: 2 to import, 0 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:
# github_repository_file.dependabot["tfroot-twilio"] will be imported
# (imported from "tfroot-twilio:.github/dependabot.yml:")
resource "github_repository_file" "dependabot" {
branch = "main"
commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT
commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a"
content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT
file = ".github/dependabot.yml"
id = "tfroot-twilio:.github/dependabot.yml:main"
overwrite_on_create = false
ref = "main"
repository = "tfroot-twilio"
repository_id = 1356437102
sha = "03c5f79693e6cbffc5a63baddc58014ba0232170"
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be imported
# (imported from "tfroot-twilio:.github/workflows/dependabot-notify.yml:")
resource "github_repository_file" "dependabot_notify" {
branch = "main"
commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT
commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a"
content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
file = ".github/workflows/dependabot-notify.yml"
id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:main"
overwrite_on_create = false
ref = "main"
repository = "tfroot-twilio"
repository_id = 1356437102
sha = "de2725088a33d9dc3bc14f05d3a709a093709856"
}
Plan: 2 to import, 0 to add, 0 to change, 0 to destroy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Import the two Dependabot files that
tfroot-twilioPR #1 seeded through the required pull-request path. This lets their canonicaltfroot-githubresources adopt existing files instead of attempting protected direct creation.The import reports inherited commit metadata and a create-only setting that would otherwise cause a protected-branch file update. The two resource definitions therefore ignore only
commit_messageandoverwrite_on_create; their centrally managed file content remains enforced.Fixes # N/A — repair the failed central Dependabot adoption path.
Type of change
Validation
2 to import, 0 to add, 0 to change, 0 to destroy.tfroot-githubas their canonical owner.The provider's documented import IDs use
repository:file-path:branch, with an empty branch for the default branch. No local OpenTofu, SOPS, state, import, plan, or apply operations were run.Impact and rollout
Producer:
tfroot-githubowns both generated files and their resource state. Consumer:tfroot-twilionow contains the exact seeded files onmainat315acbf8.The previous main apply attempted direct creation before the files existed and failed on repository protection. This PR imports only
.github/dependabot.ymland.github/workflows/dependabot-notify.ymlinto their existing central resources. Its validated plan neither writes a file nor changes repository protection, Actions secrets, Twilio configuration, or any GitOps/runtime system. After a confirmed merge, verify the environment-gated apply succeeds and records the two imports.Rollback is a reviewed revert of these import declarations. Do not manually edit the managed target files.
Safety and secrets
Repository-side secret scanning is unavailable because GitHub Advanced Security is not enabled; the diff was manually inspected before publication.
AI agent materially produced this change; reviewers should confirm the documented import IDs, exact resource addresses, metadata-only lifecycle exclusions, and retained central ownership.