feat: require Twilio OpenTofu checks

[xnoto]

Summary

Graduate tfroot-twilio from its initial relaxed branch-protection profile now that its OpenTofu workflow and centrally managed Dependabot files are installed and reconciled.

Require the established opentofu / test and opentofu / plan checks for main. A moved block preserves the existing protected-branch state while changing profiles, avoiding a delete/recreate transition.

Fixes # N/A — complete the Twilio-root bootstrap governance gate.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — OpenTofu test and plan succeeded in run 33838857603.
• Plan updates exactly one existing branch-protection resource: 0 to add, 1 to change, 0 to destroy.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files are changed.

The required check names are verified against tfroot-twilio's caller workflow and its completed validation run. No local OpenTofu, SOPS, state, import, plan, or apply operations were run.

Impact and rollout

Producer: tfroot-github owns branch protection. Consumer: tfroot-twilio will require successful opentofu / test and opentofu / plan before future pull requests merge.

This PR neither changes the Twilio root's workflow nor configures provider credentials, backend state, phone numbers, webhooks, bridge deployment, routes, or runtime secrets. Its plan uses the moved address to update the existing protection in place, adding the two required checks and conversation resolution without a protection gap. After confirmed merge, verify the environment-gated apply succeeds and that the required contexts match the caller's emitted check names.

Rollback is a reviewed revert restoring the relaxed profile. The moved block prevents a protection gap during this transition.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

Repository-side secret scanning is unavailable because GitHub Advanced Security is not enabled; the branch diff was manually inspected before publication.

AI agent materially produced this change; reviewers should confirm no secret-map, repository-topic, or unrelated protection change is present; the moved protection address; and the exact required check names.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # github_branch_protection.protections["tfroot-twilio"] will be updated in-place
  # (moved from github_branch_protection.relaxed_protections["tfroot-twilio"])
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOUNmWbs4E7fVz"
      ~ require_conversation_resolution = false -> true
        # (9 unchanged attributes hidden)

      + required_status_checks {
          + contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
          + strict   = true
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # github_branch_protection.protections["tfroot-twilio"] will be updated in-place
  # (moved from github_branch_protection.relaxed_protections["tfroot-twilio"])
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOUNmWbs4E7fVz"
      ~ require_conversation_resolution = false -> true
        # (9 unchanged attributes hidden)

      + required_status_checks {
          + contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
          + strict   = true
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.