From f365b0650ea09a3d8c6af001d3d8ed1e8829c1a1 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Thu, 3 Sep 2026 22:57:56 -0600 Subject: [PATCH 1/3] feat: require Twilio OpenTofu checks --- main.tf | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/main.tf b/main.tf index 367aacd..0540c0c 100644 --- a/main.tf +++ b/main.tf @@ -46,18 +46,17 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "s3-backend", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] "tfroot-twilio" = ["opentofu", "s3-backend", "sms", "sops", "tfstate", "twilio"] "www" = ["cloudflare", "css", "html", "pwa", "s3", "static-site"] } - # tfroot-twilio starts with the narrow relaxed profile so its initial PR can - # install the OpenTofu workflow before normal required checks are enforced. + # Public repositories remain on the relaxed profile only until their initial + # pull request has installed the required workflow and centrally managed files. relaxed_branch_protection_github_repositories = toset([ - "agent-knowledge", - "tfroot-twilio" + "agent-knowledge" ]) # Repositories where automation-created pull requests merge themselves once # required checks pass. GitHub auto-merge is enabled only for these @@ -85,6 +84,7 @@ locals { "tfroot-github" = ["opentofu / test", "opentofu / plan"] "tfroot-libvirt" = ["opentofu / test", "opentofu / plan"] "tfroot-namecheap" = ["opentofu / test", "opentofu / plan"] + "tfroot-twilio" = ["opentofu / test", "opentofu / plan"] "www" = ["static-checks"] } secrets = { @@ -100,12 +100,12 @@ locals { } "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] + value = data.sops_file.secret_vars.data["onion_access_key_id"] repositories = ["www"] } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -120,12 +120,12 @@ locals { } "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_aws_access_key_id"] + value = data.sops_file.secret_vars.data["www_access_key_id"] repositories = ["www"] } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["www_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { From a63beed6ee2e445f1e9f5a66d04b792ccf0f1cd5 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Thu, 3 Sep 2026 22:58:08 -0600 Subject: [PATCH 2/3] refactor: preserve Twilio branch protection state --- moves.tf | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 moves.tf diff --git a/moves.tf b/moves.tf new file mode 100644 index 0000000..321d226 --- /dev/null +++ b/moves.tf @@ -0,0 +1,6 @@ +# Graduate tfroot-twilio from the temporary relaxed profile without deleting +# and recreating its protected main branch. +moved { + from = github_branch_protection.relaxed_protections["tfroot-twilio"] + to = github_branch_protection.protections["tfroot-twilio"] +} From c0e74350401d4f9c8969e294b6c77521b8ad71fe Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Thu, 3 Sep 2026 22:59:37 -0600 Subject: [PATCH 3/3] fix: preserve existing secret mappings --- main.tf | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/main.tf b/main.tf index 0540c0c..21fd312 100644 --- a/main.tf +++ b/main.tf @@ -46,7 +46,7 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "s3-backend", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] @@ -100,12 +100,12 @@ locals { } "onion_access_key_id" = { name = "ONION_AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["onion_access_key_id"] + value = data.sops_file.secret_vars.data["onion_aws_access_key_id"] repositories = ["www"] } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -120,12 +120,12 @@ locals { } "www_access_key_id" = { name = "AWS_ACCESS_KEY_ID" - value = data.sops_file.secret_vars.data["www_access_key_id"] + value = data.sops_file.secret_vars.data["www_aws_access_key_id"] repositories = ["www"] } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_secret_access_key"] + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = {