From b04626b65a9655028fbaa8febd8a1cf5a845461b Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 4 Sep 2026 14:34:03 -0600 Subject: [PATCH] feat: distribute chart updater App key to kustomize-cluster Adds kustomize-cluster to the chart updater GitHub App private-key recipient list so its in-repo rotation workflow can mint makeitworkbot installation tokens. Branch protection on kustomize-cluster allows only the admins team and this App to complete pull-request merges, so the App token is required for the rotation workflow's unattended auto-merge. The App installation is organization-wide, so no installation change accompanies this recipient addition. --- main.tf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index 21fd312..b713964 100644 --- a/main.tf +++ b/main.tf @@ -50,8 +50,8 @@ locals { "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] - "tfroot-twilio" = ["opentofu", "s3-backend", "sms", "sops", "tfstate", "twilio"] - "www" = ["cloudflare", "css", "html", "pwa", "s3", "static-site"] + "tfroot-twilio" = ["opentofu", "s3-backend", "sms", "sops", "twilio"] + "www" = ["css", "html", "pwa", "s3", "static-site"] } # Public repositories remain on the relaxed profile only until their initial # pull request has installed the required workflow and centrally managed files. @@ -158,6 +158,7 @@ locals { value = data.sops_file.secret_vars.data["chart_updater_github_app_private_key"] repositories = [ "charts", + "kustomize-cluster", "tfroot-aws", "tfroot-cloudflare", "tfroot-gcp",