fix: import kustomize-cluster dependabot-notify file

[xnoto]

Summary

Imports the existing .github/workflows/dependabot-notify.yml on kustomize-cluster into the github_repository_file.dependabot_notify resource, repairing the failed main apply from run 189.

The apply created the new CHART_UPDATER_GITHUB_APP_PRIVATE_KEY secret and completed both topic reconciliations, then failed attempting a direct write of the centrally managed dependabot-notify file to kustomize-cluster's protected main (409 … Changes must be made through a pull request), because that resource instance was never adopted into state. The live file content matches the managed template byte-for-byte, so only the state address is adopted. Mirrors the tfroot-twilio import precedent.

Type of change

• Infrastructure (OpenTofu root or module)

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — this adopts an existing centrally distributed file into state; no file content changes

Expected plan: 1 to import, 0 to add, 0 to change, 0 to destroy.

Impact and rollout

After merge, the environment-gated apply records the import and returns the main pipeline to green; the standing per-apply 409 disappears. No repository, protection, secret, or file-content change results from this import itself.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — rollback is reverting the import block

Agent disclosure: change, branch, and this pull request were prepared by the makeitwork OpenCode agent at the owner's direction, mirroring the documented tfroot-twilio import precedent.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # github_repository_file.dependabot_notify["kustomize-cluster"] will be imported
  # (imported from "kustomize-cluster:.github/workflows/dependabot-notify.yml:")
    resource "github_repository_file" "dependabot_notify" {
        branch              = "main"
        commit_message      = <<-EOT
            chore: root squash — collapse pre-2026 history
            
            History squashed to a single root commit for hygiene; tree-identical to the previous main tip.
        EOT
        commit_sha          = "3509e01896a4c8781d31598ab7807be6883ead0f"
        content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
        EOT
        file                = ".github/workflows/dependabot-notify.yml"
        id                  = "kustomize-cluster:.github/workflows/dependabot-notify.yml:main"
        overwrite_on_create = false
        ref                 = "main"
        repository          = "kustomize-cluster"
        repository_id       = 1120687049
        sha                 = "de2725088a33d9dc3bc14f05d3a709a093709856"
    }

Plan: 1 to import, 0 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # github_repository_file.dependabot_notify["kustomize-cluster"] will be imported
  # (imported from "kustomize-cluster:.github/workflows/dependabot-notify.yml:")
    resource "github_repository_file" "dependabot_notify" {
        branch              = "main"
        commit_message      = <<-EOT
            chore: root squash — collapse pre-2026 history
            
            History squashed to a single root commit for hygiene; tree-identical to the previous main tip.
        EOT
        commit_sha          = "3509e01896a4c8781d31598ab7807be6883ead0f"
        content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
        EOT
        file                = ".github/workflows/dependabot-notify.yml"
        id                  = "kustomize-cluster:.github/workflows/dependabot-notify.yml:main"
        overwrite_on_create = false
        ref                 = "main"
        repository          = "kustomize-cluster"
        repository_id       = 1120687049
        sha                 = "de2725088a33d9dc3bc14f05d3a709a093709856"
    }

Plan: 1 to import, 0 to add, 0 to change, 0 to destroy.