feat: bootstrap OpenTofu root - #1
Merged
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
14 tasks
15 tasks
xnoto
added a commit
to makeitworkcloud/tfroot-aws
that referenced
this pull request
Sep 3, 2026
## Summary Replace the just-applied human-readable `tfroot-twilio` trust pattern with the exact organization/repository-ID subject emitted by its GitHub Actions OIDC token: `repo:makeitworkcloud@195502628/tfroot-twilio@1356437102:pull_request`. The repository's bootstrap plan still fails because the subject format differs from the older roots. A temporary, secret-free diagnostic job emitted only this non-sensitive claim; it is removed from the Twilio-root branch before merge. Fixes # N/A — restore the intended single-repository KMS OIDC trust boundary. ## Type of change - [x] Bug fix - [ ] Feature / enhancement - [ ] Documentation - [x] Infrastructure (OpenTofu root or module) - [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [ ] Container image - [ ] CI / reusable workflow - [ ] Refactor / cleanup - [ ] Breaking change ## Validation - [x] Required pull-request checks pass — OpenTofu test and plan succeeded. - [x] OpenTofu plan changes only `github-actions-sops-kms`: `0 to add, 1 to change, 0 to destroy`. - [x] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none are changed. The failed revalidation in [`tfroot-twilio` PR #1](makeitworkcloud/tfroot-twilio#1) established that the initial subject pattern does not match. Its temporary diagnostic job emitted the exact repository-scoped subject without exposing a token. No local OpenTofu, SOPS, state, import, plan, or apply operations were run. ## Impact and rollout Producer: `tfroot-aws` owns the `github-actions-sops-kms` trust policy. Consumer: only `tfroot-twilio` is affected. This replaces one repository-scoped subject expression with the exact repository-ID-qualified expression; it does not add repositories, widen permissions, grant S3 state access, or grant Twilio API access. After a confirmed merge and successful environment-gated apply, rerun the no-resource Twilio-root plan. Its merge remains separately confirmation-gated. Rollback is a reviewed revert of this one subject expression. Do not use an organization wildcard. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks. - [x] Breaking or irreversible effects are described above with rollback notes. AI agent materially produced this change; reviewers should confirm the exact claim evidence, no added repository scope, and retained KMS-only permission boundary.
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputNo changes. Your infrastructure matches the configuration.
OpenTofu has compared your real infrastructure against your configuration and |
15 tasks
xnoto
added a commit
to makeitworkcloud/tfroot-github
that referenced
this pull request
Sep 4, 2026
## Summary Import the two Dependabot files that [`tfroot-twilio` PR #1](makeitworkcloud/tfroot-twilio#1) seeded through the required pull-request path. This lets their canonical `tfroot-github` resources adopt existing files instead of attempting protected direct creation. The import reports inherited commit metadata and a create-only setting that would otherwise cause a protected-branch file update. The two resource definitions therefore ignore only `commit_message` and `overwrite_on_create`; their centrally managed file content remains enforced. Fixes # N/A — repair the failed central Dependabot adoption path. ## Type of change - [x] Bug fix - [ ] Feature / enhancement - [ ] Documentation - [x] Infrastructure (OpenTofu root or module) - [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [ ] Container image - [ ] CI / reusable workflow - [ ] Refactor / cleanup - [ ] Breaking change ## Validation - [x] Required pull-request checks pass — OpenTofu test and plan succeeded in [run 33819976668](https://github.com/makeitworkcloud/tfroot-github/actions/runs/33819976668). - [x] Plan is exactly `2 to import, 0 to add, 0 to change, 0 to destroy`. - [x] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — the files were exact PR seeds and retain `tfroot-github` as their canonical owner. The provider's documented import IDs use `repository:file-path:branch`, with an empty branch for the default branch. No local OpenTofu, SOPS, state, import, plan, or apply operations were run. ## Impact and rollout Producer: `tfroot-github` owns both generated files and their resource state. Consumer: `tfroot-twilio` now contains the exact seeded files on `main` at [`315acbf8`](makeitworkcloud/tfroot-twilio@315acbf). The previous main apply attempted direct creation before the files existed and failed on repository protection. This PR imports only `.github/dependabot.yml` and `.github/workflows/dependabot-notify.yml` into their existing central resources. Its validated plan neither writes a file nor changes repository protection, Actions secrets, Twilio configuration, or any GitOps/runtime system. After a confirmed merge, verify the environment-gated apply succeeds and records the two imports. Rollback is a reviewed revert of these import declarations. Do not manually edit the managed target files. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks. - [x] Breaking or irreversible effects are described above with rollback notes. Repository-side secret scanning is unavailable because GitHub Advanced Security is not enabled; the diff was manually inspected before publication. AI agent materially produced this change; reviewers should confirm the documented import IDs, exact resource addresses, metadata-only lifecycle exclusions, and retained central ownership.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bootstrap
tfroot-twilioas a no-resource OpenTofu root. It evaluates the pinnedRJPearson94/twilio0.27.1provider, adds the shared OpenTofu caller, and documents the future SOPS/backend and least-privilege credential gates.The PR also seeds the two exact
tfroot-github-generated Dependabot files through the required pull-request path. This resolves the existing direct-commit/branch-protection conflict without changing protection rules or assigning downstream ownership.The bootstrap deliberately omits an S3 backend because its Makefile initializes with
-backend=false; a permanent encrypted backend remains a follow-up prerequisite before Twilio resources can be managed.Fixes # N/A — owner-approved Twilio root bootstrap and centralized Dependabot delivery repair.
Type of change
Validation
tfroot-github/gh-dependabot.tf; central ownership remains unchanged and will adopt them after merge.The exact repository-scoped GitHub OIDC subject was validated through the separately applied
tfroot-awsPR #40. No local OpenTofu, SOPS, state, import, plan, or apply operations were run. Registry review verifiedRJPearson94/twilio0.27.1supports phone-number and inbound messaging-webhook fields; the bootstrap intentionally has no provider configuration or Twilio resources.Impact and rollout
Producer/consumer chain:
images/tfroot-runnersupplies the canonical CI toolchain,shared-workflowssupplies the reusable OpenTofu workflow,tfroot-twiliobecomes the future Twilio phone/webhook owner, andtfroot-githubremains the sole long-term owner of the seeded Dependabot files.Merging will submit the environment-gated main workflow. This bootstrap's apply has no provider-side effect because there are no configured providers, data sources, or resources. A later reviewed change must first establish encrypted backend and credential-delivery inputs with least privilege before managing Twilio inventory. Twilio provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit the seeded Dependabot files after merge.
Safety and secrets
Repository-side secret scanning is unavailable because GitHub Advanced Security is not enabled; the committed diff was manually inspected before publication.
AI agent materially produced this change; reviewers should confirm the retained no-resource bootstrap boundary and central generated-file ownership.