tfroot-github

OpenTofu root for Make IT Work Cloud GitHub organization infrastructure.

Agent and operator contract

• This root owns centralized repository policy, protections, Dependabot callers, and distributed Actions configuration.
• Read AGENTS.md before changing managed paths or workflow callers; downstream edits to generated files are overwritten.
• Pull-request CI plans are the validation authority. main is an environment-gated apply path; do not run local OpenTofu or secret-decryption operations from an agent session.

Requirements

Name	Version
terraform	> 1.3
github	~> 6.0

Providers

Name	Version
github	~> 6.0
sops	n/a

Modules

No modules.

Resources

Name	Type
github_actions_secret.secrets	resource
github_branch_protection.protections	resource
github_branch_protection.relaxed_protections	resource
github_membership.admin	resource
github_repository.repositories	resource
github_repository_file.dependabot	resource
github_repository_file.dependabot_notify	resource
github_team.admins	resource
github_team.developers	resource
github_team_membership.admins_xnoto	resource
github_team_repository.admins	resource
github_app.chart_updater	data source
sops_file.secret_vars	data source

Inputs

Name	Description	Type	Default	Required
github_owner	The GitHub owner (user or organization) for the repository.	string	"makeitworkcloud"	no
github_visibility	Public, private, or internal visibility	string	"public"	no

Outputs

No outputs.

Operator guides

• Chart updater GitHub App runbook