feat: manage Hero host configuration repository - #60
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
# github_repository.repositories["hero-host-config"] will be created
+ resource "github_repository" "repositories" {
+ allow_auto_merge = false
+ allow_forking = (known after apply)
+ allow_merge_commit = true
+ allow_rebase_merge = false
+ allow_squash_merge = true
+ archived = false
+ auto_init = true
+ default_branch = (known after apply)
+ delete_branch_on_merge = true
+ etag = (known after apply)
+ fork = (known after apply)
+ full_name = (known after apply)
+ git_clone_url = (known after apply)
+ html_url = (known after apply)
+ http_clone_url = (known after apply)
+ id = (known after apply)
+ ignore_vulnerability_alerts_during_read = false
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
+ name = "hero-host-config"
+ node_id = (known after apply)
+ primary_language = (known after apply)
+ private = (known after apply)
+ repo_id = (known after apply)
+ source_owner = (known after apply)
+ source_repo = (known after apply)
+ squash_merge_commit_message = "PR_BODY"
+ squash_merge_commit_title = "PR_TITLE"
+ ssh_clone_url = (known after apply)
+ svn_url = (known after apply)
+ topics = [
+ "ansible",
+ "cloudflare-zero-trust",
+ "configuration-management",
+ "node-exporter",
+ "rhel",
+ "systemd",
]
+ visibility = "private"
+ vulnerability_alerts = (known after apply)
+ web_commit_signoff_required = (known after apply)
+ security_and_analysis (known after apply)
}
# github_repository_file.dependabot["hero-host-config"] will be created
+ resource "github_repository_file" "dependabot" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot configuration"
+ commit_sha = (known after apply)
+ content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
"version": 2
EOT
+ file = ".github/dependabot.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_repository_file.dependabot_notify["hero-host-config"] will be created
+ resource "github_repository_file" "dependabot_notify" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot notification workflow"
+ commit_sha = (known after apply)
+ content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
+ file = ".github/workflows/dependabot-notify.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_team_repository.admins["hero-host-config"] will be created
+ resource "github_team_repository" "admins" {
+ etag = (known after apply)
+ id = (known after apply)
+ permission = "admin"
+ repository = "hero-host-config"
+ team_id = "15594330"
}
Plan: 4 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:
# github_repository.repositories["hero-host-config"] will be created
+ resource "github_repository" "repositories" {
+ allow_auto_merge = false
+ allow_forking = (known after apply)
+ allow_merge_commit = true
+ allow_rebase_merge = false
+ allow_squash_merge = true
+ archived = false
+ auto_init = true
+ default_branch = (known after apply)
+ delete_branch_on_merge = true
+ etag = (known after apply)
+ fork = (known after apply)
+ full_name = (known after apply)
+ git_clone_url = (known after apply)
+ html_url = (known after apply)
+ http_clone_url = (known after apply)
+ id = (known after apply)
+ ignore_vulnerability_alerts_during_read = false
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
+ name = "hero-host-config"
+ node_id = (known after apply)
+ primary_language = (known after apply)
+ private = (known after apply)
+ repo_id = (known after apply)
+ source_owner = (known after apply)
+ source_repo = (known after apply)
+ squash_merge_commit_message = "PR_BODY"
+ squash_merge_commit_title = "PR_TITLE"
+ ssh_clone_url = (known after apply)
+ svn_url = (known after apply)
+ topics = [
+ "ansible",
+ "cloudflare-zero-trust",
+ "configuration-management",
+ "node-exporter",
+ "rhel",
+ "systemd",
]
+ visibility = "private"
+ vulnerability_alerts = (known after apply)
+ web_commit_signoff_required = (known after apply)
+ security_and_analysis (known after apply)
}
# github_repository_file.dependabot["hero-host-config"] will be created
+ resource "github_repository_file" "dependabot" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot configuration"
+ commit_sha = (known after apply)
+ content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
"version": 2
EOT
+ file = ".github/dependabot.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_repository_file.dependabot_notify["hero-host-config"] will be created
+ resource "github_repository_file" "dependabot_notify" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot notification workflow"
+ commit_sha = (known after apply)
+ content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
+ file = ".github/workflows/dependabot-notify.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_team_repository.admins["hero-host-config"] will be created
+ resource "github_team_repository" "admins" {
+ etag = (known after apply)
+ id = (known after apply)
+ permission = "admin"
+ repository = "hero-host-config"
+ team_id = "15594330"
}
Plan: 4 to add, 0 to change, 0 to destroy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Declare
hero-host-configas a private repository managed by this OpenTofu root. The repository is the intended canonical home for the physical Hero RHEL host's Ansible configuration, beginning only with node-exporter delivery.The root will seed the centrally managed Dependabot and Dependabot-notify files after the environment-gated apply. It deliberately excludes the new repository from the organization-wide Cloudflare authentication secret broadcast: a future host-management credential must be purpose-built, narrowly scoped, and separately approved.
No driving issue was supplied; this is owner-authorized infrastructure bootstrap work.
Fixes #
None.
Type of change
Validation
opentofu / testandopentofu / planare the sole validation authority.github_repository_fileresources will create the Dependabot and notification files only after a successful root apply.No local OpenTofu init, plan, apply, import, state, or secret-decryption operation was run or claimed.
Impact and rollout
Producer:
tfroot-githubdefines the private repository, its topics, and central Dependabot enrollment. It is the only changed producer.Consumer:
hero-host-configdoes not exist until this root's environment-gatedmainapply succeeds. No Ansible playbook, host bootstrap script, Cloudflare configuration, Prometheus scrape target, alert rule, GitHub Actions deploy workflow, or host credential is included in this change.Future scope: the first repository change will be limited to node-exporter. Any later adoption of physical-host libvirt configuration, post-Ansible SSH identities, Plex Media Server, or yt-dlp must be a separately reviewed ownership migration.
tfroot-libvirtcurrently remains the canonical owner of libvirt guest lifecycle, not the physical RHEL host configuration.Delivery stages: authored on this branch; PR validation is pending. Merge, environment-gated root apply, repository creation, central file seeding, Ansible repository authorship, host bootstrap, scrape selection, reconciliation, and functional verification remain incomplete.
Rollback: before apply, close or revert this PR. After an applied repository-creation change, do not blindly revert the resource because destruction may delete the managed repository; make an explicit archival or retention decision in a separate reviewed change.
Safety and secrets
AI-assisted change: an OpenCode agent materially prepared this branch and pull request. Review the repository-creation plan, private visibility, generic Cloudflare-secret exclusion, and generated-file ownership before merge.