Skip to content

Commit ccf7e67

Browse files
xnotoxnoto
authored
feat: centrally manage root workflows and licenses
Manage reusable OpenTofu callers and GPLv3 licenses from tfroot-github.
1 parent d4ca1d5 commit ccf7e67

2 files changed

Lines changed: 175 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ No modules.
2727
| [github_repository.repositories](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository) | resource |
2828
| [github_repository_file.dependabot](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
2929
| [github_repository_file.dependabot_notify](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
30+
| [github_repository_file.license](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
31+
| [github_repository_file.opentofu_workflow](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
3032
| [github_team.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
3133
| [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
3234
| [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource |

‎gh-managed-files.tf‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# Reusable OpenTofu callers and GPLv3 licenses are managed centrally here.
2+
# Do not add hand-maintained copies to the target repositories.
3+
#
4+
# The caller map contains only roots using the shared OpenTofu workflow.
5+
# terraform-libvirt-domain has distinct CI, and tfroot-namecheap has no branch
6+
# yet, so neither can safely receive this caller file.
7+
locals {
8+
managed_opentofu_workflows = {
9+
"tfroot-aws" = <<-EOT
10+
# Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
11+
name: opentofu
12+
13+
on:
14+
pull_request:
15+
branches:
16+
- main
17+
push:
18+
branches:
19+
- main
20+
21+
permissions:
22+
contents: write
23+
id-token: write
24+
pull-requests: write
25+
26+
jobs:
27+
opentofu:
28+
# Fork PRs do not run infrastructure-aware OpenTofu jobs.
29+
if: >-
30+
github.event_name != 'pull_request' ||
31+
github.event.pull_request.head.repo.full_name == github.repository
32+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
33+
EOT
34+
"tfroot-cloudflare" = <<-EOT
35+
# Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
36+
name: opentofu
37+
38+
on:
39+
pull_request:
40+
branches:
41+
- main
42+
push:
43+
branches:
44+
- main
45+
46+
permissions:
47+
contents: write
48+
id-token: write
49+
pull-requests: write
50+
51+
jobs:
52+
opentofu:
53+
# Fork PRs do not run infrastructure-aware OpenTofu jobs.
54+
if: >-
55+
github.event_name != 'pull_request' ||
56+
github.event.pull_request.head.repo.full_name == github.repository
57+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
58+
EOT
59+
"tfroot-gcp" = <<-EOT
60+
# Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
61+
name: opentofu
62+
63+
on:
64+
pull_request:
65+
branches:
66+
- main
67+
push:
68+
branches:
69+
- main
70+
71+
permissions:
72+
contents: write
73+
id-token: write
74+
pull-requests: write
75+
76+
jobs:
77+
opentofu:
78+
# Fork PRs do not run infrastructure-aware OpenTofu jobs.
79+
if: >-
80+
github.event_name != 'pull_request' ||
81+
github.event.pull_request.head.repo.full_name == github.repository
82+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
83+
with:
84+
gcp-workload-identity-provider: projects/920734942788/locations/global/workloadIdentityPools/github/providers/github
85+
gcp-service-account: terraformer@makeitworkcloud.iam.gserviceaccount.com
86+
EOT
87+
"tfroot-github" = <<-EOT
88+
# Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
89+
name: opentofu
90+
91+
on:
92+
pull_request:
93+
branches:
94+
- main
95+
push:
96+
branches:
97+
- main
98+
99+
permissions:
100+
contents: write
101+
id-token: write
102+
pull-requests: write
103+
104+
jobs:
105+
opentofu:
106+
# Fork PRs do not run infrastructure-aware OpenTofu jobs.
107+
if: >-
108+
github.event_name != 'pull_request' ||
109+
github.event.pull_request.head.repo.full_name == github.repository
110+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
111+
EOT
112+
"tfroot-libvirt" = <<-EOT
113+
# Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
114+
name: opentofu
115+
116+
on:
117+
pull_request:
118+
branches:
119+
- main
120+
push:
121+
branches:
122+
- main
123+
124+
permissions:
125+
contents: write
126+
id-token: write
127+
pull-requests: write
128+
129+
jobs:
130+
opentofu:
131+
# Fork PRs do not run infrastructure-aware OpenTofu jobs.
132+
if: >-
133+
github.event_name != 'pull_request' ||
134+
github.event.pull_request.head.repo.full_name == github.repository
135+
uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
136+
with:
137+
# Native tfroot-runner scale set in kustomize-cluster/workloads/arc.
138+
# The runner pod IS the tfroot-runner image — no nested container.
139+
runs-on: arc-tf
140+
setup-ssh: true
141+
secrets:
142+
SSH_PRIVATE_KEY: $${{ secrets.SSH_PRIVATE_KEY }}
143+
SSH_KNOWN_HOSTS: $${{ secrets.SSH_KNOWN_HOSTS }}
144+
EOT
145+
}
146+
147+
# tfroot-namecheap is intentionally excluded until it has a default branch;
148+
# github_repository_file cannot create a file on an absent branch.
149+
managed_license_repositories = setsubtract(
150+
local.active_github_repositories,
151+
toset(["tfroot-namecheap"])
152+
)
153+
}
154+
155+
resource "github_repository_file" "opentofu_workflow" {
156+
for_each = local.managed_opentofu_workflows
157+
158+
repository = github_repository.repositories[each.key].name
159+
file = ".github/workflows/opentofu.yml"
160+
content = each.value
161+
commit_message = "chore: sync managed OpenTofu workflow"
162+
overwrite_on_create = true
163+
}
164+
165+
resource "github_repository_file" "license" {
166+
for_each = local.managed_license_repositories
167+
168+
repository = github_repository.repositories[each.key].name
169+
file = "LICENSE"
170+
content = file("${path.module}/LICENSE")
171+
commit_message = "chore: sync GPLv3 license"
172+
overwrite_on_create = true
173+
}

0 commit comments

Comments
 (0)