ci: permit automated module release pull requests

[xnoto]

Summary

Allows GitHub Actions to create and approve pull requests only in terraform-libvirt-domain, the repository that owns the automated release-please workflow. The first release run failed because this repository permission was disabled.

Fixes #
N/A — remediates failed release run #34902129930.

Type of change

• Infrastructure (OpenTofu root or module)
• CI / reusable workflow

Validation

• Required pull-request checks pass — pending OpenTofu PR plan.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated file changed.

Authoritative provider evidence: github_workflow_repository_permissions supports repository, default_workflow_permissions, and can_approve_pull_request_reviews in the configured integrations/github ~> 6.0 provider family. The PR plan is the authority for the exact repository-settings delta.

Review gate: procedural reviewer holds were recorded because isolated reviewers did not consume the supplied packet; neither found a Critical or High defect. The earlier owner waiver applies to these procedural holds.

Impact and rollout

Producer: tfroot-github centrally manages repository policy. Consumer: terraform-libvirt-domain release workflow, which runs only after successful main CI and explicitly requests only contents, issues, and pull-requests write scopes.

The change enables Actions PR creation/approval for this single module repository and sets its default workflow token permission to read. It does not alter Actions permissions for other repositories. Applying the root after merge will allow release-please to create the initial release PR; the existing automated workflow creates a tag and GitHub release only after that release PR reaches main and its main CI succeeds.

Rollback: revert this root change and apply the resulting plan before a later release workflow run. The failed run created an orphan release-please--branches--main branch but no PR, tag, or release; no branch cleanup is included in this infrastructure change.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; review the policy delta and OpenTofu plan.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # github_workflow_repository_permissions.release_automation will be created
  + resource "github_workflow_repository_permissions" "release_automation" {
      + can_approve_pull_request_reviews = true
      + default_workflow_permissions     = "read"
      + id                               = (known after apply)
      + repository                       = "terraform-libvirt-domain"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # github_workflow_repository_permissions.release_automation will be created
  + resource "github_workflow_repository_permissions" "release_automation" {
      + can_approve_pull_request_reviews = true
      + default_workflow_permissions     = "read"
      + id                               = (known after apply)
      + repository                       = "terraform-libvirt-domain"
    }

Plan: 1 to add, 0 to change, 0 to destroy.