feat(github): manage OpenCode server config repository

[xnoto]

Summary

• manage the public makeitworkcloud/opencode-server-config repository
• make the cluster-owned OpenCode server configuration independent of personal xnoto configuration repositories

Validation

• tofu init -backend=false -input=false
• tofu validate -no-color
• make test

Security

• Repository is intended only for non-secret server configuration, agents, provider/MCP definitions, and linting. OpenCode OAuth/API credentials remain SOPS-managed in kustomize-cluster.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # github_actions_secret.secrets["opencode-server-config_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "opencode-server-config"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["opencode-server-config_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "opencode-server-config"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_branch_protection.protections["opencode-server-config"] will be created
  + resource "github_branch_protection" "protections" {
      + allows_deletions                = false
      + allows_force_pushes             = false
      + enforce_admins                  = false
      + force_push_bypassers            = [
          + "makeitworkcloud/admins",
        ]
      + id                              = (known after apply)
      + lock_branch                     = false
      + pattern                         = "main"
      + repository_id                   = (known after apply)
      + require_conversation_resolution = true
      + require_signed_commits          = false
      + required_linear_history         = true

      + required_pull_request_reviews {
          + dismiss_stale_reviews           = true
          + dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          + pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
          + require_code_owner_reviews      = true
          + require_last_push_approval      = true
          + required_approving_review_count = 0
          + restrict_dismissals             = true
        }

      + required_status_checks {
          + strict = true
        }

      + restrict_pushes {
          + blocks_creations = true
          + push_allowances  = [
              + "makeitworkcloud/admins",
            ]
        }
    }

  # github_repository.repositories["opencode-server-config"] will be created
  + resource "github_repository" "repositories" {
      + allow_auto_merge                        = false
      + allow_forking                           = (known after apply)
      + allow_merge_commit                      = true
      + allow_rebase_merge                      = false
      + allow_squash_merge                      = true
      + archived                                = false
      + default_branch                          = (known after apply)
      + delete_branch_on_merge                  = true
      + etag                                    = (known after apply)
      + fork                                    = (known after apply)
      + full_name                               = (known after apply)
      + git_clone_url                           = (known after apply)
      + html_url                                = (known after apply)
      + http_clone_url                          = (known after apply)
      + id                                      = (known after apply)
      + ignore_vulnerability_alerts_during_read = false
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
      + name                                    = "opencode-server-config"
      + node_id                                 = (known after apply)
      + primary_language                        = (known after apply)
      + private                                 = (known after apply)
      + repo_id                                 = (known after apply)
      + source_owner                            = (known after apply)
      + source_repo                             = (known after apply)
      + squash_merge_commit_message             = "PR_BODY"
      + squash_merge_commit_title               = "PR_TITLE"
      + ssh_clone_url                           = (known after apply)
      + svn_url                                 = (known after apply)
      + topics                                  = (known after apply)
      + visibility                              = "public"
      + vulnerability_alerts                    = (known after apply)
      + web_commit_signoff_required             = (known after apply)

      + security_and_analysis (known after apply)
    }

  # github_team_repository.admins["opencode-server-config"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "opencode-server-config"
      + team_id    = "15594330"
    }

Plan: 5 to add, 0 to change, 0 to destroy.