feat(github): require PR checks on managed repositories

[xnoto]

Summary

• require pull requests and passing CI checks for every active managed repository
• model repository-specific check-run names so each repository waits only for its own workflow checks
• enforce protections for administrators and remove PR/force-push bypasses
• retain zero required approvals and disable code-owner and last-push approval gates

Required checks

• OpenTofu roots: opentofu / test, opentofu / plan
• Other repositories: their observed CI check-run names, including matrix jobs for cflan

Validation

• inspected all active repositories' workflow definitions and recent PR check runs
• verified github_branch_protection semantics against the integrations/github provider documentation
• verified canonical tfroot pre-commit hook pins are current
• reviewed the committed diff; no secret values, state, or decrypted SOPS content are included

Deployment impact

Merging triggers the OpenTofu workflow. Its production apply, after configured environment approval, will update main branch protections on all 13 active managed repositories.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # github_branch_protection.protections[".github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOPDNmL84EC8t_"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "pre-commit",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["cflan"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOOulWjM4EPi_e"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "lint-and-test (3.10)",
              + "lint-and-test (3.11)",
              + "lint-and-test (3.12)",
              + "lint-and-test (3.13)",
              + "type-check",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["images"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsexys4EPi_f"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "checks",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["kustomize-cluster"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsxTyc4EPi_g"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["opencode-server-config"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOUFRjB84E5_bY"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "lint",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["shared-workflows"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsfaHs4EPi_h"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "lint",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["terraform-libvirt-domain"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsXn984EPi_i"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-aws"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsXn6c4EPi_j"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-cloudflare"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsXoEM4EPi_k"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-gcp"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOUET82M4E51BQ"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsXoMs4EPi_l"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-libvirt"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOQsXoKM4EPi_n"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "opentofu / plan",
              + "opentofu / test",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["www"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
      ~ enforce_admins                  = false -> true
      ~ force_push_bypassers            = [
          - "makeitworkcloud/admins",
        ]
        id                              = "BPR_kwDOOuKZAc4EPi_o"
        # (8 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          - dismiss_stale_reviews           = true -> null
          ~ dismissal_restrictions          = [
              - "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              - "makeitworkcloud/admins",
            ]
          ~ require_code_owner_reviews      = true -> false
          ~ require_last_push_approval      = true -> false
          - restrict_dismissals             = true -> null
            # (1 unchanged attribute hidden)
        }

      ~ required_status_checks {
          ~ contexts = [
              + "static-checks",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 13 to change, 0 to destroy.