feat(github): manage charts repository

[xnoto]

Summary

• create the public makeitworkcloud/charts repository through OpenTofu
• initialize its main branch so its first chart can be contributed through a protected PR
• apply the standard organization branch-protection and admin access model, requiring the future chart CI test check

Validation

• inspected the current branch-protection and repository resource configuration
• verified github_repository.auto_init behavior in the integrations/github provider documentation
• verified the canonical tfroot hook pins are current
• reviewed the final diff; no state, credentials, or decrypted values are included

Follow-up

After CI passes and the production apply creates charts, seed the initial opencode-server Helm chart through a protected PR in that new repository.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # github_actions_secret.secrets["charts_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "charts"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["charts_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "charts"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_branch_protection.protections["charts"] will be created
  + resource "github_branch_protection" "protections" {
      + allows_deletions                = false
      + allows_force_pushes             = false
      + enforce_admins                  = true
      + id                              = (known after apply)
      + lock_branch                     = false
      + pattern                         = "main"
      + repository_id                   = (known after apply)
      + require_conversation_resolution = true
      + require_signed_commits          = false
      + required_linear_history         = true

      + required_pull_request_reviews {
          + require_code_owner_reviews      = false
          + require_last_push_approval      = false
          + required_approving_review_count = 0
        }

      + required_status_checks {
          + contexts = [
              + "test",
            ]
          + strict   = true
        }

      + restrict_pushes {
          + blocks_creations = true
          + push_allowances  = [
              + "makeitworkcloud/admins",
            ]
        }
    }

  # github_repository.repositories["charts"] will be created
  + resource "github_repository" "repositories" {
      + allow_auto_merge                        = false
      + allow_forking                           = (known after apply)
      + allow_merge_commit                      = true
      + allow_rebase_merge                      = false
      + allow_squash_merge                      = true
      + archived                                = false
      + auto_init                               = true
      + default_branch                          = (known after apply)
      + delete_branch_on_merge                  = true
      + etag                                    = (known after apply)
      + fork                                    = (known after apply)
      + full_name                               = (known after apply)
      + git_clone_url                           = (known after apply)
      + html_url                                = (known after apply)
      + http_clone_url                          = (known after apply)
      + id                                      = (known after apply)
      + ignore_vulnerability_alerts_during_read = false
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
      + name                                    = "charts"
      + node_id                                 = (known after apply)
      + primary_language                        = (known after apply)
      + private                                 = (known after apply)
      + repo_id                                 = (known after apply)
      + source_owner                            = (known after apply)
      + source_repo                             = (known after apply)
      + squash_merge_commit_message             = "PR_BODY"
      + squash_merge_commit_title               = "PR_TITLE"
      + ssh_clone_url                           = (known after apply)
      + svn_url                                 = (known after apply)
      + topics                                  = (known after apply)
      + visibility                              = "public"
      + vulnerability_alerts                    = (known after apply)
      + web_commit_signoff_required             = (known after apply)

      + security_and_analysis (known after apply)
    }

  # github_team_repository.admins["charts"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "charts"
      + team_id    = "15594330"
    }

Plan: 5 to add, 0 to change, 0 to destroy.