OSAC-3530: Lock osac-csi-driver's branch via Terraform

[eliorerz]

Summary

osac-csi-driver is merging into osac (OSAC-3530, matching the fulfillment-service/osac-operator/osac-aap precedent). Set lock_branch = true on its module block so the lock is durable across Terraform's auto-apply cycles, rather than a one-off API call that silently reverts on the next apply (the exact failure mode already hit and fixed for the other three components).

Also applied the same lock immediately via a direct API PUT (full GET-then-PUT preserving all other existing branch protection settings) so the repo is locked right now, not just once this PR merges.

Validation

• tofu fmt -check -diff -- clean.
• tofu validate -- succeeds (only the same pre-existing has_downloads deprecation warnings noted in prior PRs).

Test plan

• CI plan shows only the intended lock_branch change on osac-csi-driver's branch protection

Summary by CodeRabbit

• Chores
  • Marked the repository’s branch as read-only in preparation for archival.
  • Added explanatory notes documenting the repository’s archival status.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2a6c2949-b2f3-4424-b893-de09481b8ffc

📥 Commits

Reviewing files that changed from the base of the PR and between f43abee and 6c2cb1f.

📒 Files selected for processing (1)

• repositories.tf

---

Walkthrough

The repo_osac_csi_driver configuration now locks its branch as read-only and includes comments that document the archival and merge context.

Changes

Repository archival configuration

Layer / File(s)	Summary
Lock CSI driver branch repositories.tf	The repo_osac_csi_driver module sets lock_branch = true and adds archival and merge context comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• osac-project/github-config#138: Updates the same repository configuration with branch-locking and archival settings.
• osac-project/github-config#150: Uses the same lock_branch = true pattern in repositories.tf.
• osac-project/github-config#154: Locks a repository branch before archival or consolidation.

Suggested reviewers: larsks

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the Terraform change that locks the osac-csi-driver branch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR adds only comments and lock_branch = true; scans found no hardcoded secret assignments, encoded blobs, credential URLs, or private-key material.
No-Weak-Crypto	✅ Passed	The PR adds only comments and lock_branch = true; the changed code and tracked repository contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The change adds only comments and literal lock_branch = true in Terraform; no SQL concatenation, shell/eval, unsafe deserialization, os.system, or HTML injection patterns are present.
Container-Privileges	✅ Passed	The PR changes only repositories.tf and adds lock_branch=true; no container/Kubernetes manifests or flagged privilege settings are present.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only repositories.tf comments and lock_branch=true; it adds no logging and contains no passwords, tokens, API keys, PII, hostnames, or customer data.
Ai-Attribution	✅ Passed	The contributor PR description and the sole reviewed commit contain no AI-tool mention or attribution trailer, so this conditional check does not apply.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}