GitHub Config

OpenTofu-managed configuration for all jonathanmorley/* repositories.

What It Manages

• Repository settings (auto-merge, features, merge strategies)
• Drift detection via daily scheduled runs
• Automated enforcement via PR merges

Usage

Local Development

tofu init
tofu plan    # Preview changes
tofu apply   # Apply changes

How It Works

1. Discovery: Automatically finds all repos in the jonathanmorley namespace
2. Defaults: Applies uniform settings from variables.tf
3. Exclusions: Skip repos via excluded_repos variable
4. Overrides: Per-repo exceptions via repo_overrides variable (future)

Authentication

This repo uses Octo STS for short-lived GitHub credentials. The trust policy is at jonathanmorley/.github/.github/chainguard/terraform.sts.yaml.

State is ephemeral — each workflow run imports all repos fresh from GitHub. No state persistence needed.

Adding a New Repo

New repos are automatically discovered. No action needed.

Excluding a Repo

Add the repo name to the excluded_repos variable in variables.tf:

variable "excluded_repos" {
  default = ["repo-to-skip"]
}

Adding Per-Repo Overrides

Use the repo_overrides variable (coming soon):

variable "repo_overrides" {
  default = {
    "special-repo" = {
      allow_auto_merge = false
    }
  }
}