Repository navigation
feat: mise token tasks, drop dead 1Password path, reconcile inventory - #50
Merged
Merged
Conversation
The last org secret was removed 2026-10-01, leaving org_secrets empty, but the onepassword provider stayed declared and referenced with no provider block, failing every plan with 'Invalid provider configuration'. Remove the provider, the onepassword_item/secret_selected data sources, the github_actions_organization_secret resource, the secret_visibility variable, and the managed_secrets output, and regenerate the lockfile. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
Remove the tofu:plan/tofu:apply mise tasks that injected a 1Password token, so bare tofu plan/apply behaves exactly as in chainargo-github-terraform and jackin-github-terraform: the GitHub provider reads GITHUB_TOKEN from the environment. Document the required token permissions in the README. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2934ee7a6f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Same section order and wording as chainargo-github-terraform and jackin-github-terraform: Layout, Authentication, Adding a repository, Verification. Fixes the stale repository count (41 -> 47) and drops the user-specific cd path from the verification block. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
Add tofu:plan/tofu:apply mise tasks that inject the org token from 1Password (op://tailrocks/GitHub/tailrocks-opentofu) and refuse to run on an empty read, and document both authentication flows in the README. Also reconcile the inventory with live GitHub state so the pending rollout can converge: - Drop the stale tailrocks-open-source-skills and tui-snap entries: both repos were renamed (to tailrocks-contribution-skills and tuiscotti, already in the inventory), so the old keys double-managed the same repositories and their ruleset creates failed with 422 Name must be unique. - Re-import the live protect-main/protect-tags rulesets for repo-scan, tailrocks-repository-skills, and rust-repository-policy using their current numeric ruleset IDs (previous import IDs went stale). - Update the mandatory-repository check and README count to 45. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
donbeave
changed the title
The API silently ignores advanced_security_enabled_for_new_repositories for orgs without GitHub Advanced Security, producing a perpetual diff. Matches the jackin-project handling; ChainArgos keeps the field because its org accepts it. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
secret_visibility and OP_SERVICE_ACCOUNT_TOKEN described the removed 1Password secrets path; op_vault referenced a variable that no longer exists. The example now lists only the surviving override and the GITHUB_TOKEN env flow. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
donbeave
added a commit
to jackin-project/github-terraform
that referenced
this pull request
Oct 12, 2026
## Related pull requests - ChainArgos/github-terraform#27 - tailrocks/github-terraform#50 ## Summary This PR aligns the README with the shared skeleton used by the other github-terraform repositories — same sections in the same order (Layout, Authentication, Adding a repository, Verification) — and adds the repository's pull request template. ## What ships - README gains an Authentication section documenting that tofu reads an ambient `GITHUB_TOKEN` needing Administration: write on every managed repository. - The "Adding a repository" runbook now includes the mandatory-list step in `checks.tf` (`mandatory_target_repositories_present`) and the no-CI allowlist step, matching the actual checks. - A pull request template matching this repository's CI gates (tofu fmt/init/validate, plan smoke). ## What this addresses - The runbook omitted the mandatory-list check update, so following it produced a failing `checks.tf` invariant. - The token requirement was undocumented; the provider reads `GITHUB_TOKEN` from the environment with no repository guidance. ## Verify locally ### Checkout ```sh gh pr checkout 57 ``` ### Static checks Expected: `tofu validate` prints "Success! The configuration is valid." ```sh tofu fmt -check -recursive tofu init -backend=false -input=false -lockfile=readonly tofu validate -no-color ``` ## Migration notes None. --------- Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related pull requests
Summary
This PR brings tailrocks/github-terraform to full parity with the ChainArgos and jackin-project github-terraform repos: the same mise tofu tasks inject the org's
*-opentofutoken from 1Password, the dead 1Password provider path is removed, the README follows the shared skeleton, and the repository inventory is reconciled with live GitHub state (two repos were renamed, three had stale ruleset import IDs). A pull request template matching this repo's CI gates is included.What ships
tofu:plan/tofu:applymise tasks that read thetailrocks-opentofutoken from 1Password and export it asGITHUB_TOKEN; baretofuwith an ambient token still works too.onepasswordprovider, its data sources, the org-secret resource, thesecret_visibilityvariable, and themanaged_secretsoutput (no org secrets remain since 2026-10-01); provider lockfile regenerated.tui-snapandtailrocks-open-source-skillsremoved (renamed on GitHub totuiscottiandtailrocks-contribution-skills, already in the inventory under the new names); six ruleset import blocks added forrepo-scan,tailrocks-repository-skills, andrust-repository-policywhose live rulesets were never imported.Behavior changes
mise run tofu:plan/mise run tofu:apply(1Password injection) or an exportedGITHUB_TOKEN; the token needs org admin ontailrocksplus Administration: write on every managed repository.What this addresses
tofu plan/applyfailed with "Invalid provider configuration" from the dead 1Password provider, plus 403s from tokens lacking org permissions.Not included
tailrocks-asd-ste100-skillsprotect-main/protect-tags rulesets: the org is on the free plan and the repo is private, so GitHub returns 403 "Upgrade to GitHub Pro or make this repository public". Its two ruleset creations remain as a pending diff until visibility or plan changes.Verify locally
Checkout
Static checks
Expected:
tofu validateprints "Success! The configuration is valid."Smoke
Expected: the plan renders with no provider or permission errors; the only pending actions are the two
tailrocks-asd-ste100-skillsruleset creates (free-plan 403, see "Not included").Migration notes
Use
mise run tofu:plan/mise run tofu:apply, or exportGITHUB_TOKENmanually. The oldtofufield in the 1Passwordtailrocks/GitHubitem is superseded bytailrocks-opentofu.