From 9e4d51689ceab6dc53374accd6270b54b63c59e6 Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:17:15 +0900 Subject: [PATCH 1/7] feat repository management Co-authored-by: proto08 <194586153+proto08@users.noreply.github.com> --- main.tf | 3 + modules/repositories/config.example.yaml | 19 ++++ .../repositories/github-terraform/config.yaml | 9 ++ modules/repositories/main.tf | 92 +++++++++++++++++++ modules/repositories/outputs.tf | 0 .../setup-cloudflare-tunnel/config.yaml | 6 ++ modules/repositories/variables.tf | 0 7 files changed, 129 insertions(+) create mode 100644 modules/repositories/config.example.yaml create mode 100644 modules/repositories/github-terraform/config.yaml create mode 100644 modules/repositories/main.tf create mode 100644 modules/repositories/outputs.tf create mode 100644 modules/repositories/setup-cloudflare-tunnel/config.yaml create mode 100644 modules/repositories/variables.tf diff --git a/main.tf b/main.tf index 8da87eb..e2072ea 100644 --- a/main.tf +++ b/main.tf @@ -25,3 +25,6 @@ module "teams" { teams = var.teams } +module "repositories" { + source = "./modules/repositories" +} diff --git a/modules/repositories/config.example.yaml b/modules/repositories/config.example.yaml new file mode 100644 index 0000000..593e2ad --- /dev/null +++ b/modules/repositories/config.example.yaml @@ -0,0 +1,19 @@ +description: "リポジトリの説明文" +visibility: private # private / internal / public + +topics: + - backend + - example + +has_issues: true +has_projects: false +has_wiki: false + +allow_merge_commit: false +allow_squash_merge: true +allow_rebase_merge: false + +required_approving_review_count: 1 +require_code_owner_review: false +required_status_checks: + - "ci" # GitHub Actionsのjob名 or ステータスチェック名 diff --git a/modules/repositories/github-terraform/config.yaml b/modules/repositories/github-terraform/config.yaml new file mode 100644 index 0000000..44a1c77 --- /dev/null +++ b/modules/repositories/github-terraform/config.yaml @@ -0,0 +1,9 @@ +description: "This organization's manage" +visibility: public + +has_issue: true +has_projects: false +has_wiki: false + +required_status_checks: + - "Terraform Plan" diff --git a/modules/repositories/main.tf b/modules/repositories/main.tf new file mode 100644 index 0000000..d39f2e6 --- /dev/null +++ b/modules/repositories/main.tf @@ -0,0 +1,92 @@ +locals { + repo_config_files = fileset(path.module, "*/config.yaml") + + repositories = { + for f in local.repo_config_files : + dirname(f) => yamldecode(file("${path.module}/${f}")) + } +} + +resource "github_repository" "this" { + for_each = local.repositories + + name = each.key + description = try(each.value.description, "") + visibility = try(each.value.visibility, "private") + topics = try(each.value.topics, []) + + has_issues = try(each.value.has_issues, true) + has_projects = try(each.value.has_projects, false) + has_wiki = try(each.value.has_wiki, false) + + allow_merge_commit = try(each.value.allow_merge_commit, false) + allow_squash_merge = try(each.value.allow_squash_merge, true) + allow_rebase_merge = try(each.value.allow_rebase_merge, false) + delete_branch_on_merge = true + squash_merge_commit_title = "PR_TITLE" + + auto_init = true + + lifecycle { + # 誤ってterraform destroy/apply時にリポジトリごと消えるのを防ぐ + prevent_destroy = true + ignore_changes = [ + # README等をauto_init後に手動編集しても差分検知しない + auto_init, + ] + } +} + +resource "github_repository_vulnerability_alerts" "this" { + for_each = local.repositories + repository = github_repository.this[each.key].name + enabled = true +} + +resource "github_branch_default" "this" { + for_each = local.repositories + repository = github_repository.this[each.key].name + branch = "main" +} + +resource "github_repository_ruleset" "main_protection" { + for_each = local.repositories + + name = "main-protection" + repository = github_repository.this[each.key].name + target = "branch" + enforcement = "active" + + conditions { + ref_name { + include = ["~DEFAULT_BRANCH"] + exclude = [] + } + } + + rules { + deletion = true + non_fast_forward = true + + pull_request { + required_approving_review_count = try(each.value.required_approving_review_count, 1) + dismiss_stale_reviews_on_push = try(each.value.dismiss_stale_reviews_on_push, true) + require_code_owner_review = try(each.value.require_code_owner_review, false) + require_last_push_approval = try(each.value.require_last_push_approval, false) + required_review_thread_resolution = try(each.value.required_review_thread_resolution, true) + } + + required_status_checks { + strict_required_status_checks_policy = try(each.value.strict_status_checks, true) + + dynamic "required_check" { + for_each = try(each.value.required_status_checks, "ci") + content { + context = required_check.value + } + } + } + } + + depends_on = [github_branch_default.this] +} diff --git a/modules/repositories/outputs.tf b/modules/repositories/outputs.tf new file mode 100644 index 0000000..e69de29 diff --git a/modules/repositories/setup-cloudflare-tunnel/config.yaml b/modules/repositories/setup-cloudflare-tunnel/config.yaml new file mode 100644 index 0000000..5e74daf --- /dev/null +++ b/modules/repositories/setup-cloudflare-tunnel/config.yaml @@ -0,0 +1,6 @@ +description: "GitHub Actions Setup Cloudflare Tunnel" +visibility: public + +has_issue: true +has_projects: false +has_wiki: false diff --git a/modules/repositories/variables.tf b/modules/repositories/variables.tf new file mode 100644 index 0000000..e69de29 From 206f554e13cb7244241820db14161751f5dfecfa Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:18:34 +0900 Subject: [PATCH 2/7] fmt Co-authored-by: proto08 <194586153+proto08@users.noreply.github.com> --- modules/repositories/main.tf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/repositories/main.tf b/modules/repositories/main.tf index d39f2e6..fbca62d 100644 --- a/modules/repositories/main.tf +++ b/modules/repositories/main.tf @@ -19,10 +19,10 @@ resource "github_repository" "this" { has_projects = try(each.value.has_projects, false) has_wiki = try(each.value.has_wiki, false) - allow_merge_commit = try(each.value.allow_merge_commit, false) - allow_squash_merge = try(each.value.allow_squash_merge, true) - allow_rebase_merge = try(each.value.allow_rebase_merge, false) - delete_branch_on_merge = true + allow_merge_commit = try(each.value.allow_merge_commit, false) + allow_squash_merge = try(each.value.allow_squash_merge, true) + allow_rebase_merge = try(each.value.allow_rebase_merge, false) + delete_branch_on_merge = true squash_merge_commit_title = "PR_TITLE" auto_init = true @@ -30,7 +30,7 @@ resource "github_repository" "this" { lifecycle { # 誤ってterraform destroy/apply時にリポジトリごと消えるのを防ぐ prevent_destroy = true - ignore_changes = [ + ignore_changes = [ # README等をauto_init後に手動編集しても差分検知しない auto_init, ] @@ -38,7 +38,7 @@ resource "github_repository" "this" { } resource "github_repository_vulnerability_alerts" "this" { - for_each = local.repositories + for_each = local.repositories repository = github_repository.this[each.key].name enabled = true } From 9b187b4ef8d4d98950a37eceaaa4185865917ee2 Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:21:16 +0900 Subject: [PATCH 3/7] fix required status checks Co-authored-by: proto08 <194586153+proto08@users.noreply.github.com> --- modules/repositories/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/repositories/main.tf b/modules/repositories/main.tf index fbca62d..33e4f70 100644 --- a/modules/repositories/main.tf +++ b/modules/repositories/main.tf @@ -80,7 +80,7 @@ resource "github_repository_ruleset" "main_protection" { strict_required_status_checks_policy = try(each.value.strict_status_checks, true) dynamic "required_check" { - for_each = try(each.value.required_status_checks, "ci") + for_each = try(each.value.required_status_checks, []) content { context = required_check.value } From ab150f414af9c04060ab61ff90275f0f10f86df3 Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:24:02 +0900 Subject: [PATCH 4/7] support no strict Co-authored-by: proto08 <194586153+proto08@users.noreply.github.com> --- modules/repositories/setup-cloudflare-tunnel/config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/repositories/setup-cloudflare-tunnel/config.yaml b/modules/repositories/setup-cloudflare-tunnel/config.yaml index 5e74daf..db9cdfd 100644 --- a/modules/repositories/setup-cloudflare-tunnel/config.yaml +++ b/modules/repositories/setup-cloudflare-tunnel/config.yaml @@ -4,3 +4,5 @@ visibility: public has_issue: true has_projects: false has_wiki: false + +strict_status_checks: false \ No newline at end of file From 52bb9697d0acfc254ffb2b20e1743badacac5fdd Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:30:07 +0900 Subject: [PATCH 5/7] fix Co-authored-by: proto08 <194586153+proto08@users.noreply.github.com> --- .../repositories/github-terraform/config.yaml | 4 ---- modules/repositories/main.tf | 21 +++++++++++++------ .../setup-cloudflare-tunnel/config.yaml | 4 ---- 3 files changed, 15 insertions(+), 14 deletions(-) diff --git a/modules/repositories/github-terraform/config.yaml b/modules/repositories/github-terraform/config.yaml index 44a1c77..14d47be 100644 --- a/modules/repositories/github-terraform/config.yaml +++ b/modules/repositories/github-terraform/config.yaml @@ -1,9 +1,5 @@ description: "This organization's manage" visibility: public -has_issue: true -has_projects: false -has_wiki: false - required_status_checks: - "Terraform Plan" diff --git a/modules/repositories/main.tf b/modules/repositories/main.tf index 33e4f70..3702f1c 100644 --- a/modules/repositories/main.tf +++ b/modules/repositories/main.tf @@ -5,6 +5,11 @@ locals { for f in local.repo_config_files : dirname(f) => yamldecode(file("${path.module}/${f}")) } + + effective_status_checks = { + for name, cfg in local.repositories : + name => coalesce(lookup(cfg, "required_status_checks", null), []) + } } resource "github_repository" "this" { @@ -76,13 +81,17 @@ resource "github_repository_ruleset" "main_protection" { required_review_thread_resolution = try(each.value.required_review_thread_resolution, true) } - required_status_checks { - strict_required_status_checks_policy = try(each.value.strict_status_checks, true) + dynamic "required_status_checks" { + for_each = length(local.effective_status_checks[each.key]) > 0 ? [local.effective_status_checks[each.key]] : [] + + content { + strict_required_status_checks_policy = try(each.value.strict_status_checks, true) - dynamic "required_check" { - for_each = try(each.value.required_status_checks, []) - content { - context = required_check.value + dynamic "required_check" { + for_each = required_status_checks.value + content { + context = required_check.value + } } } } diff --git a/modules/repositories/setup-cloudflare-tunnel/config.yaml b/modules/repositories/setup-cloudflare-tunnel/config.yaml index db9cdfd..8e929ca 100644 --- a/modules/repositories/setup-cloudflare-tunnel/config.yaml +++ b/modules/repositories/setup-cloudflare-tunnel/config.yaml @@ -1,8 +1,4 @@ description: "GitHub Actions Setup Cloudflare Tunnel" visibility: public -has_issue: true -has_projects: false -has_wiki: false - strict_status_checks: false \ No newline at end of file From de4861870a3ee9ef058ff8efe1f81c58ba5106f2 Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:33:20 +0900 Subject: [PATCH 6/7] Delete modules/repositories/variables.tf --- modules/repositories/variables.tf | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 modules/repositories/variables.tf diff --git a/modules/repositories/variables.tf b/modules/repositories/variables.tf deleted file mode 100644 index e69de29..0000000 From 2774209a8a2adf3ef953d63b43f1822c79d9adce Mon Sep 17 00:00:00 2001 From: Tsuji Riya Date: Tue, 14 Jul 2026 20:33:48 +0900 Subject: [PATCH 7/7] Delete modules/repositories/outputs.tf --- modules/repositories/outputs.tf | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 modules/repositories/outputs.tf diff --git a/modules/repositories/outputs.tf b/modules/repositories/outputs.tf deleted file mode 100644 index e69de29..0000000