Skip to content

repository

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

repository

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
tests
tests
 
 
README.md
README.md
 
 
main.tf
main.tf
 
 
outputs.tf
outputs.tf
 
 
variables.tf
variables.tf
 
 
versions.tf
versions.tf
 
 

README.md

orgkit / repository

Manages GitHub repositories and their team grants, the default all-members read grant, repository and environment Actions variables and secrets, and repository environments (reviewers, wait timers, deployment branch policies).

Consumes a name → { id, slug } team map (e.g. from the teams module, a github_team data source, or literal ids) so it can be used standalone.

Requirements

Name Version
terraform >= 1.9
github ~> 6.0

Providers

Name Version
github ~> 6.0

Modules

No modules.

Resources

Name Type
github_actions_environment_secret.internal resource
github_actions_environment_variable.internal resource
github_actions_secret.repo resource
github_actions_variable.repo resource
github_branch_default.internal resource
github_repository.internal resource
github_repository_environment.internal resource
github_repository_environment_deployment_policy.internal resource
github_repository_ruleset.internal resource
github_repository_vulnerability_alerts.internal resource
github_team_repository.everyone resource
github_team_repository.internal resource

Inputs

Name Description Type Default Required
all_members_team_id ID of the all-members team that receives default read access on non-restricted repositories. null disables the default read grant. string null no
repositories Repositories to manage and which teams may access them. readers, writers
and admins reference team names from var.teams. A team listed at more than
one level gets the highest permission (admin > write > read). Set
restricted = true to withhold the default all-members read grant.		 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, false)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
 [] no
repository_secrets Per-repository Actions and environment secret values (plaintext), keyed by
repository name. Supplied already-decrypted by the caller; this module never
performs decryption.		 
map(object({
    actions      = optional(map(string), {})
    environments = optional(map(map(string)), {})
  }))
 {} no
teams Map of team name => { id, slug } for teams that may be granted repository access or set as environment reviewers. Supplied by the teams module. 
map(object({
    id   = string
    slug = string
  }))
 {} no

Outputs

Name Description
repositories Map of repository name => full github_repository resource attributes.
repository_ids Map of repository name => numeric repo_id. Consumed at the root to scope org-level secrets/variables with 'selected' visibility.