@adamhl8/configs 0.33.1 → 0.33.2

package/dist/tofu/github/actions_secrets.tofu

@@ -0,0 +1,35 @@
+data "sops_file" "secrets" {
+  source_file = pathexpand("~/secrets.yaml")
+}
+
+data "github_actions_secrets" "current" {
+  name = var.repo_name
+}
+
+locals {
+  desired_secrets = setunion(
+    toset([for k, v in var.actions_secrets : k if v]),
+    var.additional_secrets
+  )
+}
+
+locals {
+  unmanaged_secrets = setsubtract(
+    data.github_actions_secrets.current.secrets[*].name,
+    local.desired_secrets
+  )
+}
+
+check "no_unmanaged_secrets" {
+  assert {
+    condition     = length(local.unmanaged_secrets) == 0
+    error_message = "Unmanaged secrets on '${var.repo_name}': ${join(", ", local.unmanaged_secrets)}"
+  }
+}
+
+resource "github_actions_secret" "secrets" {
+  for_each    = local.desired_secrets
+  repository  = var.repo_name
+  secret_name = each.value
+  value       = data.sops_file.secrets.data[lower(each.value)]
+}

package/dist/tofu/github/main.tofu

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = "~> 6.0"
+    }
+    sops = {
+      source  = "carlpett/sops"
+      version = "1.4.1"
+    }
+  }
+}

package/dist/tofu/github/repo_settings.tofu

@@ -0,0 +1,54 @@
+data "local_file" "package_json" {
+  filename = "${path.root}/package.json"
+}
+
+locals {
+  package_json = jsondecode(data.local_file.package_json.content)
+}
+
+resource "github_repository" "current" {
+  name         = var.repo_name
+  description  = local.package_json.description
+  visibility   = var.repo_settings.visibility
+  homepage_url = var.repo_settings.homepage_url
+  topics       = try(local.package_json.keywords, [])
+
+  allow_merge_commit          = false
+  allow_auto_merge            = false
+  allow_forking               = true
+  allow_rebase_merge          = false
+  allow_squash_merge          = true
+  allow_update_branch         = false
+  delete_branch_on_merge      = true
+  has_discussions             = true
+  has_issues                  = true
+  has_projects                = false
+  has_wiki                    = false
+  squash_merge_commit_title   = "PR_TITLE"
+  squash_merge_commit_message = "BLANK"
+  web_commit_signoff_required = false
+
+  security_and_analysis {
+    secret_scanning {
+      status = "enabled"
+    }
+    secret_scanning_push_protection {
+      status = "enabled"
+    }
+  }
+}
+
+resource "github_actions_repository_permissions" "current" {
+  repository      = github_repository.current.name
+  allowed_actions = "all"
+}
+
+resource "github_repository_vulnerability_alerts" "current" {
+  repository = github_repository.current.name
+  enabled    = true
+}
+
+resource "github_repository_dependabot_security_updates" "current" {
+  repository = github_repository.current.name
+  enabled    = false
+}

package/dist/tofu/github/variables.tofu

@@ -0,0 +1,29 @@
+variable "repo_name" {
+  description = "The GitHub repository name"
+  type        = string
+}
+
+variable "repo_settings" {
+  description = "The GitHub repository settings"
+  type = object({
+    visibility   = string
+    homepage_url = optional(string, null)
+  })
+}
+
+variable "actions_secrets" {
+  description = "defaults: CI_SIGNING_KEY, CI_TOKEN"
+  type = object({
+    CI_SIGNING_KEY = optional(bool, true)
+    CI_TOKEN       = optional(bool, true)
+    NPM_CI_TOKEN   = optional(bool, false)
+    GH_TOKEN       = optional(bool, false)
+  })
+  default = {}
+}
+
+variable "additional_secrets" {
+  description = "Additional secret names to manage"
+  type        = set(string)
+  default     = []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adamhl8/configs",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "description": "My shared configs for TS projects",
   "homepage": "https://github.com/adamhl8/configs",
   "bugs": {