fix: govern tfroot-twilio Dependabot files - #55
Merged
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
# github_repository_file.dependabot["tfroot-twilio"] will be created
+ resource "github_repository_file" "dependabot" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot configuration"
+ commit_sha = (known after apply)
+ content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT
+ file = ".github/dependabot.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "tfroot-twilio"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be created
+ resource "github_repository_file" "dependabot_notify" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot notification workflow"
+ commit_sha = (known after apply)
+ content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
+ file = ".github/workflows/dependabot-notify.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "tfroot-twilio"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
Plan: 2 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:
# github_repository_file.dependabot["tfroot-twilio"] will be created
+ resource "github_repository_file" "dependabot" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot configuration"
+ commit_sha = (known after apply)
+ content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT
+ file = ".github/dependabot.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "tfroot-twilio"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be created
+ resource "github_repository_file" "dependabot_notify" {
+ autocreate_branch_source_sha = (known after apply)
+ branch = (known after apply)
+ commit_message = "chore: sync managed dependabot notification workflow"
+ commit_sha = (known after apply)
+ content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT
+ file = ".github/workflows/dependabot-notify.yml"
+ id = (known after apply)
+ overwrite_on_create = true
+ ref = (known after apply)
+ repository = "tfroot-twilio"
+ repository_id = (known after apply)
+ sha = (known after apply)
}
Plan: 2 to add, 0 to change, 0 to destroy. |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Owner explicitly requested deleting tfroot-twilio, not archiving it. Remove its catalog entry, dependent import/move declarations, and explicit App-secret recipient. Existing catalog-derived resources remove its repository/protection/team/file/secret instances through canonical tfroot-github apply. Fixes: N/A — full retirement request, provider and AWS prerequisites verified below. ## Type of change - [x] Infrastructure (OpenTofu root or module) - [x] Breaking change ## Validation - [ ] Required PR test/plan pass — pending. - [x] Generated files not hand-edited; canonical catalog/import metadata only. Adversarial/security reviewers ADVANCE after prerequisite evidence. Provider-root teardown #9 mainapply35480009715success; AWS backend/role removal #55 mainapply35482094694success. Account-gated AWS HeadBucket404/ListBuckets absence and IAMGetRoleNoSuchEntity verified. Cluster bridge resources and app already removed through kustomize253/254. No state/credential retrieval. Plan must contain only deletion of this repository's catalog-derived resources: repository, branch protection, two managed Dependabot files, team access, and its Actions secrets. Stop on changes to unrelated repositories or shared secrets. archive_on_destroy is not enabled, so apply performs deletion. ## Impact and rollout IRREVERSIBLE repository deletion on successful main apply, including repository-hosted settings/files/credentials/history. No archival repository or backup copies requested. This PR does not touch shared org credentials or other repositories. Backend and role are already absent, so deletion cannot prevent the completed provider teardown. Source restoration is not a guaranteed repository/history recovery. ## Safety and secrets - [x] No secret values, decrypted files, raw state or sensitive plans - [x] No local OpenTofu init/plan/apply/destroy/import/state operations - [x] Destructive effects and prerequisite evidence described above AI-assisted; no upstream communications. Actual deletion remains gated on matching PR plan and main apply success.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
tfroot-twilioto the centrally managed Dependabot ecosystem map. The repository created by #54 is present and protected, but its initial rollout did not create the two centrally owned Dependabot files because the map did not yet include the new root.Fixes: None — completes the approved
tfroot-twiliorepository bootstrap.Type of change
Validation
Impact and rollout
tfroot-githubremains the sole owner of.github/dependabot.ymland.github/workflows/dependabot-notify.ymlfor active managed repositories. On an approved merge and successfulmainapply, this change creates those two files intfroot-twilio; it does not alter Twilio, Cloudflare, Kubernetes, runtime Secrets, or other repositories.Rollback before apply is closing this pull request. After apply, removing centrally managed files requires a separate reviewed ownership decision.
Safety and secrets
AI agent materially produced this change; review the generator scope before merge.