Delete decommissioned tfroot-twilio repository - #70
Merged
Merged
Conversation
## Summary Owner-authorized full deletion (no archive) of the tfroot-twilio repository through tfroot-github. Removes the catalog entry, its two dependabot file imports, and its explicit CHART_UPDATER_GITHUB_APP_PRIVATE_KEY recipient entry. Broadcast Cloudflare auth recipients shrink automatically through active_github_repositories; all other recipients are unchanged. ## Type of change - [x] Infrastructure (OpenTofu root or module) - [x] Breaking change ## Validation - [ ] Required pull-request checks pass — pending `opentofu / test` and `opentofu / plan`; PR CI is the validation authority. - [x] No generated file changed — README (terraform-docs) lists resource types only; regeneration not required. Expected plan: destroy of only tfroot-twilio-scoped instances — github_repository, strict branch protection, two repository files, admins team access, and its three Actions-secret instances (CHART_UPDATER_GITHUB_APP_PRIVATE_KEY, CLOUDFLARE_AUTH_CLIENT_ID, CLOUDFLARE_AUTH_CLIENT_SECRET). archive_on_destroy is unset in gh-repositories.tf; the integrations/github ~> 6.0 default is false, so destroy deletes the repository instead of archiving it. ## Impact and rollout Apply is sequenced after the separately owned AWS cleanup. Deletion of the GitHub repository, its protections, managed files, and secret instances happens only at the environment-gated main apply. Rollback before apply: revert this branch. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks - [x] Breaking/irreversible effects (repository deletion) are described above; sequencing requires AWS cleanup first AI-assisted change; review the destroy-scoped plan before merge.
The only moved block in moves.tf graduated tfroot-twilio from the relaxed to the strict protection resource. The repository is being removed from the catalog in this branch, so the historical moved block must not outlive its target resource. No other repository is affected.
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:11 +0000 UTC" -> null
[REDACTED: potentially sensitive plan output]
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-06 21:11:12 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-06 21:11:12 +0000 UTC" -> null
}
[REDACTED: potentially sensitive plan output]
# (because key ["tfroot-twilio_CLOUDFLARE_AUTH_CLIENT_ID"] is not in for_each map)
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:08 +0000 UTC" -> null
- id = "tfroot-twilio:CLOUDFLARE_AUTH_CLIENT_ID" -> null
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-03 21:16:08 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-03 21:16:08 +0000 UTC" -> null
}
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:09 +0000 UTC" -> null
[REDACTED: potentially sensitive plan output]
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-03 21:16:09 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-03 21:16:09 +0000 UTC" -> null
}
# github_branch_protection.protections["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_branch_protection" "protections" {
- allows_deletions = false -> null
- allows_force_pushes = false -> null
- enforce_admins = true -> null
- force_push_bypassers = [] -> null
- id = "BPR_kwDOUNmWbs4E7fVz" -> null
- lock_branch = false -> null
- pattern = "main" -> null
- repository_id = "R_kgDOUNmWbg" -> null
- require_conversation_resolution = true -> null
- require_signed_commits = false -> null
- required_linear_history = true -> null
- required_pull_request_reviews {
- dismiss_stale_reviews = false -> null
- dismissal_restrictions = [] -> null
- pull_request_bypassers = [] -> null
- require_code_owner_reviews = false -> null
- require_last_push_approval = false -> null
- required_approving_review_count = 0 -> null
- restrict_dismissals = false -> null
}
- required_status_checks {
- contexts = [
- "opentofu / plan",
- "opentofu / test",
] -> null
- strict = true -> null
}
- restrict_pushes {
- blocks_creations = true -> null
- push_allowances = [
- "makeitworkcloud/admins",
] -> null
}
}
# github_repository.repositories["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository" "repositories" {
- allow_auto_merge = false -> null
- allow_forking = true -> null
- allow_merge_commit = true -> null
- allow_rebase_merge = false -> null
- allow_squash_merge = true -> null
- allow_update_branch = false -> null
- archived = false -> null
- auto_init = true -> null
- default_branch = "main" -> null
- delete_branch_on_merge = true -> null
- etag = "W/\"0087a64a8a474b7bc0d1b279908cbc17afb8c7a55280c2e18dc2c06ed2993c80\"" -> null
- fork = "false" -> null
- full_name = "makeitworkcloud/tfroot-twilio" -> null
- git_clone_url = "git://github.com/makeitworkcloud/tfroot-twilio.git" -> null
- has_discussions = false -> null
- has_downloads = false -> null
- has_issues = false -> null
- has_projects = false -> null
- has_wiki = false -> null
- html_url = "https://github.com/makeitworkcloud/tfroot-twilio" -> null
- http_clone_url = "https://github.com/makeitworkcloud/tfroot-twilio.git" -> null
- id = "tfroot-twilio" -> null
- ignore_vulnerability_alerts_during_read = false -> null
- is_template = false -> null
- merge_commit_message = "PR_TITLE" -> null
- merge_commit_title = "MERGE_MESSAGE" -> null
- name = "tfroot-twilio" -> null
- node_id = "R_kgDOUNmWbg" -> null
- primary_language = "Makefile" -> null
- private = false -> null
- repo_id = 1356437102 -> null
- squash_merge_commit_message = "PR_BODY" -> null
- squash_merge_commit_title = "PR_TITLE" -> null
- ssh_clone_url = "git@github.com:makeitworkcloud/tfroot-twilio.git" -> null
- svn_url = "https://github.com/makeitworkcloud/tfroot-twilio" -> null
- topics = [
- "opentofu",
- "s3-backend",
- "sms",
[REDACTED: potentially sensitive plan output]
- "twilio",
] -> null
- visibility = "public" -> null
- vulnerability_alerts = true -> null
- web_commit_signoff_required = false -> null
- security_and_analysis {
[REDACTED: potentially sensitive plan output]
- status = "disabled" -> null
}
[REDACTED: potentially sensitive plan output]
- status = "disabled" -> null
}
}
}
# github_repository_file.dependabot["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository_file" "dependabot" {
- branch = "main" -> null
- commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT -> null
- commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a" -> null
- content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT -> null
- file = ".github/dependabot.yml" -> null
- id = "tfroot-twilio:.github/dependabot.yml:main" -> null
- overwrite_on_create = false -> null
- ref = "main" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
- sha = "03c5f79693e6cbffc5a63baddc58014ba0232170" -> null
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository_file" "dependabot_notify" {
- branch = "main" -> null
- commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT -> null
- commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a" -> null
- content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT -> null
- file = ".github/workflows/dependabot-notify.yml" -> null
- id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:main" -> null
- overwrite_on_create = false -> null
- ref = "main" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
- sha = "de2725088a33d9dc3bc14f05d3a709a093709856" -> null
}
# github_team_repository.admins["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_team_repository" "admins" {
- etag = "W/\"d9f6b77d1f4eda18d975a5149b2c3f63abdf3cbbc7629ab1a3bfdac162953393\"" -> null
- id = "15594330:tfroot-twilio" -> null
- permission = "admin" -> null
- repository = "tfroot-twilio" -> null
- team_id = "15594330" -> null
}
# github_workflow_repository_permissions.release_automation will be created
+ resource "github_workflow_repository_permissions" "release_automation" {
+ can_approve_pull_request_reviews = true
+ default_workflow_permissions = "read"
+ id = (known after apply)
+ repository = "terraform-libvirt-domain"
}
Plan: 1 to add, 0 to change, 8 to destroy.
OpenTofu will perform the following actions:
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:11 +0000 UTC" -> null
[REDACTED: potentially sensitive plan output]
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-06 21:11:12 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-06 21:11:12 +0000 UTC" -> null
}
[REDACTED: potentially sensitive plan output]
# (because key ["tfroot-twilio_CLOUDFLARE_AUTH_CLIENT_ID"] is not in for_each map)
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:08 +0000 UTC" -> null
- id = "tfroot-twilio:CLOUDFLARE_AUTH_CLIENT_ID" -> null
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-03 21:16:08 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-03 21:16:08 +0000 UTC" -> null
}
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- created_at = "2026-09-03 21:16:09 +0000 UTC" -> null
[REDACTED: potentially sensitive plan output]
- key_id = "3380204578043523366" -> null
- plaintext_value = (sensitive value) -> null
- remote_updated_at = "2026-09-03 21:16:09 +0000 UTC" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
[REDACTED: potentially sensitive plan output]
- updated_at = "2026-09-03 21:16:09 +0000 UTC" -> null
}
# github_branch_protection.protections["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_branch_protection" "protections" {
- allows_deletions = false -> null
- allows_force_pushes = false -> null
- enforce_admins = true -> null
- force_push_bypassers = [] -> null
- id = "BPR_kwDOUNmWbs4E7fVz" -> null
- lock_branch = false -> null
- pattern = "main" -> null
- repository_id = "R_kgDOUNmWbg" -> null
- require_conversation_resolution = true -> null
- require_signed_commits = false -> null
- required_linear_history = true -> null
- required_pull_request_reviews {
- dismiss_stale_reviews = false -> null
- dismissal_restrictions = [] -> null
- pull_request_bypassers = [] -> null
- require_code_owner_reviews = false -> null
- require_last_push_approval = false -> null
- required_approving_review_count = 0 -> null
- restrict_dismissals = false -> null
}
- required_status_checks {
- contexts = [
- "opentofu / plan",
- "opentofu / test",
] -> null
- strict = true -> null
}
- restrict_pushes {
- blocks_creations = true -> null
- push_allowances = [
- "makeitworkcloud/admins",
] -> null
}
}
# github_repository.repositories["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository" "repositories" {
- allow_auto_merge = false -> null
- allow_forking = true -> null
- allow_merge_commit = true -> null
- allow_rebase_merge = false -> null
- allow_squash_merge = true -> null
- allow_update_branch = false -> null
- archived = false -> null
- auto_init = true -> null
- default_branch = "main" -> null
- delete_branch_on_merge = true -> null
- etag = "W/\"0087a64a8a474b7bc0d1b279908cbc17afb8c7a55280c2e18dc2c06ed2993c80\"" -> null
- fork = "false" -> null
- full_name = "makeitworkcloud/tfroot-twilio" -> null
- git_clone_url = "git://github.com/makeitworkcloud/tfroot-twilio.git" -> null
- has_discussions = false -> null
- has_downloads = false -> null
- has_issues = false -> null
- has_projects = false -> null
- has_wiki = false -> null
- html_url = "https://github.com/makeitworkcloud/tfroot-twilio" -> null
- http_clone_url = "https://github.com/makeitworkcloud/tfroot-twilio.git" -> null
- id = "tfroot-twilio" -> null
- ignore_vulnerability_alerts_during_read = false -> null
- is_template = false -> null
- merge_commit_message = "PR_TITLE" -> null
- merge_commit_title = "MERGE_MESSAGE" -> null
- name = "tfroot-twilio" -> null
- node_id = "R_kgDOUNmWbg" -> null
- primary_language = "Makefile" -> null
- private = false -> null
- repo_id = 1356437102 -> null
- squash_merge_commit_message = "PR_BODY" -> null
- squash_merge_commit_title = "PR_TITLE" -> null
- ssh_clone_url = "git@github.com:makeitworkcloud/tfroot-twilio.git" -> null
- svn_url = "https://github.com/makeitworkcloud/tfroot-twilio" -> null
- topics = [
- "opentofu",
- "s3-backend",
- "sms",
[REDACTED: potentially sensitive plan output]
- "twilio",
] -> null
- visibility = "public" -> null
- vulnerability_alerts = true -> null
- web_commit_signoff_required = false -> null
- security_and_analysis {
[REDACTED: potentially sensitive plan output]
- status = "disabled" -> null
}
[REDACTED: potentially sensitive plan output]
- status = "disabled" -> null
}
}
}
# github_repository_file.dependabot["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository_file" "dependabot" {
- branch = "main" -> null
- commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT -> null
- commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a" -> null
- content = <<-EOT
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
"updates":
- "directory": "/"
"groups":
"github-actions":
"patterns":
- "*"
"package-ecosystem": "github-actions"
"schedule":
"interval": "daily"
- "directory": "/"
"groups":
"opentofu":
"patterns":
- "*"
"package-ecosystem": "opentofu"
"schedule":
"interval": "daily"
"version": 2
EOT -> null
- file = ".github/dependabot.yml" -> null
- id = "tfroot-twilio:.github/dependabot.yml:main" -> null
- overwrite_on_create = false -> null
- ref = "main" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
- sha = "03c5f79693e6cbffc5a63baddc58014ba0232170" -> null
}
# github_repository_file.dependabot_notify["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_repository_file" "dependabot_notify" {
- branch = "main" -> null
- commit_message = <<-EOT
feat: bootstrap OpenTofu root
## Summary
Bootstrap `tfroot-twilio` as a no-resource OpenTofu root. It evaluates
the pinned `RJPearson94/twilio` `0.27.1` provider, adds the shared
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
The PR also seeds the two exact `tfroot-github`-generated Dependabot
files through the required pull-request path. This resolves the existing
direct-commit/branch-protection conflict without changing protection
rules or assigning downstream ownership.
The bootstrap deliberately omits an S3 backend because its Makefile
initializes with `-backend=false`; a permanent encrypted backend remains
a follow-up prerequisite before Twilio resources can be managed.
Fixes # N/A — owner-approved Twilio root bootstrap and centralized
Dependabot delivery repair.
## Type of change
- [ ] Bug fix
- [x] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change
## Validation
- [x] Required pull-request checks pass — OpenTofu test and no-resource
plan succeeded in [run
33818165420](https://github.com/makeitworkcloud/tfroot-twilio/actions/runs/33818165420).
- [x] Plan reports no changes; there are no provider configurations,
data sources, or Twilio resources.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the two generated files are an
exact PR-based seed from `tfroot-github/gh-dependabot.tf`; central
ownership remains unchanged and will adopt them after merge.
The exact repository-scoped GitHub OIDC subject was validated through
the separately applied [`tfroot-aws` PR
#40](https://github.com/makeitworkcloud/tfroot-aws/pull/40). No local
[REDACTED: potentially sensitive plan output]
Registry review verified `RJPearson94/twilio` `0.27.1` supports
phone-number and inbound messaging-webhook fields; the bootstrap
intentionally has no provider configuration or Twilio resources.
## Impact and rollout
Producer/consumer chain: `images/tfroot-runner` supplies the canonical
CI toolchain, `shared-workflows` supplies the reusable OpenTofu
workflow, `tfroot-twilio` becomes the future Twilio phone/webhook owner,
and `tfroot-github` remains the sole long-term owner of the seeded
Dependabot files.
Merging will submit the environment-gated main workflow. This
bootstrap's apply has no provider-side effect because there are no
configured providers, data sources, or resources. A later reviewed
[REDACTED: potentially sensitive plan output]
inputs with least privilege before managing Twilio inventory. Twilio
provisioning and webhook changes remain separately confirmation-gated.
Rollback is a normal revert of this bootstrap PR. Do not manually edit
the seeded Dependabot files after merge.
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.
[REDACTED: potentially sensitive plan output]
Security is not enabled; the committed diff was manually inspected
before publication.
AI agent materially produced this change; reviewers should confirm the
retained no-resource bootstrap boundary and central generated-file
ownership.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
EOT -> null
- commit_sha = "315acbf8cf0411eb44c1d59ad3603724d5c15a7a" -> null
- content = <<-EOT
---
# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
name: dependabot-notify
on:
pull_request:
types: [opened, reopened]
permissions: {}
jobs:
notify:
if: github.actor == 'dependabot[bot]'
uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
[REDACTED: potentially sensitive plan output]
EOT -> null
- file = ".github/workflows/dependabot-notify.yml" -> null
- id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:main" -> null
- overwrite_on_create = false -> null
- ref = "main" -> null
- repository = "tfroot-twilio" -> null
- repository_id = 1356437102 -> null
- sha = "de2725088a33d9dc3bc14f05d3a709a093709856" -> null
}
# github_team_repository.admins["tfroot-twilio"] will be destroyed
# (because key ["tfroot-twilio"] is not in for_each map)
- resource "github_team_repository" "admins" {
- etag = "W/\"d9f6b77d1f4eda18d975a5149b2c3f63abdf3cbbc7629ab1a3bfdac162953393\"" -> null
- id = "15594330:tfroot-twilio" -> null
- permission = "admin" -> null
- repository = "tfroot-twilio" -> null
- team_id = "15594330" -> null
}
# github_workflow_repository_permissions.release_automation will be created
+ resource "github_workflow_repository_permissions" "release_automation" {
+ can_approve_pull_request_reviews = true
+ default_workflow_permissions = "read"
+ id = (known after apply)
+ repository = "terraform-libvirt-domain"
}
Plan: 1 to add, 0 to change, 8 to destroy. |
Contributor
Author
|
Owner approved the disclosed plan exception before merge: in addition to the eight tfroot-twilio-scoped deletions, apply may create the already-declared github_workflow_repository_permissions.release_automation resource for terraform-libvirt-domain (default_workflow_permissions=read, can_approve_pull_request_reviews=true). This is the one additional approved change; no other repository or shared-secret changes authorized. Required test and plan succeeded at cb0e84d. Provider teardown and AWS bucket/role deletion were already applied and verified. Proceeding under explicit owner approval. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Owner explicitly requested deleting tfroot-twilio, not archiving it. Remove its catalog entry, dependent import/move declarations, and explicit App-secret recipient. Existing catalog-derived resources remove its repository/protection/team/file/secret instances through canonical tfroot-github apply.
Fixes: N/A — full retirement request, provider and AWS prerequisites verified below.
Type of change
Validation
Adversarial/security reviewers ADVANCE after prerequisite evidence. Provider-root teardown #9 mainapply35480009715success; AWS backend/role removal #55 mainapply35482094694success. Account-gated AWS HeadBucket404/ListBuckets absence and IAMGetRoleNoSuchEntity verified. Cluster bridge resources and app already removed through kustomize253/254. No state/credential retrieval.
Plan must contain only deletion of this repository's catalog-derived resources: repository, branch protection, two managed Dependabot files, team access, and its Actions secrets. Stop on changes to unrelated repositories or shared secrets. archive_on_destroy is not enabled, so apply performs deletion.
Impact and rollout
IRREVERSIBLE repository deletion on successful main apply, including repository-hosted settings/files/credentials/history. No archival repository or backup copies requested. This PR does not touch shared org credentials or other repositories. Backend and role are already absent, so deletion cannot prevent the completed provider teardown. Source restoration is not a guaranteed repository/history recovery.
Safety and secrets
AI-assisted; no upstream communications. Actual deletion remains gated on matching PR plan and main apply success.