Prepare GitHub App credential delivery for module releases

[xnoto]

Summary

Prepare repository-scoped release authentication without weakening organization Actions policy. Add terraform-libvirt-domain as one recipient of the existing CHART_UPDATER_GITHUB_APP_PRIVATE_KEY and document the proposed consumer/installation gates. No key value, App permission, installation, or organization policy is changed in source.

Fixes: N/A — companion to module release-auth migration; HTTP409 root blocker resolved separately by #71.

Type of change

• Documentation
• Infrastructure (OpenTofu root or module)

Validation

• Required test and plan pass — pending.
• Generated README not hand-edited; no new resource types.

Independent adversarial/security/delivery reviews ADVANCE for draft PR creation. Expected plan: exactly one new repository Actions secret for terraform-libvirt-domain, with no unrelated settings or App/installation changes. Do not retrieve or paste private-key values. PR creation is not authorization to apply.

Impact and rollout

MERGE/APPLY HOLD until owner explicitly accepts adding this shared-key recipient and confirms makeitworkbot is installed for terraform-libvirt-domain using the selected-repository installation. Installation ownership stays manual under this root's runbook.

Security distinction: workflow repositories input restricts the minted token, NOT the private key. A repository holding this key could request tokens for other repositories already granted to the App. This adds a ninth recipient; owner must accept that expanded credential exposure before merge.

Then merge/apply this producer first; verify successful delivery without retrieving values. Only afterward merge the companion consumer workflow, which requests Contents and Pull requests write for terraform-libvirt-domain only. No Issues permission increase is proposed. The consumer merge is publication-capable and separately gated. Rollback removes the recipient through a reviewed root change; it does not revoke the shared key globally.

Safety and secrets

• No plaintext/decrypted secrets, state, kubeconfigs, tokens, or sensitive plans
• No local OpenTofu init/plan/apply/destroy/import/state operations
• Credential exposure, manual installation, and staged rollout gates explained

AI-assisted. Draft only, no auto-merge, no upstream communications.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "terraform-libvirt-domain"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "terraform-libvirt-domain"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

[xnoto]

Owner explicitly approved merging and proceeding after the shared-key recipient risk and selected-installation prerequisites were presented. Current head241c50926a69ea2b57e2a244f52a6eb2f53ecc69 has successful test/plan and synthetic checks; plan shows only1new Actions secret for terraform-libvirt-domain,0change,0destroy. Proceeding producer-first. Will verify successful root apply without retrieving values before merging the consumer workflow. App token functionality will be verified in the resulting release workflow; no organization-wide permission change or App permission expansion is included.