From 95c9b3cb0173619abc5056889cfbfd138f541223 Mon Sep 17 00:00:00 2001
From: Elior Erez <eerez@redhat.com>
Date: Wed, 5 Aug 2026 18:53:54 -0400
Subject: [PATCH] Revert removed-block approach for archived-repo sub-resources

removed blocks require the resource's configuration to be deleted from
source entirely -- they can't coexist with a resource block that's
still declared (even when gated to count=0/empty for_each for the
specific instance in question), because the block is shared across
every module instance, archived or not. Terraform validates this
statically and refuses to plan at all:

  Error: Removed resource block still exists
  This statement declares a removal of the resource
  module.repo_fulfillment_service.github_branch_protection.repo_protection,
  but this resource block still exists in the configuration.

This broke the very first real apply after #165 merged (run
31053762343), blocking the whole pipeline again -- the exact failure
mode this effort exists to fix, caused by the fix itself.

Delete removed_archived_repos.tf. No other change is needed:
modules/common_repository/main.tf's count/for_each conditions
(count = ... : var.archived ? 0 : ..., for_each = var.archived ? {} : {...})
were never modified by the removed-block commit -- they already
correctly guard branch_protection and environment for archived repos.
That was always the right fix for *not creating new* instances; the
removed blocks were only ever needed to cleanly detach the *existing*
tracked instances for the 7 already-archived repos without an
unverified destroy attempt. That part still needs doing, just via
`tofu state rm` instead (see PR description for the exact addresses).

Signed-off-by: Elior Erez <eerez@redhat.com>
---
 removed_archived_repos.tf | 101 --------------------------------------
 1 file changed, 101 deletions(-)
 delete mode 100644 removed_archived_repos.tf

diff --git a/removed_archived_repos.tf b/removed_archived_repos.tf
deleted file mode 100644
index ed6926c..0000000
--- a/removed_archived_repos.tf
+++ /dev/null
@@ -1,101 +0,0 @@
-# github_issue_label and github_repository_ruleset are safe to guard with a
-# plain count=0/empty for_each for archived repos: the underlying Terraform
-# GitHub provider (v6.12.1) already handles deleting those two resource
-# types gracefully against an archived repository (skips the delete, drops
-# it from state). github_branch_protection and github_repository_environment
-# are not -- their delete codepaths call the GitHub API directly with no
-# archived-repo handling, so flipping their count/for_each to zero for an
-# archived repo (in modules/common_repository/main.tf) would make Terraform
-# attempt to destroy the existing resource with unverified behavior against
-# an archived repo. `removed` blocks tell Terraform to stop managing these
-# specific already-existing instances without ever issuing a delete.
-#
-# See the review discussion on osac-project/github-config#165 for the full
-# analysis (CodeRabbit + follow-up).
-#
-# One block is required per already-archived repo, since `removed` targets
-# a concrete resource address rather than a dynamic set.
-
-removed {
-  from = module.repo_fulfillment_service.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_fulfillment_service.github_repository_environment.env
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_cloudkit_operator.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_cloudkit_operator.github_repository_environment.env
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_cloudkit_aap.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_cloudkit_aap.github_repository_environment.env
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_osac_installer.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_osac_installer.github_repository_environment.env
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_osac_csi_driver.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_osac_csi_driver.github_repository_environment.env
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_host_management_openstack.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}
-
-removed {
-  from = module.repo_bare_metal_operator.github_branch_protection.repo_protection
-  lifecycle {
-    destroy = false
-  }
-}