From 12f66b7f7372bdacf1cb0df05b0c2056828bd9b1 Mon Sep 17 00:00:00 2001 From: Joachim Hill-Grannec Date: Sun, 16 Aug 2026 11:29:11 -0600 Subject: [PATCH 1/2] docs: add community-health files and README badges Add CONTRIBUTING.md, SECURITY.md (GitHub private vulnerability reporting), .github/CODEOWNERS, a PR template, and issue templates (bug/feature/config). Add Terraform Registry, release, CI, and license badges to the README. --- .github/CODEOWNERS | 3 ++ .github/ISSUE_TEMPLATE/bug_report.md | 23 ++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 1 + .github/ISSUE_TEMPLATE/feature_request.md | 13 ++++++++ .github/PULL_REQUEST_TEMPLATE.md | 15 +++++++++ CONTRIBUTING.md | 38 +++++++++++++++++++++++ README.md | 5 +++ SECURITY.md | 20 ++++++++++++ 8 files changed, 118 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..0f8c1e9 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +# Review ownership. +# TODO(pelotech): confirm the exact team slug before merging this PR. +* @pelotech/maintainers diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..70db023 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,23 @@ +--- +name: Bug report +about: Report a problem with the module +labels: bug +--- + +**What happened** + +**What you expected** + +**Reproduction** — the module block / inputs (redact any secrets): + +```hcl + +``` + +**Versions** + +- orgkit: +- Terraform: +- integrations/github provider: + +**Plan/apply output** (redacted) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..3ba13e0 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1 @@ +blank_issues_enabled: false diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..5b15796 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,13 @@ +--- +name: Feature request +about: Suggest a capability (see the roadmap in docs/DESIGN.md) +labels: enhancement +--- + +**Problem / use case** + +**Proposed input or resource** + +**Roadmap tier** — does this map to a Tier 1/2/3 item in `docs/DESIGN.md`? + +**Alternatives considered** diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..fbaf5c7 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,15 @@ +## What & why + + + +## Checklist + +- [ ] PR title follows Conventional Commits (it is linted) +- [ ] `terraform fmt -recursive` is clean +- [ ] `pre-commit run --all-files` passes (docs regenerated if inputs/outputs/resources changed) +- [ ] `terraform test` passes for any submodule I changed +- [ ] Breaking input changes are described below (pre-1.0) + +## Breaking changes + + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..87b2aa2 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,38 @@ +# Contributing + +Thanks for contributing to **terraform-github-orgkit**! + +## Development workflow + +- Work on a feature branch — never commit directly to `main`. +- Use [Conventional Commits](https://www.conventionalcommits.org/). PR titles are + linted, and `release-please` derives the changelog and version from them. +- Before opening a PR: + + ```sh + terraform fmt -recursive + pre-commit run --all-files + # run tests for any submodule you touched + cd modules/ && terraform init && terraform test + ``` + +- When you change inputs, outputs, or resources, the `terraform_docs` pre-commit + hook regenerates each README — commit the result. + +## Testing + +Tests use `terraform test` with a mocked provider (`command = plan`), so they need +**no GitHub credentials**. Add coverage for new validations and behavior; keep test +output pristine (warnings are treated as failures). + +## Design & scope + +Read [`docs/DESIGN.md`](docs/DESIGN.md) for the architecture, the composition DAG, +the feature roadmap, and the design principles that must not be violated — notably: +no hardcoded organization policy, and **secrets are never decrypted here** (callers +pass already-decrypted values). + +## Pre-1.0 + +The input interface may still change between minor releases (see the README +"Stability" section). Call out any breaking input changes in your PR description. diff --git a/README.md b/README.md index b1c7fce..06148e4 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,10 @@ # terraform-github-orgkit +[![Terraform Registry](https://img.shields.io/badge/Terraform%20Registry-orgkit-844FBA?logo=terraform)](https://registry.terraform.io/modules/pelotech/orgkit/github/latest) +[![Release](https://img.shields.io/github/v/release/pelotech/terraform-github-orgkit)](https://github.com/pelotech/terraform-github-orgkit/releases) +[![Tests](https://github.com/pelotech/terraform-github-orgkit/actions/workflows/test.yaml/badge.svg)](https://github.com/pelotech/terraform-github-orgkit/actions/workflows/test.yaml) +[![License](https://img.shields.io/github/license/pelotech/terraform-github-orgkit)](LICENSE) + A composable Terraform module suite for managing a **whole GitHub organization** as code — members, teams, repositories, GitHub Actions (variables, secrets and environments), organization rulesets, and organization roles. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..b8d02be --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +# Security Policy + +## Reporting a vulnerability + +Please report security issues **privately** via GitHub's +[private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) +on this repository's **Security** tab ("Report a vulnerability"). Do not open a +public issue for security problems. + +We will acknowledge your report and keep you updated on remediation. + +## Supported versions + +This module is pre-1.0; only the latest minor release receives fixes. + +## A note on secrets + +orgkit **never decrypts secrets**. Callers pass already-decrypted values via the +`secrets` input; decryption is a consumer concern. Do not commit plaintext secrets +to configurations that use this module — pass them from a secure source at apply time. From 584d6a35a1b4c2b5a8331982d940aecb20f058af Mon Sep 17 00:00:00 2001 From: Joachim Hill-Grannec Date: Sun, 16 Aug 2026 11:33:49 -0600 Subject: [PATCH 2/2] Update CODEOWNERS --- .github/CODEOWNERS | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 0f8c1e9..e8285af 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1 @@ -# Review ownership. -# TODO(pelotech): confirm the exact team slug before merging this PR. * @pelotech/maintainers