From 85bf7cea8c43bd82045c4507634be61d843c46e7 Mon Sep 17 00:00:00 2001 From: Joachim Hill-Grannec Date: Sun, 16 Aug 2026 12:49:16 -0600 Subject: [PATCH 1/2] feat: default archive_on_destroy to true Archiving a repository on destroy is safer than permanently deleting it. Consumers can still opt out per-repo with archive_on_destroy = false. --- README.md | 2 +- modules/repository/README.md | 2 +- modules/repository/variables.tf | 2 +- variables.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 66cc7af..4ea06b3 100644 --- a/README.md +++ b/README.md @@ -133,7 +133,7 @@ upgrading. Breaking input changes so far, since the initial release: | [organization\_variables](#input\_organization\_variables) | Org-level shared Actions variables (plaintext value + visibility). | 
map(object({
    value        = string
    visibility   = optional(string, "private")
    repositories = optional(list(string), [])
  }))
| `{}` | no | | [owners](#input\_owners) | Explicit set of owner usernames (mapped to GitHub's `admin` role). Ignored when `owners_team` is set. | `set(string)` | `[]` | no | | [owners\_team](#input\_owners\_team) | Convenience: derive organization owners from the members of this team, by
name. `null` (default) means use the explicit `owners` set instead. There is
no hardcoded owners team — the consumer chooses. | `string` | `null` | no | -| [repositories](#input\_repositories) | Repositories and which teams may access them. See the repository submodule for the full object schema and validations. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, false)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | +| [repositories](#input\_repositories) | Repositories and which teams may access them. See the repository submodule for the full object schema and validations. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | | [secrets](#input\_secrets) | Decrypted secret values keyed by scope. Supplied already-decrypted by the caller; this module never performs decryption. | 
object({
    org = optional(map(string), {})
    repos = optional(map(object({
      actions      = optional(map(string), {})
      environments = optional(map(map(string)), {})
    })), {})
  })
| 
{
  "org": {},
  "repos": {}
}
| no | | [teams](#input\_teams) | Teams and their membership. A team may hold predefined organization-level
GitHub roles via `org_roles`. Repository access is granted per repository via
readers/writers/admins, not through org roles. | 
list(object({
    name        = string
    description = string
    members     = optional(list(string), [])
    org_roles   = optional(list(string), [])
  }))
| `[]` | no | | [users](#input\_users) | Organization members. `fullname`/`email` are informational; membership is keyed on `username`. | 
list(object({
    username = string
    fullname = optional(string, "")
    email    = optional(string, "")
  }))
| `[]` | no | diff --git a/modules/repository/README.md b/modules/repository/README.md index 99f6261..df51ff6 100644 --- a/modules/repository/README.md +++ b/modules/repository/README.md @@ -47,7 +47,7 @@ No modules. | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [all\_members\_team\_id](#input\_all\_members\_team\_id) | ID of the all-members team that receives default read access on non-restricted repositories. null disables the default read grant. | `string` | `null` | no | -| [repositories](#input\_repositories) | Repositories to manage and which teams may access them. `readers`, `writers`
and `admins` reference team names from `var.teams`. A team listed at more than
one level gets the highest permission (admin > write > read). Set
`restricted = true` to withhold the default all-members read grant. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, false)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | +| [repositories](#input\_repositories) | Repositories to manage and which teams may access them. `readers`, `writers`
and `admins` reference team names from `var.teams`. A team listed at more than
one level gets the highest permission (admin > write > read). Set
`restricted = true` to withhold the default all-members read grant. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | | [repository\_secrets](#input\_repository\_secrets) | Per-repository Actions and environment secret values (plaintext), keyed by
repository name. Supplied already-decrypted by the caller; this module never
performs decryption. | 
map(object({
    actions      = optional(map(string), {})
    environments = optional(map(map(string)), {})
  }))
| `{}` | no | | [teams](#input\_teams) | Map of team name => { id, slug } for teams that may be granted repository access or set as environment reviewers. Supplied by the teams module. | 
map(object({
    id   = string
    slug = string
  }))
| `{}` | no | diff --git a/modules/repository/variables.tf b/modules/repository/variables.tf index 7e4bba6..4f77de9 100644 --- a/modules/repository/variables.tf +++ b/modules/repository/variables.tf @@ -24,7 +24,7 @@ variable "repositories" { gitignore_template = optional(string, null) license_template = optional(string, null) archived = optional(bool, false) - archive_on_destroy = optional(bool, false) + archive_on_destroy = optional(bool, true) default_branch = optional(string, null) enable_pages = optional(bool, false) signed_commits = optional(bool, true) diff --git a/variables.tf b/variables.tf index 3897c7b..37fcb4f 100644 --- a/variables.tf +++ b/variables.tf @@ -73,7 +73,7 @@ variable "repositories" { gitignore_template = optional(string, null) license_template = optional(string, null) archived = optional(bool, false) - archive_on_destroy = optional(bool, false) + archive_on_destroy = optional(bool, true) default_branch = optional(string, null) enable_pages = optional(bool, false) signed_commits = optional(bool, true) From c2fed7207dfb9c68d4e4924033c380745d8ea8b9 Mon Sep 17 00:00:00 2001 From: Joachim Hill-Grannec Date: Sun, 16 Aug 2026 12:55:51 -0600 Subject: [PATCH 2/2] feat: default has_downloads to false The GitHub Downloads section is a deprecated legacy feature superseded by Releases. Defaulting it off matches GitHub's effective default and avoids spurious drift on existing repositories. --- README.md | 2 +- modules/repository/README.md | 2 +- modules/repository/variables.tf | 2 +- variables.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4ea06b3..c594f14 100644 --- a/README.md +++ b/README.md @@ -133,7 +133,7 @@ upgrading. Breaking input changes so far, since the initial release: | [organization\_variables](#input\_organization\_variables) | Org-level shared Actions variables (plaintext value + visibility). | 
map(object({
    value        = string
    visibility   = optional(string, "private")
    repositories = optional(list(string), [])
  }))
| `{}` | no | | [owners](#input\_owners) | Explicit set of owner usernames (mapped to GitHub's `admin` role). Ignored when `owners_team` is set. | `set(string)` | `[]` | no | | [owners\_team](#input\_owners\_team) | Convenience: derive organization owners from the members of this team, by
name. `null` (default) means use the explicit `owners` set instead. There is
no hardcoded owners team — the consumer chooses. | `string` | `null` | no | -| [repositories](#input\_repositories) | Repositories and which teams may access them. See the repository submodule for the full object schema and validations. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | +| [repositories](#input\_repositories) | Repositories and which teams may access them. See the repository submodule for the full object schema and validations. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, false)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | | [secrets](#input\_secrets) | Decrypted secret values keyed by scope. Supplied already-decrypted by the caller; this module never performs decryption. | 
object({
    org = optional(map(string), {})
    repos = optional(map(object({
      actions      = optional(map(string), {})
      environments = optional(map(map(string)), {})
    })), {})
  })
| 
{
  "org": {},
  "repos": {}
}
| no | | [teams](#input\_teams) | Teams and their membership. A team may hold predefined organization-level
GitHub roles via `org_roles`. Repository access is granted per repository via
readers/writers/admins, not through org roles. | 
list(object({
    name        = string
    description = string
    members     = optional(list(string), [])
    org_roles   = optional(list(string), [])
  }))
| `[]` | no | | [users](#input\_users) | Organization members. `fullname`/`email` are informational; membership is keyed on `username`. | 
list(object({
    username = string
    fullname = optional(string, "")
    email    = optional(string, "")
  }))
| `[]` | no | diff --git a/modules/repository/README.md b/modules/repository/README.md index df51ff6..59dff5d 100644 --- a/modules/repository/README.md +++ b/modules/repository/README.md @@ -47,7 +47,7 @@ No modules. | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [all\_members\_team\_id](#input\_all\_members\_team\_id) | ID of the all-members team that receives default read access on non-restricted repositories. null disables the default read grant. | `string` | `null` | no | -| [repositories](#input\_repositories) | Repositories to manage and which teams may access them. `readers`, `writers`
and `admins` reference team names from `var.teams`. A team listed at more than
one level gets the highest permission (admin > write > read). Set
`restricted = true` to withhold the default all-members read grant. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, true)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | +| [repositories](#input\_repositories) | Repositories to manage and which teams may access them. `readers`, `writers`
and `admins` reference team names from `var.teams`. A team listed at more than
one level gets the highest permission (admin > write > read). Set
`restricted = true` to withhold the default all-members read grant. | 
list(object({
    name        = string
    description = string
    visibility  = optional(string, "private")
    readers     = optional(list(string), [])
    writers     = optional(list(string), [])
    admins      = optional(list(string), [])
    restricted  = optional(bool, false)

    topics             = optional(list(string), [])
    homepage_url       = optional(string, null)
    has_issues         = optional(bool, true)
    has_wiki           = optional(bool, false)
    has_projects       = optional(bool, false)
    has_downloads      = optional(bool, false)
    is_template        = optional(bool, false)
    gitignore_template = optional(string, null)
    license_template   = optional(string, null)
    archived           = optional(bool, false)
    archive_on_destroy = optional(bool, true)
    default_branch     = optional(string, null)
    enable_pages       = optional(bool, false)
    signed_commits     = optional(bool, true)

    allow_merge_commit     = optional(bool, false)
    allow_squash_merge     = optional(bool, true)
    allow_rebase_merge     = optional(bool, false)
    allow_auto_merge       = optional(bool, true)
    delete_branch_on_merge = optional(bool, true)
    merge_commit_message   = optional(string, "PR_BODY")
    merge_commit_title     = optional(string, "PR_TITLE")

    template = optional(object({
      owner                = string
      repository           = string
      include_all_branches = optional(bool, false)
    }))

    rulesets = optional(map(object({
      enforcement  = optional(string, "active")
      target       = optional(string, "branch")
      include_refs = optional(list(string), ["~ALL"])
      exclude_refs = optional(list(string), [])
      bypass_actors = optional(list(object({
        actor_type  = string
        actor_id    = optional(number, 0)
        team        = optional(string)
        bypass_mode = optional(string, "always")
      })), [])
      rules = object({
        creation                = optional(bool, false)
        update                  = optional(bool, false)
        deletion                = optional(bool, false)
        non_fast_forward        = optional(bool, false)
        required_signatures     = optional(bool, false)
        required_linear_history = optional(bool, false)
        pull_request = optional(object({
          required_approving_review_count   = optional(number, 0)
          require_code_owner_review         = optional(bool, false)
          require_last_push_approval        = optional(bool, false)
          dismiss_stale_reviews_on_push     = optional(bool, false)
          required_review_thread_resolution = optional(bool, false)
        }))
      })
    })), {})

    variables = optional(map(string), {})
    environments = optional(map(object({
      variables  = optional(map(string), {})
      reviewers  = optional(list(string), [])
      wait_timer = optional(number, 0)
      deployment_branch_policy = optional(object({
        protected_branches     = optional(bool, false)
        custom_branch_policies = optional(list(string), [])
      }))
    })), {})
  }))
| `[]` | no | | [repository\_secrets](#input\_repository\_secrets) | Per-repository Actions and environment secret values (plaintext), keyed by
repository name. Supplied already-decrypted by the caller; this module never
performs decryption. | 
map(object({
    actions      = optional(map(string), {})
    environments = optional(map(map(string)), {})
  }))
| `{}` | no | | [teams](#input\_teams) | Map of team name => { id, slug } for teams that may be granted repository access or set as environment reviewers. Supplied by the teams module. | 
map(object({
    id   = string
    slug = string
  }))
| `{}` | no | diff --git a/modules/repository/variables.tf b/modules/repository/variables.tf index 4f77de9..ca16956 100644 --- a/modules/repository/variables.tf +++ b/modules/repository/variables.tf @@ -19,7 +19,7 @@ variable "repositories" { has_issues = optional(bool, true) has_wiki = optional(bool, false) has_projects = optional(bool, false) - has_downloads = optional(bool, true) + has_downloads = optional(bool, false) is_template = optional(bool, false) gitignore_template = optional(string, null) license_template = optional(string, null) diff --git a/variables.tf b/variables.tf index 37fcb4f..d765335 100644 --- a/variables.tf +++ b/variables.tf @@ -68,7 +68,7 @@ variable "repositories" { has_issues = optional(bool, true) has_wiki = optional(bool, false) has_projects = optional(bool, false) - has_downloads = optional(bool, true) + has_downloads = optional(bool, false) is_template = optional(bool, false) gitignore_template = optional(string, null) license_template = optional(string, null)