From eb6ea0dd10f29da127e8beeb3914433a84b1f675 Mon Sep 17 00:00:00 2001 From: Alexey Zhokhov Date: Sun, 11 Oct 2026 17:31:14 +0700 Subject: [PATCH] feat(policy): onboard 6 listed repos MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add repo-scan, tailrocks-asd-ste100-skills (private), tailrocks-contribution-skills, tailrocks-repository-skills, tuiscotti (bespoke DCO+Required per live ruleset 23746094), and rust-repository-policy as no-CI exception (tag-push release checks only). Ruleset imports for contribution-skills (23746090/23746068) and tuiscotti (23746094/23746052); settings-only for the rest — module creates both rulesets on apply, adopting repo-scan's release-tag ruleset into protect-tags management. Signed-off-by: Alexey Zhokhov --- checks.tf | 18 ++++++++++-------- imports.tf | 43 +++++++++++++++++++++++++++++++++++++++++++ variables.tf | 30 ++++++++++++++++++++++++++++++ 3 files changed, 83 insertions(+), 8 deletions(-) diff --git a/checks.tf b/checks.tf index 973f9bd..1ceefa8 100644 --- a/checks.tf +++ b/checks.tf @@ -10,18 +10,20 @@ check "mandatory_target_repositories_present" { "holla-apt", "homebrew-holla", "homebrew-parallax", "homebrew-ruxel", "homebrew-tablerock", "homebrew-velnor", "jambalaya", "parallax", "parallax-telemetry-playground", "pg-bigdecimal", "pgquill", - "renovate-rust", "ruxel", "schemalane", "tablerock", - "tailrocks-code-quality-skills", "tailrocks-gradle-conventions", - "tailrocks-logo", "tailrocks-macos-skills", - "tailrocks-open-source-skills", "tailrocks-pull-request-skills", + "renovate-rust", "repo-scan", "rust-repository-policy", "ruxel", + "schemalane", "tablerock", "tailrocks-asd-ste100-skills", + "tailrocks-code-quality-skills", "tailrocks-contribution-skills", + "tailrocks-gradle-conventions", "tailrocks-logo", + "tailrocks-macos-skills", "tailrocks-open-source-skills", + "tailrocks-pull-request-skills", "tailrocks-repository-skills", "tailrocks-roadmap-skills", "tailrocks-rust-skills", "tailrocks-skill-authoring-skills", "tailrocks-skills", "tailrocks-sqldiff", "tailrocks-typescript-skills", "terminal-components-claude", "termpane", "termrock", - "tracing-request-level", "tui-snap", "velnor", + "tracing-request-level", "tui-snap", "tuiscotti", "velnor", "velnor-actions-fixture", "velnor-apt", "velnor-new", "vision", ]) - error_message = "repository_policies must contain exactly the 41 managed tailrocks repositories." + error_message = "repository_policies must contain exactly the 47 managed tailrocks repositories." } } @@ -48,8 +50,8 @@ check "no_ci_exception_allowlist_is_explicit" { condition = toset([ for name, policy in var.repository_policies : name if policy.no_ci_reason != null - ]) == toset(["jambalaya", "renovate-rust", "tailrocks-logo", "tailrocks-sqldiff", "vision"]) - error_message = "Only jambalaya, renovate-rust, tailrocks-logo, tailrocks-sqldiff, and vision may carry a no_ci_reason exception." + ]) == toset(["jambalaya", "renovate-rust", "rust-repository-policy", "tailrocks-logo", "tailrocks-sqldiff", "vision"]) + error_message = "Only jambalaya, renovate-rust, rust-repository-policy, tailrocks-logo, tailrocks-sqldiff, and vision may carry a no_ci_reason exception." } } diff --git a/imports.tf b/imports.tf index cce4f0a..6f107ba 100644 --- a/imports.tf +++ b/imports.tf @@ -105,6 +105,15 @@ import { id = "renovate-rust" } +import { + to = module.repository_policy.github_repository.managed_settings["repo-scan"] + id = "repo-scan" +} + +import { + to = module.repository_policy.github_repository.managed_settings["rust-repository-policy"] + id = "rust-repository-policy" +} import { to = module.repository_policy.github_repository.managed_settings["ruxel"] id = "ruxel" @@ -120,11 +129,20 @@ import { id = "tablerock" } +import { + to = module.repository_policy.github_repository.managed_settings["tailrocks-asd-ste100-skills"] + id = "tailrocks-asd-ste100-skills" +} + import { to = module.repository_policy.github_repository.managed_settings["tailrocks-code-quality-skills"] id = "tailrocks-code-quality-skills" } +import { + to = module.repository_policy.github_repository.managed_settings["tailrocks-contribution-skills"] + id = "tailrocks-contribution-skills" +} import { to = module.repository_policy.github_repository.managed_settings["tailrocks-gradle-conventions"] id = "tailrocks-gradle-conventions" @@ -150,6 +168,10 @@ import { id = "tailrocks-pull-request-skills" } +import { + to = module.repository_policy.github_repository.managed_settings["tailrocks-repository-skills"] + id = "tailrocks-repository-skills" +} import { to = module.repository_policy.github_repository.managed_settings["tailrocks-roadmap-skills"] id = "tailrocks-roadmap-skills" @@ -205,6 +227,10 @@ import { id = "tui-snap" } +import { + to = module.repository_policy.github_repository.managed_settings["tuiscotti"] + id = "tuiscotti" +} import { to = module.repository_policy.github_repository.managed_settings["velnor"] id = "velnor" @@ -331,6 +357,10 @@ import { id = "tailrocks-code-quality-skills:23746100" } +import { + to = module.repository_policy.github_repository_ruleset.protect_main["tailrocks-contribution-skills"] + id = "tailrocks-contribution-skills:23746090" +} import { to = module.repository_policy.github_repository_ruleset.protect_main["tailrocks-gradle-conventions"] id = "tailrocks-gradle-conventions:19573041" @@ -396,6 +426,11 @@ import { id = "tui-snap:23746094" } +import { + to = module.repository_policy.github_repository_ruleset.protect_main["tuiscotti"] + id = "tuiscotti:23746094" +} + import { to = module.repository_policy.github_repository_ruleset.protect_main["termrock"] id = "termrock:19573043" @@ -527,6 +562,10 @@ import { id = "tailrocks-code-quality-skills:23746075" } +import { + to = module.repository_policy.github_repository_ruleset.protect_tags["tailrocks-contribution-skills"] + id = "tailrocks-contribution-skills:23746068" +} import { to = module.repository_policy.github_repository_ruleset.protect_tags["tailrocks-gradle-conventions"] id = "tailrocks-gradle-conventions:19573027" @@ -592,6 +631,10 @@ import { id = "tui-snap:23746052" } +import { + to = module.repository_policy.github_repository_ruleset.protect_tags["tuiscotti"] + id = "tuiscotti:23746052" +} import { to = module.repository_policy.github_repository_ruleset.protect_tags["termrock"] id = "termrock:19573026" diff --git a/variables.tf b/variables.tf index c757a35..74f17e8 100644 --- a/variables.tf +++ b/variables.tf @@ -123,6 +123,16 @@ variable "repository_policies" { required_checks = [] no_ci_reason = "No CI workflow emits a status context; DCO app results are not a CI check." } + "repo-scan" = { + # local.check_templates.required_only + visibility = "public" + required_checks = ["Required"] + } + "rust-repository-policy" = { + visibility = "public" + required_checks = [] + no_ci_reason = "No CI workflow emits a status context on the default branch; only tag-push release checks exist." + } "ruxel" = { visibility = "public" required_checks = ["DCO", "Policy", "ci-required"] @@ -135,10 +145,20 @@ variable "repository_policies" { visibility = "public" required_checks = ["DCO", "Policy", "ci-required"] } + "tailrocks-asd-ste100-skills" = { + # local.check_templates.required_only + visibility = "private" + required_checks = ["Required"] + } "tailrocks-code-quality-skills" = { visibility = "public" required_checks = ["Required"] } + "tailrocks-contribution-skills" = { + # local.check_templates.required_only + visibility = "public" + required_checks = ["Required"] + } "tailrocks-gradle-conventions" = { visibility = "public" required_checks = ["Control / Required"] @@ -160,6 +180,11 @@ variable "repository_policies" { visibility = "public" required_checks = ["Required"] } + "tailrocks-repository-skills" = { + # local.check_templates.required_only + visibility = "public" + required_checks = ["Required"] + } "tailrocks-roadmap-skills" = { visibility = "public" required_checks = ["Required"] @@ -205,6 +230,11 @@ variable "repository_policies" { visibility = "public" required_checks = ["DCO", "Required"] } + "tuiscotti" = { + # Bespoke: matches live protect-main ruleset 23746094 required contexts (DCO + Required). + visibility = "public" + required_checks = ["DCO", "Required"] + } "velnor" = { visibility = "public" required_checks = ["DCO", "Policy", "ci-required"]