Repository navigation
fix(policy): remove stale ruleset imports shadowed by new repos - #49
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
tui-snap and tailrocks-open-source-skills have no own rulesets; their imports.tf entries pointed at IDs owned by tuiscotti (23746094/23746052) and tailrocks-contribution-skills (23746090/23746068) — verified via source/source_type on the live ruleset objects. Removing the 4 stale blocks; module creates both rulesets for the two repos on apply. Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
cb2a7a5 to
3dc5198
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb2a7a57d7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
|
|
||
| import { | ||
| to = module.repository_policy.github_repository_ruleset.protect_main["tailrocks-pull-request-skills"] |
There was a problem hiding this comment.
When any workspace applied these import blocks before this commit, deleting them does not unbind the foreign rulesets: OpenTofu continues tracking the contribution-skills/tuiscotti objects at the tailrocks-open-source-skills and tui-snap addresses, so the next apply will not create the missing protections as intended. The OpenTofu import documentation confirms that imported objects remain in state after their import blocks are removed; migrate or remove all four stale bindings and verify the subsequent plan before dropping the blocks.
AGENTS.md reference: AGENTS.md:L3-L3
Useful? React with 👍 / 👎.
Follow-up to #48, found by security review.
tui-snap and tailrocks-open-source-skills carry import blocks pointing at ruleset IDs owned by other repos (source/source_type verified live): tui-snap -> tuiscotti's 23746094/23746052, open-source-skills -> contribution-skills' 23746090/23746068. Neither repo has its own rulesets — the API resolves the foreign IDs to the owning repo's objects.
Removes the 4 stale blocks; the module's for_each creates both rulesets for these repos on next apply. New repos' entries (contribution-skills, tuiscotti) are the correct owners and stay.