docs: record managed-file, ci-recovery, and sops handling lessons

[xnoto]

Documentation-only follow-up to the dependabot-alerting recovery (2026-08-25):

• Dependency Updates: every github_repository_file path is force-written to all repos in its for_each — audit for hand-authored collisions before adding managed files (root cause of the reusable-workflow clobbering).
• Git Workflow: stacked branches + squash merges produce phantom conflicts; recover with rebase --onto.
• Branch Protection: the makeitworkcloud/admins bypass drift is a known perpetual diff — treat as noise, don't remove the codified bypass.
• Dependabot PR Alerting: E2E verification curl (in-subprocess sops extraction, expect HTTP 200); note that @dependabot recreate fires synchronize, which the actor filter excludes.
• SOPS Secrets: in-subprocess handling rule + conflict resolution via key-set/ciphertext-hash comparison, never decrypt to resolve.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# github_branch_protection.protections[".github"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOPDNmL84EC8t_"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["cflan"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOOulWjM4EPi_e"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["images"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsexys4EPi_f"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["kustomize-cluster"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsxTyc4EPi_g"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["shared-workflows"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsfaHs4EPi_h"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["terraform-libvirt-domain"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsXn984EPi_i"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["tfroot-aws"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsXn6c4EPi_j"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["tfroot-cloudflare"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsXoEM4EPi_k"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["tfroot-github"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsXoMs4EPi_l"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["tfroot-libvirt"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOQsXoKM4EPi_n"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
# github_branch_protection.protections["www"] will be updated in-place
~ resource "github_branch_protection" "protections" {
id = "BPR_kwDOOuKZAc4EPi_o"
# (10 unchanged attributes hidden)
~ required_pull_request_reviews {
~ dismissal_restrictions = [
+ "makeitworkcloud/admins",
]
~ pull_request_bypassers = [
+ "makeitworkcloud/admins",
]
# (5 unchanged attributes hidden)
}
~ restrict_pushes {
~ push_allowances = [
+ "makeitworkcloud/admins",
]
# (1 unchanged attribute hidden)
}
# (1 unchanged block hidden)
}
Plan: 0 to add, 11 to change, 0 to destroy.