From 2232fcd6e3cb994a9c8b6277bfec4496078fe34b Mon Sep 17 00:00:00 2001
From: xnoto <steven@makeitwork.cloud>
Date: Tue, 25 Aug 2026 10:45:32 -0600
Subject: [PATCH] fix: grant admins team repo access so protection bypass
 actors converge

---
 AGENTS.md         | 13 +++++++------
 README.md         |  1 +
 gh-iam.tf         | 10 +++++++++-
 gh-protections.tf |  2 +-
 4 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 0c5bf33..49309f9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -26,12 +26,13 @@ validation, plan output, and change history, not as a review gate. Do not
 tighten `contexts` or `required_approving_review_count` unless explicitly
 requested.
 
-Note: plans perpetually show `+ makeitworkcloud/admins` being re-added to
-`dismissal_restrictions`, `pull_request_bypassers`, and `push_allowances` in
-all repositories, hours after an apply already converged them (cause under
-investigation — org-level reset or provider read quirk). Treat these entries
-as noise and do not "fix" the drift by removing the codified bypass from
-`gh-protections.tf`.
+GitHub silently drops branch-protection bypass actors that have no repository
+access at write time — the apply succeeds but the stored rule omits them, so
+config and live state diverge on every plan. The `admins` bypass entries here
+are only valid because `gh-iam.tf` grants the team admin access to every
+active repository (`github_team_repository.admins`); never remove those
+grants while the bypass entries exist, and grant access to any future bypass
+team in the same apply.
 
 ## Pre-commit Configuration
 
diff --git a/README.md b/README.md
index 68c4a63..336396c 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ No modules.
 | [github_team.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
 | [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
 | [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource |
+| [github_team_repository.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository) | resource |
 | [sops_file.secret_vars](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source |
 
 ## Inputs
diff --git a/gh-iam.tf b/gh-iam.tf
index 122b5e6..611c39f 100644
--- a/gh-iam.tf
+++ b/gh-iam.tf
@@ -5,10 +5,18 @@ resource "github_membership" "admin" {
 
 resource "github_team" "admins" {
   name        = "admins"
-  description = "ArgoCD administrators"
+  description = "Administrators — ArgoCD admins and GitHub branch-protection bypass actors"
   privacy     = "closed"
 }
 
+resource "github_team_repository" "admins" {
+  for_each = local.active_github_repositories
+
+  team_id    = github_team.admins.id
+  repository = github_repository.repositories[each.key].name
+  permission = "admin"
+}
+
 resource "github_team" "developers" {
   name        = "developers"
   description = "ArgoCD read-only access"
diff --git a/gh-protections.tf b/gh-protections.tf
index 10a8d1d..55ca206 100644
--- a/gh-protections.tf
+++ b/gh-protections.tf
@@ -30,5 +30,5 @@ resource "github_branch_protection" "protections" {
       "${var.github_owner}/${github_team.admins.slug}"
     ]
   }
-  depends_on = [github_repository.repositories, github_team.admins]
+  depends_on = [github_repository.repositories, github_team.admins, github_team_repository.admins]
 }