Skip to content

fix: grant admins team repo access so protection bypass actors converge#20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 1 commit into from
Aug 25, 2026
Merged

fix: grant admins team repo access so protection bypass actors converge #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions AGENTS.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,12 +26,13 @@ validation, plan output, and change history, not as a review gate. Do not
tighten `contexts` or `required_approving_review_count` unless explicitly
requested.

Note: plans perpetually show `+ makeitworkcloud/admins` being re-added to
`dismissal_restrictions`, `pull_request_bypassers`, and `push_allowances` in
all repositories, hours after an apply already converged them (cause under
investigation — org-level reset or provider read quirk). Treat these entries
as noise and do not "fix" the drift by removing the codified bypass from
`gh-protections.tf`.
GitHub silently drops branch-protection bypass actors that have no repository
access at write time — the apply succeeds but the stored rule omits them, so
config and live state diverge on every plan. The `admins` bypass entries here
are only valid because `gh-iam.tf` grants the team admin access to every
active repository (`github_team_repository.admins`); never remove those
grants while the bypass entries exist, and grant access to any future bypass
team in the same apply.

## Pre-commit Configuration

Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,7 @@ No modules.
| [github_team.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
| [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
| [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource |
| [github_team_repository.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository) | resource |
| [sops_file.secret_vars](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source |

## Inputs
Expand Down
10 changes: 9 additions & 1 deletion gh-iam.tf
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,10 +5,18 @@ resource "github_membership" "admin" {

resource "github_team" "admins" {
name = "admins"
description = "ArgoCD administrators"
description = "Administrators — ArgoCD admins and GitHub branch-protection bypass actors"
privacy = "closed"
}

resource "github_team_repository" "admins" {
for_each = local.active_github_repositories

team_id = github_team.admins.id
repository = github_repository.repositories[each.key].name
permission = "admin"
}

resource "github_team" "developers" {
name = "developers"
description = "ArgoCD read-only access"
Expand Down
2 changes: 1 addition & 1 deletion gh-protections.tf
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -30,5 +30,5 @@ resource "github_branch_protection" "protections" {
"${var.github_owner}/${github_team.admins.slug}"
]
}
depends_on = [github_repository.repositories, github_team.admins]
depends_on = [github_repository.repositories, github_team.admins, github_team_repository.admins]
}
Loading