feat: allow admins team to force push protected branches

[xnoto]

GitHub's allows_force_pushes = false blocks force pushes for everyone including org admins; only force_push_bypassers actors can override. Needed for the history root-squash.

The bypass entries converge because github_team_repository.admins already grants the team repo access (same eligibility rule as the other bypass actors). AGENTS.md updated.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# github_branch_protection.protections[".github"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOPDNmL84EC8t_"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["cflan"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOOulWjM4EPi_e"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["images"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsexys4EPi_f"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["kustomize-cluster"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsxTyc4EPi_g"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["shared-workflows"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsfaHs4EPi_h"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["terraform-libvirt-domain"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsXn984EPi_i"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["tfroot-aws"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsXn6c4EPi_j"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["tfroot-cloudflare"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsXoEM4EPi_k"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["tfroot-github"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsXoMs4EPi_l"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["tfroot-libvirt"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOQsXoKM4EPi_n"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
# github_branch_protection.protections["www"] will be updated in-place
~ resource "github_branch_protection" "protections" {
~ force_push_bypassers = [
+ "makeitworkcloud/admins",
]
id = "BPR_kwDOOuKZAc4EPi_o"
# (9 unchanged attributes hidden)
# (3 unchanged blocks hidden)
}
Plan: 0 to add, 11 to change, 0 to destroy.