github-terraform-task-StephanHorbach/main.tf at develop · Practical-DevOps-GitHub/github-terraform-task-StephanHorbach · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    github = {
      source  = "integrations/github"
      version = "~> 6.0"
    }

    tls = {
      source  = "hashicorp/tls"
      version = "~> 4.0"
    }
  }
}

variable "pat" {
  description = "GitHub personal access token classic"
  type        = string
  sensitive   = true

  default = "ghp_000000000000000000000000000000000000"
}

variable "discord_webhook_url" {
  description = "Discord webhook URL without /github suffix"
  type        = string
  sensitive   = true

  default = "https://discord.com/api/webhooks/000000000000000000/placeholder"
}

locals {
  owner      = "Practical-DevOps-GitHub"
  repository = "github-terraform-task-StephanHorbach"
}

provider "github" {
  owner = local.owner
}

resource "github_repository_collaborator" "softservedata" {
  repository = local.repository
  username   = "softservedata"
  permission = "push"
}

resource "github_branch" "develop" {
  repository    = local.repository
  branch        = "develop"
  source_branch = "main"
}

resource "github_branch_default" "develop" {
  repository = local.repository
  branch     = github_branch.develop.branch
}

resource "github_repository_file" "codeowners" {
  repository          = local.repository
  branch              = "main"
  file                = ".github/CODEOWNERS"
  content             = "* @softservedata\n"
  commit_message      = "Add CODEOWNERS"
  overwrite_on_create = true

  depends_on = [
    github_branch.develop,
    github_repository_collaborator.softservedata
  ]
}

resource "github_repository_file" "pull_request_template" {
  repository = local.repository
  branch     = "main"
  file       = ".github/pull_request_template.md"

  content = <<-EOT
    ## Describe your changes

    ## Issue ticket number and link

    ## Checklist before requesting a review
    - [ ] I have performed a self-review of my code
    - [ ] If it is a core feature, I have added thorough tests
    - [ ] Do we need to implement analytics?
    - [ ] Will this be part of a product update? If yes, please write one phrase about this update
  EOT

  commit_message      = "Add pull request template"
  overwrite_on_create = true

  depends_on = [github_branch.develop]
}

resource "github_branch_protection" "develop" {
  repository_id  = local.repository
  pattern        = "develop"
  enforce_admins = true

  allows_deletions    = false
  allows_force_pushes = false

  required_pull_request_reviews {
    required_approving_review_count = 2
    dismiss_stale_reviews           = true
  }

  depends_on = [github_branch.develop]
}

resource "github_branch_protection" "main" {
  repository_id  = local.repository
  pattern        = "main"
  enforce_admins = true

  allows_deletions    = false
  allows_force_pushes = false

  required_pull_request_reviews {
    required_approving_review_count = 0
    require_code_owner_reviews      = true
    dismiss_stale_reviews           = true
  }

  depends_on = [
    github_repository_file.codeowners,
    github_repository_file.pull_request_template
  ]
}

resource "tls_private_key" "deploy_key" {
  algorithm = "ED25519"
}

resource "github_repository_deploy_key" "deploy_key" {
  title      = "DEPLOY_KEY"
  repository = local.repository
  key        = tls_private_key.deploy_key.public_key_openssh
  read_only  = true
}

resource "github_repository_webhook" "discord" {
  repository = local.repository
  events     = ["pull_request"]
  active     = true

  configuration {
    url          = format("%s/github", var.discord_webhook_url)
    content_type = "json"
    insecure_ssl = false
  }
}

resource "github_actions_secret" "pat" {
  repository  = local.repository
  secret_name = "PAT"
  value       = var.pat
}