TFM: github-org-variable-section module

[frmadem]

Parent

gitops-k8s#2530

What to build

A new TFM module github-org-variable-section that manages GitHub Actions organization variables via github_actions_organization_variable resources, with idempotency support.

Input contract — the module accepts var.config with shape:

variable "config" {
  type = object({
    org = string
    variables = map(object({
      value                  = string
      visibility             = string           # "all" | "selected"
      selected_repository_ids = optional(list(number))
    }))
  })
}

Behaviour:

• Uses for_each over var.config.variables to create github_actions_organization_variable resources keyed by variable name
• When visibility = "selected", passes selected_repository_ids (resolved repo IDs from the entity)
• Outputs the set of managed variable names as managed_variables (accumulated across runs, persisted via Kubernetes outputs Secret). This output enables the entity to compute which variables are new-to-module and trigger apply-time adoption.

Acceptance criteria

• Module accepts config object via terraform.tfvars.json (gh-provisioner compatible)
• for_each creates one github_actions_organization_variable per entry in variables map
• selected visibility correctly passes selected_repository_ids
• all visibility omits selected_repository_ids
• Module outputs managed_variables: set of variable names from the current run
• README documents config shape, examples, output contract, and Firestartr compatibility notes
• Validation on visibility enum (all, selected)

Blocked by

None — can start immediately.

[frmadem]

Spec created: #1360