master-github/github.tf at master · DevopsCare/master-github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
locals {
  ci_username = var.ci_username != "" ? var.ci_username : data.aws_ssm_parameter.github_username.value
}

resource "github_repository" "terraform-repo" {
  count       = var.create_terraform_repo ? 1 : 0
  name        = "${var.project_prefix}-terraform"
  description = "\"${var.project_name}\" Terraform Infrastructure repository"

  private      = true
  has_issues   = false
  has_wiki     = false
  has_projects = false
  auto_init    = false

  lifecycle {
    ignore_changes = [description, private, has_issues, has_wiki, has_projects, auto_init, gitignore_template]
  }
}

resource "github_repository" "repo" {
  count       = length(var.github_projects)
  name        = "${var.project_prefix}-${element(var.github_projects, count.index)}"
  description = "\"${var.project_name}\" ${element(var.github_projects, count.index)} repository"

  private      = true
  has_issues   = false
  has_wiki     = false
  has_projects = false
  auto_init    = var.github_init_repos

  lifecycle {
    ignore_changes = [description, private, has_issues, has_wiki, has_projects, auto_init, gitignore_template]
  }
}

resource "github_team" "admins" {
  name        = "${var.project_prefix}-admins"
  description = "${var.project_name} administrators with full access to repos"
  privacy     = "closed"
}

resource "github_team" "devs" {
  name        = "${var.project_prefix}-developers"
  description = "${var.project_name} developers with usual read-write access to repos"
  privacy     = "closed"
}

resource "github_team_membership" "ci-account" {
  team_id  = github_team.admins.id
  username = local.ci_username
  role     = "member"
}

resource "github_team_repository" "repo-admins-terraform" {
  count      = var.create_terraform_repo ? 1 : 0
  team_id    = github_team.admins.id
  repository = github_repository.terraform-repo[0].name
  permission = "admin"
}

resource "github_team_repository" "repo-admins" {
  count      = length(var.github_projects)
  team_id    = github_team.admins.id
  repository = element(github_repository.repo.*.name, count.index)
  permission = "admin"
}

resource "github_team_repository" "repo-devs" {
  count      = length(var.github_projects)
  team_id    = github_team.devs.id
  repository = element(github_repository.repo.*.name, count.index)
  permission = "push"
}

resource "github_branch_protection" "this" {
  count          = var.github_init_repos ? length(var.github_projects) : 0
  repository     = element(github_repository.repo.*.name, count.index)
  branch         = var.github_init_branch
  enforce_admins = false
}