osinfra-io/github-organization-management

Infrastructure as Code (IaC) example for a GitHub organization.

github-organization-management's Issues

Refactor and try out thin platform template

Description

Refactor code to current coding conventions. Let's see if we can populate useful thin platform docs.

Acceptance

• Current coding conventions
• Thin platform documentation
• Issue templates for service interface

Implementation Notes

Additional Context

Issues generated by a service interface should be labeled good first issue

We want to cultivate and develop a strong pool of talented individuals ready to take on work and grow within the organization. This is a key concept in the Open Source Infrastructure as Code development model.

#74 (comment)

Setup the add to project called workflow

Description

We'd like to see all issues and pull requests added to the Open Source Infrastructure (as Code) project.

Acceptance

• Issue and PRs are added to the Open Source Infrastructure (as Code) project.

Implementation Notes

Additional Context

Add or update repository

Email address:

[email protected]

Team name:

none

Repository name:

terraform-google-kubernetes-engine-onboarding

Describe your repository:

Terraform example module for Google Cloud Platform Kubernetes Engine onboarding

Topics:

No response

Push restrictions:

No response

Required status checks:

No response

Template repository:

No response

Disable branch protection:

• True

Additional comments:

No response

Manage teams, team members and team repositories

Description

We want to manage GitHub Teams with Terraform. Keeping with or norm of balancing KISS and DRY let's see what we can come up with to accomplish this.

Acceptance

• Support for creating and updating teams
• Support for adding/removing one or many repositories to a team

Implementation Notes

Optionally let's investigate sub-teams.

Additional Context

Add or update repository

Email address:

[email protected]

Team name:

stream-customer-acquisition

Repository name:

stream-customer-acquistion

Describe your repository:

Team based repository

Topics:

No response

Push restrictions:

No response

Required status checks:

No response

Template repository:

No response

Disable branch protection:

• True

Additional comments:

No response

Ensure GitHub branch protection rules require linear history

Description

Enforcing a linear commit history prevents collaborators from pushing merge commits to the branch. This means that any pull requests merged into the protected branch must use a squash merge or a rebase merge. A strictly linear commit history can help teams reverse changes more easily.

Acceptance

• Enforcing a linear commit history

Implementation Notes

Additional Context

Add remaining repositories

Description

Import remaining repositories for management under Terraform.

Acceptance

• All repositories managed under Terraform

Implementation Notes

Additional Context

Support for repository environments and reviewers

Enable support for environments and reviewers.

Tasks

Beta Give feedback

1. Can add environments and reviewer groups

• https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_environment

Support for github_organization_settings

Race condition on Datadog webhooks

Tasks

Beta Give feedback

1. Datadog webhooks are created successfully when a new repository is created

Error: POST https://api.github.com/repos/osinfra-io/enabling-security/hooks: 404 Not Found []

  with github_repository_webhook.datadog["enabling-security"],
  on main.tf line 194, in resource "github_repository_webhook" "datadog":
 194: resource "github_repository_webhook" "datadog" {

Enable automatically merging a pull request

You can increase development velocity by enabling auto-merge for a pull request to merge automatically when all merge requirements are met.

https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request

Configure workflows

#63 (comment)

Ensure GitHub branch protection requires status checks

Requiring status checks means that all required CI jobs must pass for the code to be merged. This is especially important when your status checks include security reviews that must pass before merging the code. This requirement can be found in the branch protection policies of your repository.

#52 (comment)

Update github_repository service interface

#64 (comment)

Rotate GPG_PASSPHRASE

Ensure GitHub branch protection requires CODEOWNER reviews

Branch protections can require code owner reviews for code changes. This means that pull requests must have approval from a code owner before merging.

#54 (comment)

Update GitHub repository issue template for team support

#44 Added support for teams

Branch protection should be optional

Description

We don't want branch protection on some repositories.

Acceptance

• Branch protection off for: https://github.com/osinfra-io/gitbook-docs

Implementation Notes

Additional Context

Add new repository for google-cloud-kitchen-terraform

Description

This repository will be for creating the testing infrastructure for child module development.

Acceptance

• google-cloud-kitchen-terraform

Implementation Notes

Additional Context

Support for linked projects

Link a project from the organization to a repository to provide quick access to relevant projects.

Tasks

Beta Give feedback

1. Can link projects

Blocked on: integrations/terraform-provider-github#1910

Support for `github_actions_organization_permissions`

Allow Hashicorp GitHub Actions

Manage repository security policy

Manage a single markdown for repository security policy.

Tasks

Beta Give feedback

1. Security policy in all repositories

• https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file

Support for repositories

Description

I'd like to manage repositories with Terraform.

Acceptance

• Can manage IaC repos wth Terraform

Implementation Notes

Additional Context

Update repository descriptions

Description

Update date repository descriptions to include "Infrastructure as Code (IaC)"

Acceptance

• Description updated

Implementation Notes

Additional Context

Add platform tags to repositories

This will allow the grouping of repositories to help understand the platform they belong to.

Ensure GitHub branch protection requires push restrictions

This branch protection rule ensures that only specific users can merge code to a repository. This prevents code from bypassing checks and being merged without proper review.

#53 (comment)

Update team names to align with team types from Team Topologies

Add labels to align with platform teams

Support for repository webhooks for Datadog

Tools like Datadog require webhook creation on repositories.

Tasks

Beta Give feedback

1. Can optionally add webhooks for Datadog

Add or update repository

Email address:

[email protected]

Team name:

platform-google-cloud-landing-zone

Repository name:

platform-google-cloud-landing-zone

Describe your repository:

Team based repository

Topics:

No response

Push restrictions:

No response

Required status checks:

No response

Template repository:

No response

Disable branch protection:

• True

Additional comments:

No response

Add dependabot auto merge workflow

Description

Dependabot workflows for auto-merging of PRs should be configured.

Acceptance

• Dependabot PRs should auto-merge on everything but major versions

Implementation Notes

Additional Context

Add or update repository

Email address:

[email protected]

Team name:

platform-github

Repository name:

platform-github

Describe your repository:

Team based repository

Topics:

No response

Push restrictions:

No response

Required status checks:

No response

Template repository:

No response

Disable branch protection:

• True

Additional comments:

No response

Support private repositories

Description

We will want to support private repositories.

Acceptance

• .github-private is private

Implementation Notes

Additional Context

Update Dependabot workflow

Description

Test Dependabot workflow without passing the GITHUB_TOKEN.

Acceptance

• Remove GITHUB_TOKEN

Implementation Notes

Additional Context