fix(people): declare addyCooks, whom the first import missed by mrspence · Pull Request #10 · Nano-Collective/infrastructure

mrspence · 2026-10-22T20:26:09Z

What this is

addyCooks (Aditya Mishra) is an active member of the organisation with no file
in people/. Every other member got one from scripts/import-from-live.sh in
the first import; this one did not, and nothing since has added it.

github_team_members is authoritative per team, so the first apply read
core-team as the two people the catalogue named and removed the third. The
organisation membership was never in state, so there was nothing to destroy and
it survived — which is why they stayed a member of the organisation while
losing maintain on all ten of core-team's repositories.

This was reported from the outside before we noticed it: they went to review
and merge pull requests, found no merge access, and checked their email.

What it does

Adds people/addyCooks.yaml declaring them a member of the organisation and a
member of core-team — the access they held before the apply, nothing more.

Team role is member, matching akramcodez. The team role governs who
administers the team, not what they can merge; merge rights come from
core-team's own maintain grant in teams/core-team.yaml.
No import block needed. github_membership writes with PUT and adopts an
active membership rather than creating one, exactly as it did for
puri-adityakumar.

The drift check

The daily Drift run has been failing on precisely this:

FAIL  organisation members with no file in people/: addyCooks.
      Nothing records what they are here for.

That failure is cleared by this change. Running the read-back on this branch
now reports the inverse, which is the expected pre-apply state and is what the
plan should show:

ok    8 members and 3 owners, one file each
FAIL  people/addyCooks.yaml claims member of "core-team" but GitHub does not
      have them in it.

It clears on the apply. policy/checks.sh --offline, which is what Validate
runs, passes on this branch.

Not fixed here

The other Drift failure is unrelated and still open:

FAIL  organisation secrets in org/secrets.yaml that do not exist:
      CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, NPM_TOKEN, DISCORD_WEBHOOK.

That needs the secrets themselves, not a catalogue change.

Worth a separate look: tofu/imports.tf still carries the hand-written
nanocoder-desktop import block, which its own comment says to delete in the
pull request after the apply that used it (#8, applied 2026-10-22).

Every other organisation member got a file from scripts/import-from-live.sh; addyCooks did not, and nothing since has added one. Because github_team_members is authoritative per team, the first apply read core-team as the two people the catalogue named and removed the third, taking maintain on ten repositories with it. The organisation membership was never in state, so it survived -- which is why they remained a member while losing every merge right. The daily drift check has been failing on exactly this: "organisation members with no file in people/: addyCooks." Declaring them restores the access and closes that failure. github_membership writes with PUT and adopts the active membership rather than creating one, as it did for puri-adityakumar, so this needs no import block. Team role is `member`, matching akramcodez: the team role governs who administers the team, not what they can merge.

github-actions · 2026-10-22T20:27:05Z

This pull request changes the organisation. Read the plan before approving.

Plan output

github_team.root["nanocoder-desktop"]: Refreshing state... [id=20259972]
github_team.root["core-team"]: Refreshing state... [id=17922917]
github_team.root["admin"]: Refreshing state... [id=15526101]
module.repository["nanocoder"].github_repository.this: Refreshing state... [id=nanocoder]
module.repository["organisation"].github_repository.this: Refreshing state... [id=organisation]
module.repository["contentforest"].github_repository.this: Refreshing state... [id=contentforest]
module.repository["sentinel"].github_repository.this: Refreshing state... [id=sentinel]
module.repository["taskforest"].github_repository.this: Refreshing state... [id=taskforest]
module.repository["docs"].github_repository.this: Refreshing state... [id=docs]
module.repository["nanolist"].github_repository.this: Refreshing state... [id=nanolist]
module.repository["nanoterm"].github_repository.this: Refreshing state... [id=nanoterm]
github_membership.this["akramcodez"]: Refreshing state... [id=Nano-Collective:akramcodez]
module.repository["roster"].github_repository.this: Refreshing state... [id=roster]
module.repository["prompt-scrubber"].github_repository.this: Refreshing state... [id=prompt-scrubber]
module.repository["get-md"].github_repository.this: Refreshing state... [id=get-md]
module.repository["nanocoder-desktop"].github_repository.this: Refreshing state... [id=nanocoder-desktop]
module.repository["nanotune"].github_repository.this: Refreshing state... [id=nanotune]
module.repository["json-up"].github_repository.this: Refreshing state... [id=json-up]
module.repository["infrastructure"].github_repository.this: Refreshing state... [id=infrastructure]
module.repository[".github"].github_repository.this: Refreshing state... [id=.github]
github_membership.this["spinualexandru"]: Refreshing state... [id=Nano-Collective:spinualexandru]
github_membership.this["mrspence"]: Refreshing state... [id=Nano-Collective:mrspence]
github_membership.this["followbenparry"]: Refreshing state... [id=Nano-Collective:followbenparry]
github_membership.this["Avtrkrb"]: Refreshing state... [id=Nano-Collective:Avtrkrb]
github_membership.this["will-lamerton"]: Refreshing state... [id=Nano-Collective:will-lamerton]
github_membership.this["puri-adityakumar"]: Refreshing state... [id=Nano-Collective:puri-adityakumar]
github_team_members.this["admin"]: Refreshing state... [id=15526101]
github_team_members.this["core-team"]: Refreshing state... [id=17922917]
github_team_members.this["nanocoder-desktop"]: Refreshing state... [id=20259972]
module.repository["nanotune"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1146764215]
module.repository["json-up"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1165641658]
module.repository["contentforest"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1222794803]
module.repository["get-md"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1081935107]
module.repository["organisation"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1064141539]
module.repository["taskforest"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1255394363]
module.repository[".github"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1256130038]
module.repository["nanoterm"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1313629853]
module.repository["docs"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1163990675]
module.repository["infrastructure"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1428211040]
module.repository["roster"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1354824928]
module.repository["nanocoder-desktop"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1429652002]
module.repository["nanocoder"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1029049168]
module.repository["nanolist"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1339377078]
module.repository["sentinel"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1304294125]
module.repository["prompt-scrubber"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1276739924]
module.repository["nanotune"].github_repository_ruleset.quality[0]: Refreshing state... [id=22462202]
module.repository["nanocoder-desktop"].github_repository_ruleset.quality[0]: Refreshing state... [id=25634670]
module.repository["sentinel"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271986]
module.repository["nanoterm"].github_repository_ruleset.quality[0]: Refreshing state... [id=22445028]
module.repository["json-up"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271991]
module.repository["get-md"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271989]
module.repository["prompt-scrubber"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271987]
module.repository["nanocoder"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271985]
module.repository["nanocoder-desktop"].github_repository_ruleset.review[0]: Refreshing state... [id=25634667]
module.repository["prompt-scrubber"].github_repository_ruleset.review[0]: Refreshing state... [id=22277954]
module.repository["contentforest"].github_repository_ruleset.review[0]: Refreshing state... [id=22277962]
module.repository["nanoterm"].github_repository_ruleset.review[0]: Refreshing state... [id=22389731]
module.repository["sentinel"].github_repository_ruleset.review[0]: Refreshing state... [id=22277952]
module.repository["get-md"].github_repository_ruleset.review[0]: Refreshing state... [id=22277955]
module.repository["nanocoder"].github_repository_ruleset.review[0]: Refreshing state... [id=22277950]
module.repository["organisation"].github_repository_ruleset.review[0]: Refreshing state... [id=22277963]
module.repository["json-up"].github_repository_ruleset.review[0]: Refreshing state... [id=22277958]
module.repository["nanotune"].github_repository_ruleset.review[0]: Refreshing state... [id=22277960]
github_team_repository.this["core-team:json-up"]: Refreshing state... [id=17922917:json-up]
github_team_repository.this["core-team:nanoterm"]: Refreshing state... [id=17922917:nanoterm]
github_team_repository.this["core-team:nanocoder-desktop"]: Refreshing state... [id=17922917:nanocoder-desktop]
github_team_repository.this["core-team:prompt-scrubber"]: Refreshing state... [id=17922917:prompt-scrubber]
github_team_repository.this["core-team:get-md"]: Refreshing state... [id=17922917:get-md]
github_team_repository.this["core-team:sentinel"]: Refreshing state... [id=17922917:sentinel]
github_team_repository.this["core-team:nanocoder"]: Refreshing state... [id=17922917:nanocoder]
github_team_repository.this["nanocoder-desktop:nanocoder-desktop"]: Refreshing state... [id=20259972:nanocoder-desktop]
github_team_repository.this["core-team:docs"]: Refreshing state... [id=17922917:docs]
github_team_repository.this["core-team:nanotune"]: Refreshing state... [id=17922917:nanotune]
github_team_repository.this["core-team:.github"]: Refreshing state... [id=17922917:.github]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # github_membership.this["addyCooks"] will be created
  + resource "github_membership" "this" {
      + downgrade_on_destroy = false
      + etag                 = (known after apply)
      + id                   = (known after apply)
      + role                 = "member"
      + username             = "addyCooks"
    }

  # github_team_members.this["core-team"] will be updated in-place
  ~ resource "github_team_members" "this" {
        id        = "17922917"
        # (2 unchanged attributes hidden)

      + members {
          + role     = "member"
          + username = "addyCooks"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository[".github"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = ".github"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = ".github"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (31 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["contentforest"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "contentforest"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "contentforest"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["contentforest"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277962"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["docs"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "docs"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "docs"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["get-md"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "get-md"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "get-md"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["get-md"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22271989"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["get-md"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277955"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["infrastructure"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "infrastructure"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "infrastructure"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (31 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["json-up"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "json-up"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "json-up"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["json-up"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22271991"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["json-up"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277958"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanocoder"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "nanocoder"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "nanocoder"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["nanocoder"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22271985"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanocoder"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277950"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanocoder-desktop"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_squash_merge                      = false -> true
      ~ delete_branch_on_merge                  = false -> true
        id                                      = "nanocoder-desktop"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "nanocoder-desktop"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (31 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["nanocoder-desktop"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "25634670"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanocoder-desktop"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "25634667"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanolist"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "nanolist"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "nanolist"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["nanoterm"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "nanoterm"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "nanoterm"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (30 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["nanoterm"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22445028"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanoterm"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22389731"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanotune"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "nanotune"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "nanotune"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["nanotune"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22462202"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["nanotune"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277960"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["organisation"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "organisation"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "organisation"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["organisation"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277963"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["prompt-scrubber"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "prompt-scrubber"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "prompt-scrubber"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (31 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["prompt-scrubber"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22271987"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["prompt-scrubber"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277954"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["roster"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "roster"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "roster"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["sentinel"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "sentinel"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "sentinel"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (32 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.repository["sentinel"].github_repository_ruleset.quality[0] will be updated in-place
  ~ resource "github_repository_ruleset" "quality" {
        id          = "22271986"
        name        = "Quality gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["sentinel"].github_repository_ruleset.review[0] will be updated in-place
  ~ resource "github_repository_ruleset" "review" {
        id          = "22277952"
        name        = "Review gates"
        # (6 unchanged attributes hidden)

      + bypass_actors {
          + actor_id    = 0
          + actor_type  = "OrganizationAdmin"
          + bypass_mode = "always"
        }
      + bypass_actors {
          + actor_id    = 2
          + actor_type  = "RepositoryRole"
          + bypass_mode = "always"
        }

        # (2 unchanged blocks hidden)
    }

  # module.repository["taskforest"].github_repository.this will be updated in-place
  ~ resource "github_repository" "this" {
      ~ allow_merge_commit                      = false -> true
      ~ allow_rebase_merge                      = false -> true
      ~ allow_squash_merge                      = false -> true
        id                                      = "taskforest"
      + merge_commit_message                    = "PR_TITLE"
      + merge_commit_title                      = "MERGE_MESSAGE"
        name                                    = "taskforest"
      + squash_merge_commit_message             = "COMMIT_MESSAGES"
      + squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
        # (30 unchanged attributes hidden)
    }

Plan: 1 to add, 35 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

Planned from 390989ad2dabbe0c66a74ece8d014419af2aa6ae. Comment /plan to run it again.

mrspence · 2026-10-22T20:28:03Z

Note for whoever reviews the plan: it reads Plan: 1 to add, 35 to change, 0 to destroy, and only two of those 36 belong to this pull request.

# github_membership.this["addyCooks"] will be created
# github_team_members.this["core-team"] will be updated in-place
#   + members { role = "member", username = "addyCooks" }

The other 34 are the standing drift that every plan here has shown — the
sixteen repositories' merge-button settings (allow_merge_commit,
allow_rebase_merge, allow_squash_merge, all false -> true) and the
rulesets' bypass_actors. The same count appeared on #8 (35 to change) and
#1 (31 to change), and #8's apply did not settle it, so it is not something
this branch introduced and not something it fixes.

It is worth its own issue: drift that survives an apply means either the
catalogue does not say what we want for those fields, or the provider cannot
read back what it writes. Until then, releasing the apply on this pull request
will also push those 34 — which is the existing behaviour of every merge to
main here, but worth knowing before you release it rather than after.

mrspence merged commit 1483081 into main Oct 22, 2026
3 checks passed

mrspence mentioned this pull request Oct 22, 2026

fix(tofu): lower the logins fed to github_team_members #11

Merged

Navigation Menu

Repository navigation

fix(people): declare addyCooks, whom the first import missed - #10

fix(people): declare addyCooks, whom the first import missed#10
mrspence merged 1 commit into
mainfrom
fix/declare-addycooks

mrspence commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

mrspence commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mrspence commented Oct 22, 2026

What this is

What it does

The drift check

Not fixed here

Uh oh!

github-actions Bot commented Oct 22, 2026

This pull request changes the organisation. Read the plan before approving.

Uh oh!

mrspence commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant