Repository navigation
feat(teams): record nanocoder-desktop, and the member already in it - #8
Merged
Merged
Conversation
The team and the membership were made by hand against the live organisation on 2026-10-22, which is the wrong way round. This is the catalogue catching up, so it records something that is already true rather than asking for something new. teams/nanocoder-desktop.yaml holds one repository at push, because desktop access was the whole request. people/puri-adityakumar.yaml is a new organisation member who accepted the invitation before this file named them, so github_membership adopts an active membership rather than creating one. The team itself still needs adopting into state: github_team posts a name and would fail with 422 on the one that exists. That import block is NOT in this commit -- see the pull request body. readback.mjs compared role_name against the catalogue's own spelling, so any push grant read back as "write" and failed. core-team's ten grants are all maintain, the one permission GitHub says the same way in both vocabularies, which is why nothing caught it until a push grant existed. The nanocoder-desktop note on core-team was written when neither the repository nor the team existed. Both do now.
This pull request changes the organisation. Read the plan before approving.Plan outputmodule.repository["prompt-scrubber"].github_repository.this: Refreshing state... [id=prompt-scrubber]
module.repository[".github"].github_repository.this: Refreshing state... [id=.github]
module.repository["infrastructure"].github_repository.this: Refreshing state... [id=infrastructure]
module.repository["get-md"].github_repository.this: Refreshing state... [id=get-md]
github_team.root["admin"]: Refreshing state... [id=15526101]
module.repository["roster"].github_repository.this: Refreshing state... [id=roster]
module.repository["nanocoder-desktop"].github_repository.this: Refreshing state... [id=nanocoder-desktop]
module.repository["docs"].github_repository.this: Refreshing state... [id=docs]
module.repository["organisation"].github_repository.this: Refreshing state... [id=organisation]
module.repository["nanotune"].github_repository.this: Refreshing state... [id=nanotune]
module.repository["json-up"].github_repository.this: Refreshing state... [id=json-up]
module.repository["nanolist"].github_repository.this: Refreshing state... [id=nanolist]
module.repository["nanoterm"].github_repository.this: Refreshing state... [id=nanoterm]
module.repository["nanocoder"].github_repository.this: Refreshing state... [id=nanocoder]
module.repository["taskforest"].github_repository.this: Refreshing state... [id=taskforest]
module.repository["sentinel"].github_repository.this: Refreshing state... [id=sentinel]
module.repository["contentforest"].github_repository.this: Refreshing state... [id=contentforest]
github_membership.this["will-lamerton"]: Refreshing state... [id=Nano-Collective:will-lamerton]
github_team.root["core-team"]: Refreshing state... [id=17922917]
github_team.root["nanocoder-desktop"]: Preparing import... [id=20259972]
github_team.root["nanocoder-desktop"]: Refreshing state... [id=20259972]
github_membership.this["akramcodez"]: Refreshing state... [id=Nano-Collective:akramcodez]
github_membership.this["followbenparry"]: Refreshing state... [id=Nano-Collective:followbenparry]
github_membership.this["mrspence"]: Refreshing state... [id=Nano-Collective:mrspence]
github_membership.this["spinualexandru"]: Refreshing state... [id=Nano-Collective:spinualexandru]
github_membership.this["Avtrkrb"]: Refreshing state... [id=Nano-Collective:Avtrkrb]
github_team_members.this["core-team"]: Refreshing state... [id=17922917]
github_team_members.this["admin"]: Refreshing state... [id=15526101]
module.repository["organisation"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1064141539]
module.repository["get-md"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1081935107]
module.repository[".github"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1256130038]
module.repository["contentforest"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1222794803]
module.repository["nanocoder"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1029049168]
module.repository["docs"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1163990675]
module.repository["taskforest"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1255394363]
module.repository["json-up"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1165641658]
module.repository["prompt-scrubber"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1276739924]
module.repository["nanotune"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1146764215]
module.repository["infrastructure"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1428211040]
module.repository["roster"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1354824928]
module.repository["nanocoder-desktop"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1429652002]
module.repository["nanoterm"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1313629853]
module.repository["sentinel"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1304294125]
module.repository["nanolist"].github_repository_vulnerability_alerts.this: Refreshing state... [id=1339377078]
module.repository["nanoterm"].github_repository_ruleset.quality[0]: Refreshing state... [id=22445028]
module.repository["prompt-scrubber"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271987]
module.repository["sentinel"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271986]
module.repository["json-up"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271991]
module.repository["nanotune"].github_repository_ruleset.quality[0]: Refreshing state... [id=22462202]
module.repository["nanocoder"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271985]
module.repository["get-md"].github_repository_ruleset.quality[0]: Refreshing state... [id=22271989]
module.repository["nanocoder-desktop"].github_repository_ruleset.quality[0]: Refreshing state... [id=25634670]
module.repository["contentforest"].github_repository_ruleset.review[0]: Refreshing state... [id=22277962]
module.repository["json-up"].github_repository_ruleset.review[0]: Refreshing state... [id=22277958]
module.repository["nanocoder"].github_repository_ruleset.review[0]: Refreshing state... [id=22277950]
module.repository["sentinel"].github_repository_ruleset.review[0]: Refreshing state... [id=22277952]
module.repository["organisation"].github_repository_ruleset.review[0]: Refreshing state... [id=22277963]
module.repository["prompt-scrubber"].github_repository_ruleset.review[0]: Refreshing state... [id=22277954]
module.repository["nanoterm"].github_repository_ruleset.review[0]: Refreshing state... [id=22389731]
module.repository["get-md"].github_repository_ruleset.review[0]: Refreshing state... [id=22277955]
module.repository["nanocoder-desktop"].github_repository_ruleset.review[0]: Refreshing state... [id=25634667]
module.repository["nanotune"].github_repository_ruleset.review[0]: Refreshing state... [id=22277960]
github_team_repository.this["core-team:json-up"]: Refreshing state... [id=17922917:json-up]
github_team_repository.this["core-team:nanocoder"]: Refreshing state... [id=17922917:nanocoder]
github_team_repository.this["core-team:.github"]: Refreshing state... [id=17922917:.github]
github_team_repository.this["core-team:nanocoder-desktop"]: Refreshing state... [id=17922917:nanocoder-desktop]
github_team_repository.this["core-team:nanoterm"]: Refreshing state... [id=17922917:nanoterm]
github_team_repository.this["core-team:prompt-scrubber"]: Refreshing state... [id=17922917:prompt-scrubber]
github_team_repository.this["core-team:get-md"]: Refreshing state... [id=17922917:get-md]
github_team_repository.this["core-team:sentinel"]: Refreshing state... [id=17922917:sentinel]
github_team_repository.this["core-team:docs"]: Refreshing state... [id=17922917:docs]
github_team_repository.this["core-team:nanotune"]: Refreshing state... [id=17922917:nanotune]
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place (current -> planned)
OpenTofu will perform the following actions:
# github_membership.this["puri-adityakumar"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "puri-adityakumar"
}
# github_team.root["nanocoder-desktop"] will be imported
# (imported from "20259972")
resource "github_team" "root" {
create_default_maintainer = false
description = "Nanocoder Desktop contributors"
etag = "W/\"6b02fe51a2ccf3bdd6f60d4b5cc366fa3c35b74618563d91ffbcf3b8a195752f\""
id = "20259972"
members_count = 1
name = "nanocoder-desktop"
node_id = "T_kwDODdnGfc4BNSSE"
notification_setting = "notifications_enabled"
privacy = "closed"
slug = "nanocoder-desktop"
}
# github_team_members.this["core-team"] will be updated in-place
~ resource "github_team_members" "this" {
id = "17922917"
# (2 unchanged attributes hidden)
- members {
- role = "member" -> null
- username = "addycooks" -> null
}
# (2 unchanged blocks hidden)
}
# github_team_members.this["nanocoder-desktop"] will be created
+ resource "github_team_members" "this" {
+ id = (known after apply)
+ team_id = (known after apply)
+ team_slug = "nanocoder-desktop"
+ members {
+ role = "member"
+ username = "puri-adityakumar"
}
}
# github_team_repository.this["nanocoder-desktop:nanocoder-desktop"] will be created
+ resource "github_team_repository" "this" {
+ etag = (known after apply)
+ id = (known after apply)
+ permission = "push"
+ repository = "nanocoder-desktop"
+ team_id = "20259972"
}
# module.repository[".github"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = ".github"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = ".github"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (31 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["contentforest"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "contentforest"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "contentforest"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["contentforest"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277962"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["docs"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "docs"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "docs"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["get-md"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "get-md"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "get-md"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["get-md"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22271989"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["get-md"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277955"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["infrastructure"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "infrastructure"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "infrastructure"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (31 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["json-up"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "json-up"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "json-up"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["json-up"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22271991"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["json-up"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277958"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanocoder"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "nanocoder"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "nanocoder"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["nanocoder"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22271985"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanocoder"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277950"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanocoder-desktop"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_squash_merge = false -> true
~ delete_branch_on_merge = false -> true
id = "nanocoder-desktop"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "nanocoder-desktop"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (31 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["nanocoder-desktop"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "25634670"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanocoder-desktop"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "25634667"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanolist"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "nanolist"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "nanolist"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["nanoterm"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "nanoterm"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "nanoterm"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (30 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["nanoterm"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22445028"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanoterm"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22389731"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanotune"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "nanotune"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "nanotune"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["nanotune"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22462202"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["nanotune"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277960"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["organisation"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "organisation"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "organisation"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["organisation"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277963"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["prompt-scrubber"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "prompt-scrubber"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "prompt-scrubber"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (31 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["prompt-scrubber"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22271987"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["prompt-scrubber"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277954"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["roster"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "roster"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "roster"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["sentinel"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "sentinel"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "sentinel"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (32 unchanged attributes hidden)
# (1 unchanged block hidden)
}
# module.repository["sentinel"].github_repository_ruleset.quality[0] will be updated in-place
~ resource "github_repository_ruleset" "quality" {
id = "22271986"
name = "Quality gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["sentinel"].github_repository_ruleset.review[0] will be updated in-place
~ resource "github_repository_ruleset" "review" {
id = "22277952"
name = "Review gates"
# (6 unchanged attributes hidden)
+ bypass_actors {
+ actor_id = 0
+ actor_type = "OrganizationAdmin"
+ bypass_mode = "always"
}
+ bypass_actors {
+ actor_id = 2
+ actor_type = "RepositoryRole"
+ bypass_mode = "always"
}
# (2 unchanged blocks hidden)
}
# module.repository["taskforest"].github_repository.this will be updated in-place
~ resource "github_repository" "this" {
~ allow_merge_commit = false -> true
~ allow_rebase_merge = false -> true
~ allow_squash_merge = false -> true
id = "taskforest"
+ merge_commit_message = "PR_TITLE"
+ merge_commit_title = "MERGE_MESSAGE"
name = "taskforest"
+ squash_merge_commit_message = "COMMIT_MESSAGES"
+ squash_merge_commit_title = "COMMIT_OR_PR_TITLE"
# (30 unchanged attributes hidden)
}
Plan: 1 to import, 3 to add, 35 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
Planned from |
github_team posts a name, so creating the team that already exists fails with 422. The import block is scoped to that one object rather than arming var.bootstrap, which is for the first apply and would break every addition made to the catalogue since. Remove it in the pull request after the apply that uses it.
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the
nanocoder-desktopteam and its one member in the catalogue. Bothalready exist on GitHub, so this changes nobody's access — it ends the drift.
teams/nanocoder-desktop.yamlnanocoder-desktop: push, no other repositorypeople/puri-adityakumar.yamlmemberof that teamtofu/imports.tfscripts/readback.mjspushgrantsteams/core-team.yamlThe import block
The team exists already (id
20259972).github_teamposts a name and wouldfail with 422 Name has already been taken, so it is imported. The block is
scoped to that one resource rather than arming
var.bootstrap— that variableis for the first apply and says so, and turning it back on would break every
addition made to the catalogue since.
Nothing else needs importing.
github_team_repository,github_team_membersand
github_membershipall write with PUT and reconcile what is already there.Remove the block in the next pull request, after this has been applied.
The readback fix
scripts/readback.mjscompared GitHub'srole_nameagainst the catalogue's ownspelling. The schema accepts
pull/push;role_namereads backread/write.A correct
pushgrant therefore failed the check:core-team's ten grants are allmaintain, the one permission spelled the samein both vocabularies, so no
pushgrant has ever exercised this check before.Fixed by mapping
pull→readandpush→write. Separable from the rest of thispull request if you would rather review it on its own.
Read the plan before releasing the apply
The plan is 4 to add, 35 to change. Only four of those belong to this
branch. The rest is drift that predates it and will be applied along with it.
One item in particular:
This apply removes
addyCooksfromcore-team, and with it their access toall ten repositories that team holds.
github_team_membersis authoritativeover the whole member list, and
addyCookshas no file inpeople/, so thecatalogue reads as "not a member". They are one of only three people in that
team.
That is a pre-existing condition — any apply from
mainwould do the same — butthis pull request is the one that triggers it. It wants resolving first, either
by giving
addyCooksapeople/file or by deciding the removal is correct.