Skip to content

NO-ISSUE: migrate required status checks to GitHub rulesets #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
larsks merged 1 commit into from
Jul 16, 2026
+36 −4
Merged

NO-ISSUE: migrate required status checks to GitHub rulesets #131

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 36 additions & 4 deletions modules/common_repository/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,12 +97,44 @@ resource "github_branch_protection" "repo_protection" {
}
}

required_status_checks {
strict = true
contexts = var.required_status_checks
depends_on = [github_repository.repo, github_repository_collaborators.repo_collaborators]
}

resource "github_repository_ruleset" "status_checks" {

@coderabbitai coderabbitai Bot Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a Terraform plan CI workflow.

Regarding your question about adding a tf plan CI job: Yes, it is strongly recommended. Running terraform fmt -check, terraform validate, and terraform plan on pull requests validates configuration syntax and previews infrastructure changes, preventing unexpected enforcement gaps or errors upon merge.

Would you like me to generate a GitHub Actions workflow snippet or open a new issue to implement this?

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modules/common_repository/main.tf` at line 103, Add a GitHub Actions
pull-request workflow for the Terraform configuration containing
github_repository_ruleset.status_checks that runs terraform fmt -check,
terraform validate, and terraform plan. Configure the job to initialize
Terraform before validation and planning, and ensure the plan executes from the
correct Terraform working directory.

@rccrdpccl rccrdpccl Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be a separate PR

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rccrdpccl, that makes sense—keeping infra changes and CI tooling changes separate is good practice. Would you like me to open a follow-up issue to track adding the tf plan/fmt/validate CI workflow?

@larsks larsks Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason there is no tf plan pre-commit job is because that requires credentials to access state storage, so it wouldn't work for pull requests from forked repositories.

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

@rccrdpccl rccrdpccl Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason there is no tf plan pre-commit job is because that requires credentials to access state storage, so it wouldn't work for pull requests from forked repositories.

There are ways to work around that: see environment protection, or pull_request_target, etc. if this is of interest I could craft a PR.

In any case, I do not think it should be done in this PR.

@rccrdpccl rccrdpccl Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

example PR #132

count = var.visibility == "private" ? 0 : var.branch_protection && length(var.required_status_checks) > 0 ? 1 : 0

name = "ci-status-checks"
repository = github_repository.repo.name
target = "branch"
enforcement = "active"

bypass_actors {
actor_id = 1
actor_type = "OrganizationAdmin"
bypass_mode = "always"
}

depends_on = [github_repository.repo, github_repository_collaborators.repo_collaborators]
conditions {
ref_name {
include = ["~DEFAULT_BRANCH"]
exclude = []
}
}

rules {
required_status_checks {
strict_required_status_checks_policy = true

dynamic "required_check" {
for_each = var.required_status_checks
content {
context = required_check.value
}
}
}
}

depends_on = [github_repository.repo]
}

resource "github_repository_environment" "env" {
Expand Down
Loading