diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl deleted file mode 100644 index b9c14df..0000000 --- a/.terraform.lock.hcl +++ /dev/null @@ -1,36 +0,0 @@ -# This file is maintained automatically by "tofu init". -# Manual edits may be lost in future updates. - -provider "registry.opentofu.org/integrations/github" { - version = "6.13.0" - constraints = "~> 6.0, ~> 6.13" - hashes = [ - "h1:2kD+4leuV8tBBXv+EPeehmfW6cDhIzVki61OXsGCtRI=", - "h1:99s0C+KmzXIsUJY0tKlgfcFUIuuXjCK0TAeeZ8HaOZQ=", - "h1:Mug81HyUTKKMngXMOtBxuQ8ge3dVnzt9tGcF9SxLcVE=", - "h1:RhCWa2aaFVKF/HzeR0fkIxZmoJvkGrv07hE0z09aPQs=", - "h1:YS8951MRtP4YNs2CNsDfqE7Mr9tDz/Y7xDSo18zyCkQ=", - "h1:Z0dj6yhxjLxg44gGNkh3zdAPY9iNkkiC+n7mEJcvUHY=", - "h1:a9VUv7chtxc+vro0uZo12PhBGbyeq3uKslrKLDHbkeg=", - "h1:awjLJy4zAQRONIVuKbsFSOpEWYWREdeeAXQHkhDXMDI=", - "h1:gz9DIUPAPQf0wI9dcmcNMgPBY/AwUfzKZbVnUMbAd9I=", - "h1:jPHxtaeO8mgFGGWdEmATq/BNGo1LkE6FYFgMa6Dum08=", - "h1:jXEm7QnQCF2UG4KTgDMwT2cEqezPE8a+3V0iA8N1r7k=", - "h1:jjeEBnfOJI+bV/rf1721l4B3fNO7Yws4AKf4NDdhiho=", - "h1:y0Sujto8gttV86innNp/LTMzq7CqsFpBs7XKH8AlMl4=", - "zh:0ab29fc21699f34345cf0bbbe44745fd1b143b7c73b410c1dc4abe05ffad0a84", - "zh:1aed10d06755d420bb3a893bf548ab2932297a9d094c04c5a8501e949ca186ed", - "zh:2a6a11c21eae408055f45b9533c07afd2e845f6d496fd1b645aec2e873012103", - "zh:5dd05dee677f6ebdbed00cbb1b9be444ab2d1062d345cbc9ec50a47cb41b8622", - "zh:6b757d034831243d67ddda869eac4368cef539848bd97511f4d68f1aa38a9c88", - "zh:947c9b5b238f0364c57a705beabd24d3eea3159a6f3a24c07e3fbb13657ffae0", - "zh:a676549a98164b61630658cbeb6c17820331ca04a049dc9b5095996a0c31ffbe", - "zh:a8a81b7fe41dd61eb6a6fa5e08a4dd9ee070e862868252a7fd4cfce30364efee", - "zh:c26a9bca4865665084e7f59b1402d7aff34ee63a418d7401a0658fa280cad4d4", - "zh:c638d8d0762e62ea188f86302954ef4c92803f2160f0a45fca0cd13974bd3725", - "zh:e739a0b7e81ca816944a18a38e679f4015edf8be7ac319815cdea865ba7727d7", - "zh:ec099487ea3de8999c84b3b791e242d728461e51fe344832b37bd8d521201c77", - "zh:f016ff9e2daab5b88185cec0795213049d105439ffd585d3309a714514ccae13", - "zh:fbd1fee2c9df3aa19cf8851ce134dea6e45ea01cb85695c1726670c285797e25", - ] -} diff --git a/README.md b/README.md new file mode 100644 index 0000000..c5f5e04 --- /dev/null +++ b/README.md @@ -0,0 +1,19 @@ +# Deprecated repository-policy root + +This repository is being retired as an owner of Jackin GitHub repository settings and rulesets. The planned source of truth is the [ChainArgos GitHub Terraform control plane](https://github.com/ChainArgos/github-terraform), which centralizes policies across organizations. + +Do not merge this retirement until the central control-plane change is on its default branch and its reviewed plan confirms it adopts the existing nine Jackin repositories and their rulesets. The control plane should be the only root that declares or imports these policies. + +The handoff inventory is: + +- `homebrew-tap` +- `jackin` +- `jackin-agent-smith` +- `jackin-dev` +- `jackin-github-terraform` +- `jackin-marketplace` +- `jackin-role-action` +- `jackin-sentinel` +- `jackin-the-architect` + +This root intentionally contains no GitHub provider, repository inventory, repository or ruleset resources, or import blocks. The `removed` blocks in `migrations.tf` forget any legacy local-state ownership with `destroy = false`; they do not delete GitHub repositories or rulesets. CI initializes with `-backend=false`, and this root does not configure a remote backend. diff --git a/branch-protection.tf b/branch-protection.tf deleted file mode 100644 index 1653b61..0000000 --- a/branch-protection.tf +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Alexey Zhokhov -# SPDX-License-Identifier: Apache-2.0 - -# Canonical GitHub repository settings and branch/tag protection policies -# Managed via the shared repository-policy module -module "repository_policy" { - source = "./modules/repository-policy" - - repository_policies = var.repository_policies -} diff --git a/checks.tf b/checks.tf deleted file mode 100644 index 0a2037a..0000000 --- a/checks.tf +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Alexey Zhokhov -# SPDX-License-Identifier: Apache-2.0 - -# Deterministic invariant assertions to prevent policy weakening and inventory omissions - -check "mandatory_target_repositories_present" { - assert { - condition = length(setsubtract([ - "homebrew-tap", - "jackin", - "jackin-agent-smith", - "jackin-dev", - "jackin-github-terraform", - "jackin-role-action", - "jackin-sentinel", - "jackin-the-architect", - ], keys(var.repository_policies))) == 0 - error_message = "One or more mandatory jackin-project target repositories are missing from repository_policies." - } -} - -check "self_protection_enforced" { - assert { - condition = lookup(var.repository_policies, "jackin-github-terraform", null) != null && var.repository_policies["jackin-github-terraform"].disposition == "FullRuleset" - error_message = "jackin-github-terraform must protect itself with FullRuleset disposition." - } -} - -check "jackin_terraform_required_checks_match_ci" { - assert { - condition = contains(keys(var.repository_policies), "jackin-github-terraform") ? ( - length(var.repository_policies["jackin-github-terraform"].required_checks) == 2 && - contains(var.repository_policies["jackin-github-terraform"].required_checks, "Required") && - contains(var.repository_policies["jackin-github-terraform"].required_checks, "DCO") - ) : false - error_message = "jackin-github-terraform must require the current green CI aggregator (Required) and DCO checks." - } -} - -check "delete_branch_on_merge_mandate" { - assert { - condition = alltrue([ - for name, repo in module.repository_policy.repository_settings : - repo.delete_branch_on_merge == true - ]) - error_message = "All managed repositories must enforce delete_branch_on_merge = true." - } -} - -check "squash_only_merge_mandate" { - assert { - condition = alltrue([ - for name, repo in module.repository_policy.repository_settings : - repo.allow_squash_merge == true && - repo.allow_merge_commit == false && - repo.allow_rebase_merge == false && - repo.squash_merge_commit_title == "PR_TITLE" && - repo.squash_merge_commit_message == "PR_BODY" - ]) - error_message = "All managed repositories must enforce squash-only merge policy with PR_TITLE/PR_BODY." - } -} diff --git a/migrations.tf b/migrations.tf index 13676a0..56bc884 100644 --- a/migrations.tf +++ b/migrations.tf @@ -1,18 +1,35 @@ # SPDX-FileCopyrightText: 2026 Alexey Zhokhov # SPDX-License-Identifier: Apache-2.0 -# Module refactoring: migrate root-level resources into module.repository_policy -moved { +# Forget this root's former ownership without deleting the GitHub objects. +removed { + from = module.repository_policy + + lifecycle { + destroy = false + } +} + +removed { from = github_repository.managed_settings - to = module.repository_policy.github_repository.managed_settings + + lifecycle { + destroy = false + } } -moved { +removed { from = github_repository_ruleset.protect_main - to = module.repository_policy.github_repository_ruleset.protect_main + + lifecycle { + destroy = false + } } -moved { +removed { from = github_repository_ruleset.protect_tags - to = module.repository_policy.github_repository_ruleset.protect_tags + + lifecycle { + destroy = false + } } diff --git a/modules/repository-policy/main.tf b/modules/repository-policy/main.tf deleted file mode 100644 index 74db1db..0000000 --- a/modules/repository-policy/main.tf +++ /dev/null @@ -1,134 +0,0 @@ -terraform { - required_version = ">= 1.5" - - required_providers { - github = { - source = "integrations/github" - version = "~> 6.0" - } - } -} - -locals { - managed_settings_repositories = toset([ - for repo, policy in var.repository_policies : repo - if contains(["FullRuleset", "RepoSettingsOnly"], policy.disposition) - ]) - - full_ruleset_repositories = toset([ - for repo, policy in var.repository_policies : repo - if policy.disposition == "FullRuleset" - ]) -} - -# Repository-level merge settings (Tier 1 enforcement across all repos) -resource "github_repository" "managed_settings" { - for_each = local.managed_settings_repositories - - name = each.value - - # Strict squash-only merge policy - allow_squash_merge = true - allow_merge_commit = false - allow_rebase_merge = false - - # Standard commit title and body format - squash_merge_commit_title = "PR_TITLE" - squash_merge_commit_message = "PR_BODY" - - # Keep GitHub from offering the pull-request branch-update action. - allow_update_branch = false - delete_branch_on_merge = true - - lifecycle { - prevent_destroy = true - ignore_changes = [ - description, - homepage_url, - has_issues, - has_projects, - has_wiki, - has_discussions, - visibility, - archived, - topics, - vulnerability_alerts, - allow_auto_merge, - web_commit_signoff_required, - pages, - security_and_analysis, - ] - } -} - -# Branch ruleset on main / default branch (Tier 2 ref protection) -resource "github_repository_ruleset" "protect_main" { - for_each = local.full_ruleset_repositories - - name = "protect-main" - target = "branch" - enforcement = "active" - repository = each.value - - conditions { - ref_name { - include = ["~DEFAULT_BRANCH"] - exclude = [] - } - } - - # MANDATORY INVARIANT: Zero standing bypasses on core protections. - # Direct pushes, non-squash integration, force pushes, and deletion are blocked for all actors. - - rules { - deletion = true - non_fast_forward = true - required_linear_history = true - - pull_request { - allowed_merge_methods = ["squash"] - required_approving_review_count = 0 - dismiss_stale_reviews_on_push = true - require_last_push_approval = false - require_code_owner_review = false - required_review_thread_resolution = true - } - - dynamic "required_status_checks" { - for_each = length(var.repository_policies[each.value].required_checks) > 0 ? [1] : [] - content { - strict_required_status_checks_policy = false - do_not_enforce_on_create = false - - dynamic "required_check" { - for_each = var.repository_policies[each.value].required_checks - content { - context = required_check.value - } - } - } - } - } -} - -# Tag ruleset protecting all tags -resource "github_repository_ruleset" "protect_tags" { - for_each = local.full_ruleset_repositories - - name = "protect-tags" - target = "tag" - enforcement = "active" - repository = each.value - - conditions { - ref_name { - include = ["~ALL"] - exclude = [] - } - } - - rules { - deletion = true - non_fast_forward = true - } -} diff --git a/modules/repository-policy/outputs.tf b/modules/repository-policy/outputs.tf deleted file mode 100644 index beb94d3..0000000 --- a/modules/repository-policy/outputs.tf +++ /dev/null @@ -1,24 +0,0 @@ -output "managed_settings_repositories" { - description = "Set of repository names with managed repository-level merge settings" - value = local.managed_settings_repositories -} - -output "full_ruleset_repositories" { - description = "Set of repository names with active branch and tag rulesets" - value = local.full_ruleset_repositories -} - -output "repository_settings" { - description = "Map of repository merge and lifecycle settings" - value = { - for k, v in github_repository.managed_settings : k => { - allow_squash_merge = v.allow_squash_merge - allow_merge_commit = v.allow_merge_commit - allow_rebase_merge = v.allow_rebase_merge - squash_merge_commit_title = v.squash_merge_commit_title - squash_merge_commit_message = v.squash_merge_commit_message - allow_update_branch = v.allow_update_branch - delete_branch_on_merge = v.delete_branch_on_merge - } - } -} diff --git a/modules/repository-policy/variables.tf b/modules/repository-policy/variables.tf deleted file mode 100644 index 2899ee8..0000000 --- a/modules/repository-policy/variables.tf +++ /dev/null @@ -1,24 +0,0 @@ -variable "repository_policies" { - description = "Map of repository names to their protection policy configurations" - type = map(object({ - disposition = string # "FullRuleset" | "RepoSettingsOnly" - visibility = string # "public" | "private" - required_checks = list(string) - })) - - validation { - condition = alltrue([ - for name, config in var.repository_policies : - contains(["FullRuleset", "RepoSettingsOnly"], config.disposition) - ]) - error_message = "disposition must be either 'FullRuleset' or 'RepoSettingsOnly'." - } - - validation { - condition = alltrue([ - for name, config in var.repository_policies : - contains(["public", "private"], config.visibility) - ]) - error_message = "visibility must be either 'public' or 'private'." - } -} diff --git a/provider.tf b/provider.tf deleted file mode 100644 index 5ade5ba..0000000 --- a/provider.tf +++ /dev/null @@ -1,6 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Alexey Zhokhov -# SPDX-License-Identifier: Apache-2.0 - -provider "github" { - owner = "jackin-project" -} diff --git a/tests/verify-policy.sh b/tests/verify-policy.sh index ef3ac27..3611322 100755 --- a/tests/verify-policy.sh +++ b/tests/verify-policy.sh @@ -6,152 +6,105 @@ set -euo pipefail REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" cd "$REPO_ROOT" -echo "=== 1. Checking OpenTofu formatting ===" -tofu fmt -check -recursive - -echo "=== 2. Validating OpenTofu configuration ===" -tofu validate - -echo "=== 3. Verifying mandatory target inventory coverage ===" -MANDATORY_TARGETS=( - "homebrew-tap" - "jackin" - "jackin-agent-smith" - "jackin-dev" - "jackin-github-terraform" - "jackin-role-action" - "jackin-sentinel" - "jackin-the-architect" -) +fail() { + echo "FAILED: $*" >&2 + exit 1 +} -python3 - << 'EOF' -import re, sys +echo "=== Verifying this root cannot manage GitHub repositories or rulesets ===" +for forbidden in \ + '^\s*resource\s+"github_repository(_ruleset)?"' \ + '^\s*provider\s+"github"' \ + '^\s*module\s+"repository_policy"' \ + '^\s*import\s*\{' \ + '^\s*backend\s+"[^"]+"' +do + if rg -n "$forbidden" --glob '*.tf' --glob '*.tofu' .; then + fail "retired root contains active GitHub ownership or backend configuration ($forbidden)" + fi +done + +if [[ -e modules/repository-policy ]]; then + fail "repository-policy module remains in the retired root" +fi +if [[ -e .terraform.lock.hcl ]]; then + fail "unused GitHub provider lockfile remains" +fi + +echo "=== Verifying state handoff never deletes live GitHub objects ===" +python3 - <<'PY' +import re +import sys +from pathlib import Path + +migration = Path("migrations.tf").read_text() +versions = Path("versions.tf").read_text() +if not re.search(r'required_version\s*=\s*">=\s*1\.10(?:\.0)?"', versions): + print("FAILED: OpenTofu >= 1.10 is required for lifecycle in removed blocks.") + sys.exit(1) -with open("variables.tf") as f: - content = f.read() +expected = { + "module.repository_policy", + "github_repository.managed_settings", + "github_repository_ruleset.protect_main", + "github_repository_ruleset.protect_tags", +} +removed = re.findall(r"^\s*from\s*=\s*(\S+)\s*$", migration, re.M) +destroy_false = re.findall(r"^\s*destroy\s*=\s*false\s*$", migration, re.M) +if set(removed) != expected or len(removed) != len(expected): + print(f"FAILED: expected removed addresses {sorted(expected)}, found {removed}") + sys.exit(1) +if len(destroy_false) != len(expected): + print(f"FAILED: expected destroy=false on {len(expected)} removed blocks, found {len(destroy_false)}") + sys.exit(1) -mandatory = [ +readme = Path("README.md").read_text() +if "https://github.com/ChainArgos/github-terraform" not in readme: + print("FAILED: deprecation pointer to the control plane is missing.") + sys.exit(1) +for repo in ( "homebrew-tap", "jackin", "jackin-agent-smith", "jackin-dev", "jackin-github-terraform", + "jackin-marketplace", "jackin-role-action", "jackin-sentinel", "jackin-the-architect", -] - -missing = [] -for repo in mandatory: - pattern = rf'"{re.escape(repo)}"\s*=\s*\{{' - if not re.search(pattern, content): - missing.append(repo) - -if missing: - print(f"FAILED: Missing mandatory repositories in variables.tf: {missing}") - sys.exit(1) - -print(f"SUCCESS: All {len(mandatory)} mandatory jackin-project target repositories are declared.") -EOF - -echo "=== 4. Verifying canonical policy invariants in module ===" -python3 - << 'EOF' -import re, sys - -with open("modules/repository-policy/main.tf") as f: - mod = f.read() - -def check_pattern(pattern, desc): - if not re.search(pattern, mod): - print(f"FAILED invariant: {desc}") +): + if f"`{repo}`" not in readme: + print(f"FAILED: handoff inventory is missing {repo}.") sys.exit(1) -check_pattern(r'allow_squash_merge\s*=\s*true', "allow_squash_merge = true") -check_pattern(r'allow_merge_commit\s*=\s*false', "allow_merge_commit = false") -check_pattern(r'allow_rebase_merge\s*=\s*false', "allow_rebase_merge = false") -check_pattern(r'squash_merge_commit_title\s*=\s*"PR_TITLE"', "squash_merge_commit_title = PR_TITLE") -check_pattern(r'squash_merge_commit_message\s*=\s*"PR_BODY"', "squash_merge_commit_message = PR_BODY") -update_branch_values = re.findall(r'^\s*allow_update_branch\s*=\s*(true|false)\s*$', mod, re.M) -if update_branch_values != ["false"]: - print(f"FAILED invariant: expected one allow_update_branch = false setting; found {update_branch_values}") - sys.exit(1) -check_pattern(r'delete_branch_on_merge\s*=\s*true', "delete_branch_on_merge = true") -check_pattern(r'allowed_merge_methods\s*=\s*\[\s*"squash"\s*\]', "allowed_merge_methods = ['squash']") -check_pattern(r'required_linear_history\s*=\s*true', "required_linear_history = true") -check_pattern(r'deletion\s*=\s*true', "deletion = true") -check_pattern(r'non_fast_forward\s*=\s*true', "non_fast_forward = true") -check_pattern(r'required_review_thread_resolution\s*=\s*true', "required_review_thread_resolution = true") -strict_freshness_values = re.findall(r'^\s*strict_required_status_checks_policy\s*=\s*(true|false)\s*$', mod, re.M) -if strict_freshness_values != ["false"]: - print(f"FAILED invariant: expected one strict_required_status_checks_policy = false setting; found {strict_freshness_values}") - sys.exit(1) +print("SUCCESS: Legacy state addresses are forgotten with destroy=false and all nine repos point to the control plane.") +PY -assert 'bypass_actors' not in mod, "No bypass_actors allowed on core protection" - -print("SUCCESS: All canonical policy invariants verified in modules/repository-policy/main.tf.") -EOF - -echo "=== 5. Verifying configured required CI contexts ===" -python3 - << 'EOF' -import re, sys - -with open("variables.tf") as f: - content = f.read() - -expected = { - "homebrew-tap": {"Required", "DCO"}, - "jackin": {"Required", "DCO"}, - "jackin-agent-smith": {"Required", "DCO"}, - "jackin-dev": {"Required", "DCO"}, - "jackin-github-terraform": {"Required", "DCO"}, - "jackin-role-action": {"Required", "DCO"}, - "jackin-sentinel": {"Required", "DCO"}, - "jackin-the-architect": {"Required", "DCO"}, - "jackin-marketplace": {"Policy"}, -} - -policies = {} -for name, body in re.findall(r'"([^"]+)"\s*=\s*\{(.*?)\n\s*\}', content, re.S): - checks = re.search(r'required_checks\s*=\s*\[([^\]]*)\]', body) - policies[name] = re.findall(r'"([^"]+)"', checks.group(1)) if checks else [] - -missing = sorted(set(expected) - set(policies)) -incorrect = { - name: policies[name] - for name, contexts in expected.items() - if name in policies and (set(policies[name]) != contexts or len(policies[name]) != len(contexts)) -} -if missing or incorrect: - print(f"FAILED: Missing policy entries: {missing}; incorrect required contexts: {incorrect}.") - sys.exit(1) - -print("SUCCESS: All 8 target repos require Required and DCO; marketplace retains its verified Policy context.") -EOF - -echo "=== 6. Verifying every protected repository has required CI contexts ===" -python3 - << 'EOF' -import re, sys - -with open("variables.tf") as f: - content = f.read() - -policies = re.findall(r'"([^"]+)"\s*=\s*\{(.*?)\n\s*\}', content, re.S) -empty = [] -protected_count = 0 -for name, body in policies: - disposition = re.search(r'disposition\s*=\s*"([^"]+)"', body) - checks = re.search(r'required_checks\s*=\s*\[([^\]]*)\]', body) - contexts = re.findall(r'"([^"]+)"', checks.group(1)) if checks else [] - if disposition and disposition.group(1) == "FullRuleset": - protected_count += 1 - if not contexts: - empty.append(name) - -if empty: - print(f"FAILED: Protected repositories have no required CI contexts: {empty}") +echo "=== Checking OpenTofu formatting, initialization, and validation ===" +tofu fmt -check -recursive +tofu init -backend=false -input=false -lockfile=readonly -no-color +tofu validate -no-color + +echo "=== Verifying a backend=false plan has no GitHub mutations ===" +plan_file="$(mktemp "${TMPDIR:-/tmp}/jackin-policy-retirement.XXXXXX")" +trap 'rm -f "$plan_file"' EXIT +tofu plan -refresh=false -input=false -no-color -out="$plan_file" +tofu show -json "$plan_file" | python3 -c ' +import json +import sys + +plan = json.load(sys.stdin) +changes = plan.get("resource_changes", []) +unsafe = [] +for item in changes: + actions = item.get("change", {}).get("actions", []) + if actions not in (["no-op"], ["forget"]): + unsafe.append((item.get("address"), actions)) +if unsafe: + print(f"FAILED: plan contains resource mutations: {unsafe}") sys.exit(1) - -print(f"SUCCESS: All {protected_count} protected repositories have required CI contexts.") -EOF - -echo "=== ALL VERIFICATIONS PASSED ===" +if changes: + print(f"Plan contains state-only forget/no-op entries: {len(changes)}; no GitHub mutations.") +else: + print("SUCCESS: plan is empty; no GitHub resources are managed or changed.") +' diff --git a/variables.tf b/variables.tf deleted file mode 100644 index 6e0e0fe..0000000 --- a/variables.tf +++ /dev/null @@ -1,59 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Alexey Zhokhov -# SPDX-License-Identifier: Apache-2.0 - -variable "repository_policies" { - description = "Authoritative map of managed repository names to their protection policy configuration" - type = map(object({ - disposition = string # "FullRuleset" | "RepoSettingsOnly" - visibility = string # "public" | "private" - required_checks = list(string) - })) - default = { - # The current Velnor CI aggregator is Required; DCO is an independent app check. - "homebrew-tap" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-agent-smith" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-dev" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-github-terraform" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-marketplace" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Policy"] - } - "jackin-role-action" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-sentinel" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - "jackin-the-architect" = { - disposition = "FullRuleset" - visibility = "public" - required_checks = ["Required", "DCO"] - } - } -} diff --git a/versions.tf b/versions.tf index 4cce781..8716922 100644 --- a/versions.tf +++ b/versions.tf @@ -2,12 +2,5 @@ # SPDX-License-Identifier: Apache-2.0 terraform { - required_version = ">= 1.5" - - required_providers { - github = { - source = "integrations/github" - version = "~> 6.13" - } - } + required_version = ">= 1.10" }