feat: create github team module

modules/github/repository/main.tf

@@ -1,16 +1,15 @@
 locals {
     repositories = [
-        "infrastructure",
-        "manifests",
-        "airflow-pipeline-factory",
-        "fetch-system.worker",
-        "fetch-system.util",
-        "core-system.worker",
-        "hts-connector",
-        ".github",
-        "GoCppLinkingLibrary",
-        "common",
-        "buycycle"
+        {name = "infrastructure",           tags = ["devops"]},
+        {name = "manifests",                tags = ["devops"]},
+        {name = "airflow-pipeline-factory", tags = ["de"]},
+        {name = "fetch-system.worker",      tags = ["backend"]},
+        {name = "fetch-system.util",        tags = ["backend"]},
+        {name = "core-system.worker",       tags = ["backend"]},
+        {name = "hts-connector",            tags = ["backend"]},
+        {name = ".github",                  tags = []},
+        {name = "GoCppLinkingLibrary",      tags = ["ml"]},
+        {name = "common",                   tags = []}
     ]
 
     archived_repositories = [
@@ -30,82 +29,56 @@ locals {
 
 
 resource "github_repository" "repository" {
-    for_each = toset(local.repositories)
+  for_each = { for repo in local.repositories : repo.name => repo }
 
-    name = each.value
-    description = ""
+  name = each.value.name
+  description = ""
 
-    visibility = "public"
-    has_issues = true
+  visibility = "public"
+  has_issues = true
 
-    delete_branch_on_merge = true
-    allow_merge_commit = true
+  delete_branch_on_merge = true
+  allow_merge_commit = true
 }
 
-resource "github_branch_protection" "main_branch_protection" {
-  for_each = toset(local.repositories)
+resource "github_repository_topics" "repository_topic" {
+  for_each = { for repo in local.repositories : repo.name => repo }
 
-  repository_id = github_repository.repository[each.value].node_id
-
-  pattern = "main"
+  repository = each.value.name
+  topics = each.value.tags
+
+  depends_on = [github_repository.repository]
+}
+
+resource "github_branch_protection_v3" "main_branch_protection" {
+  for_each = { for repo in local.repositories : repo.name => repo }
+
+  repository = each.value.name
+  branch = "main"
+  enforce_admins = true  
 
   required_pull_request_reviews {
     required_approving_review_count = 1
     dismiss_stale_reviews           = false
     require_code_owner_reviews      = false
-    pull_request_bypassers = [
-      "goboolean/devops"
-    ]
+    bypass_pull_request_allowances {
+      teams = ["goboolean/DevOps"]
+    }
   }
 
   required_status_checks {
     strict   = true
-    contexts = []
   }
 
-  enforce_admins = true  
-  allows_deletions = false
-  allows_force_pushes = false
+  depends_on = [github_repository.repository]
 }
 
 resource "github_repository" "archived" {
-    for_each = { for repo in local.archived_repositories : repo.name => repo }
-
-    name = each.value.name
-    description = ""
-
-    visibility = each.value.visibility
-    archived = true
-}
-
-resource "github_team" "devops" {
-  name        = "devops"
-  description = "DevOps team"
-}
-
-resource "github_team_members" "devops_members" {
-  team_id  = github_team.devops.id
-
-  members {
-    username = "mulmuri"
-    role     = "maintainer"
-  }
-
-  members {
-    username = "ikjeong"
-    role     = "maintainer"
-  }
-
-  members {
-    username = "goboolean-io"
-    role     = "member"
-  }
-}
+  for_each = { for repo in local.archived_repositories : repo.name => repo }
 
-resource "github_team_repository" "devops_access" {
-  for_each = toset(local.repositories)
+  name = each.value.name
+  description = ""
 
-  team_id    = github_team.devops.id
-  repository = each.value
-  permission = "push"
+  visibility = each.value.visibility
+  archived = true
 }

modules/github/team/main.tf

@@ -0,0 +1,128 @@
+#Active Users
+resource "github_team" "active_users" {
+    name = "Active Users"
+    description = "Active Users"
+}
+
+resource "github_team_members" "active_users" {
+  team_id  = github_team.active_users.id
+
+  members {
+    username = "mulmuri"
+    role     = "member"
+  }
+
+  members {
+    username = "ikjeong"
+    role     = "member"
+  }
+
+  members {
+    username = "goboolean-io"
+    role     = "member"
+  }
+
+  members {
+    username = "dawit0905"
+    role     = "member"
+  }
+}
+
+
+#DevOps
+resource "github_team" "devops" {
+  name        = "DevOps"
+  description = "DevOps team"
+}
+
+resource "github_team_members" "devops_members" {
+  team_id  = github_team.devops.id
+
+  members {
+    username = "mulmuri"
+    role     = "maintainer"
+  }
+
+  members {
+    username = "ikjeong"
+    role     = "maintainer"
+  }
+
+  members {
+    username = "goboolean-io"
+    role     = "maintainer"
+  }
+}
+
+data "github_repositories" "infra_repos" {
+  query = "topic:devops org:goboolean"
+}
+
+resource "github_team_repository" "devops_access" {
+  for_each = toset(data.github_repositories.infra_repos.names)
+
+  team_id    = github_team.devops.id
+  repository = each.value
+  permission = "push"
+}
+
+
+#DE
+resource "github_team" "de" {
+  name = "DE"
+  description = "DevOps"
+}
+
+resource "github_team_members" "de_members" {
+  team_id  = github_team.de.id
+
+  members {
+    username = "mulmuri"
+    role     = "maintainer"
+  }
+
+  members {
+    username = "dawit0905"
+    role     = "maintainer"
+  }
+}
+
+data "github_repositories" "de_repos" {
+  query = "topic:de org:goboolean"
+}
+
+resource "github_team_repository" "de_access" {
+  for_each = toset(data.github_repositories.de_repos.names)
+
+  team_id    = github_team.de.id
+  repository = each.value
+  permission = "push"
+}
+
+
+#Backend
+resource "github_team" "backend" {
+  name = "Backend"
+  description = "Backend team"
+}
+
+resource "github_team_members" "backend_members" {
+  team_id  = github_team.backend.id
+
+  members {
+    username = "mulmuri"
+    role     = "maintainer"
+  }
+}
+
+data "github_repositories" "backend_repos" {
+  query = "topic:backend org:goboolean"
+}
+
+resource "github_team_repository" "backend_access" {
+  for_each = toset(data.github_repositories.backend_repos.names)
+
+  team_id    = github_team.backend.id
+  repository = each.value
+  permission = "push"
+}

projects/github/main.tf

@@ -38,9 +38,7 @@ module "github_secret" {
   registry_password = local.harbor_password
 }
 
-provider "github" {
-  owner = "goboolean"
-  token = local.github_token
+module "team" {
+  source = "../../modules/github/team"
+  depends_on = [module.repository]
 }
-
-

projects/github/provider.tf

@@ -3,21 +3,30 @@ provider "google" {
   region = var.region
 }
 
-data "google_secret_manager_secret_version" "vault_role_id" {
-  secret = "vault_role_id"
-}
+ephemeral "google_service_account_jwt" "vault_jwt" {
+  target_service_account = "atlantis@${var.project_id}.iam.gserviceaccount.com"
+
+  payload = jsonencode({
+    sub: "atlantis@${var.project_id}.iam.gserviceaccount.com",
+    aud: "vault/terraform",
+  })
 
-data "google_secret_manager_secret_version" "vault_secret_id" {
-  secret = "vault_secret_id"
+  expires_in = 1800
 }
 
 provider "vault" {
   address = "https://vault.goboolean.io"
+
   auth_login {
-    path = "auth/approle/login"
+    path = "auth/gcp/login"
     parameters = {
-      role_id   = data.google_secret_manager_secret_version.vault_role_id.secret_data
-      secret_id = data.google_secret_manager_secret_version.vault_secret_id.secret_data
+      jwt  = ephemeral.google_service_account_jwt.vault_jwt.jwt
+      role = "terraform"
     }
   }
 }
+
+provider "github" {
+  owner = "goboolean"
+  token = local.github_token
+}