Skip to content

feat: wire Dependabot PR alerting via managed caller workflow - #15

Merged
xnoto merged 1 commit into
mainfrom
feat/dependabot-alerts
Aug 24, 2026
Merged

feat: wire Dependabot PR alerting via managed caller workflow#15
xnoto merged 1 commit into
mainfrom
feat/dependabot-alerts

Conversation

@xnoto

@xnoto xnoto commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Note

Stacked on #14 — merge that first; this PR retargets to main automatically.

What

Last leg of the Dependabot PR alerting pipeline:

  1. gh-dependabot.tf now also manages .github/workflows/dependabot-notify.yml in every active repo — a thin caller that invokes shared-workflows/.github/workflows/dependabot-notify.yml only when github.actor == 'dependabot[bot]'.
  2. Secrets distribution (main.tf):
    • CLOUDFLARE_AUTH_CLIENT_ID / CLOUDFLARE_AUTH_CLIENT_SECRET extended from 3 repos to all active repos (new active_github_repositories local — archived repos reject secret writes).
    • GRAFANA_ALERTS_TOKEN added with a documented placeholder. The real value is the operator-generated token from kustomize-cluster#54; copy it into secrets/secrets.yaml as grafana_alerts_token after that PR syncs: 
      kubectl --context k3s -n grafana get secret grafana-alerts-token -o jsonpath='{.data.token}' | base64 -d
  3. AGENTS.md: new Dependabot PR Alerting section documenting the pipeline and the placeholder.

Merge order (full pipeline)

  1. shared-workflows#14 (reusable workflow)
  2. kustomize-cluster#54 (Discord contact point, policy, service account)
  3. tfroot-cloudflare#20 (Access app)
  4. tfroot-github feat: manage Dependabot configs centrally and document branch protection posture #14 → this PR

On apply: 11 caller workflow files + secret updates land across the org. Until the token is copied into SOPS and re-applied, the notify job fails loudly with a 401 — by design, visible in Actions logs.

Validation

  • make test — all hooks pass (validate, tflint, checkov, fmt, terraform_docs, gitleaks).
  • Caller YAML verified: no HCL interpolation hazards (jobs.if needs no ${{ }} wrapper), actionlint-clean in the shared repo.

Base automatically changed from feat/managed-dependabot to main August 24, 2026 14:14
@xnoto
feat: wire dependabot pr alerting via managed caller workflow
e4fc5d7 
- gh-dependabot.tf also manages .github/workflows/dependabot-notify.yml
  in every active repo, calling the shared-workflows reusable workflow
  only when the pull_request actor is dependabot[bot]
- distribute CLOUDFLARE_AUTH_CLIENT_* to all active repos (new
  active_github_repositories local; archived repos cannot receive
  secrets)
- add GRAFANA_ALERTS_TOKEN with a documented placeholder until the
  operator-generated token is copied from the cluster secret
@xnoto
xnoto force-pushed the feat/dependabot-alerts branch from 3db1073 to e4fc5d7 Compare August 24, 2026 14:19
@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown

OpenTofu Plan

OpenTofu will perform the following actions:

  # github_actions_secret.secrets[".github_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = ".github"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets[".github_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = ".github"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets[".github_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = ".github"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["cflan_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "cflan"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["cflan_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "cflan"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["cflan_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "cflan"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["images_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "images"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["kustomize-cluster_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "kustomize-cluster"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["shared-workflows_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "shared-workflows"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["shared-workflows_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "shared-workflows"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["shared-workflows_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "shared-workflows"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["terraform-libvirt-domain_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "terraform-libvirt-domain"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["terraform-libvirt-domain_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "terraform-libvirt-domain"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["terraform-libvirt-domain_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "terraform-libvirt-domain"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-aws_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-aws"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-aws_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-aws"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-aws_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-aws"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-cloudflare_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-cloudflare"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-cloudflare_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-cloudflare"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-cloudflare_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-cloudflare"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-github_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-github"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-libvirt_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-libvirt"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-libvirt_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-libvirt"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["tfroot-libvirt_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-libvirt"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["www_CLOUDFLARE_AUTH_CLIENT_ID"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "www"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_ID"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["www_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "www"
      + repository_id     = (known after apply)
      + secret_name       = "CLOUDFLARE_AUTH_CLIENT_SECRET"
      + updated_at        = (known after apply)
    }

  # github_actions_secret.secrets["www_GRAFANA_ALERTS_TOKEN"] will be created
  + resource "github_actions_secret" "secrets" {
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "www"
      + repository_id     = (known after apply)
      + secret_name       = "GRAFANA_ALERTS_TOKEN"
      + updated_at        = (known after apply)
    }

  # github_branch_protection.protections[".github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOPDNmL84EC8t_"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["cflan"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOOulWjM4EPi_e"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["images"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsexys4EPi_f"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["kustomize-cluster"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsxTyc4EPi_g"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["shared-workflows"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsfaHs4EPi_h"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["terraform-libvirt-domain"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXn984EPi_i"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-aws"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXn6c4EPi_j"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-cloudflare"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoEM4EPi_k"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoMs4EPi_l"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-libvirt"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoKM4EPi_n"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["www"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOOuKZAc4EPi_o"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_repository_file.dependabot_notify[".github"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = ".github"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["cflan"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "cflan"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["images"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "images"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["kustomize-cluster"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "kustomize-cluster"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["shared-workflows"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "shared-workflows"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["terraform-libvirt-domain"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "terraform-libvirt-domain"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-aws"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-aws"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-cloudflare"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-cloudflare"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-github"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-github"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["tfroot-libvirt"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "tfroot-libvirt"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

  # github_repository_file.dependabot_notify["www"] will be created
  + resource "github_repository_file" "dependabot_notify" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = (known after apply)
      + commit_message               = "chore: sync managed dependabot notification workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
                uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
                secrets: inherit
        EOT
      + file                         = ".github/workflows/dependabot-notify.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "www"
      + repository_id                = (known after apply)
      + sha                          = (known after apply)
    }

Plan: 38 to add, 11 to change, 0 to destroy.

@xnoto
xnoto merged commit 5d20878 into main Aug 24, 2026
4 checks passed
@xnoto
xnoto deleted the feat/dependabot-alerts branch August 24, 2026 14:21
@xnoto xnoto mentioned this pull request Aug 24, 2026
Merged
xnoto added a commit that referenced this pull request Aug 24, 2026
@xnoto
chore: add Grafana alerts service account token (#16)
42dea73 
## What

Adds `grafana_alerts_token` to the SOPS secrets — the operator-generated
token minted by the `GrafanaServiceAccount` CR (kustomize-cluster#54),
retrieved from the cluster and written via `sops set`. Replaces the
placeholder distributed by #15.

On apply, `GRAFANA_ALERTS_TOKEN` becomes functional in all 11 active
repos and the Dependabot PR alerting pipeline goes end-to-end:

Dependabot PR → caller workflow → shared-workflows reusable workflow →
Cloudflare Access app → Grafana Alertmanager → Discord.

## Validation

- Token value handled entirely in subprocesses (kubectl → shell → sops
set); never exposed in logs or this PR.
- SOPS key existence verified post-write; `make test` hooks pass at
commit.
- Cluster-side objects confirmed synced: `grafanacontactpoint/discord`,
`grafananotificationpolicy/root-discord`,
`grafanaserviceaccount/github-actions-alerts`,
`secret/grafana-alerts-token`, `secret/discord-webhook`.

## After merge

End-to-end test: `@dependabot recreate` on cflan#9 → expect a Discord
message within a minute of the reopened PR.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@xnoto