chore: drop unused Grafana token; rotate CF service token secret by xnoto · Pull Request #17 · makeitworkcloud/tfroot-github

xnoto · 2026-08-24T22:06:25Z

What

secrets.yaml: carries the rotated cloudflare_auth_client_secret. The GitHub Actions service token had expired 2026-06-03 (1-year duration, never successfully used) — diagnosed via Cloudflare API (last_seen_at: null), rotated, and duration set to forever. This unblocks every Cloudflare Access machine-auth consumer, including the Dependabot alert path.
main.tf: drops grafana_alerts_token from the secrets map — unused after the Alertmanager pivot (Grafana 12 cannot ingest external alerts into the embedded AM).
AGENTS.md / gh-dependabot.tf: docs updated for the Alertmanager delivery target.
README regenerated.

On apply: GRAFANA_ALERTS_TOKEN is deleted from all repos and CLOUDFLARE_AUTH_CLIENT_SECRET is updated org-wide.

Validation

make test clean. Token values handled in-subprocess only (kubectl/sops set), never exposed.

Merge order

Last, after shared-workflows#15, kustomize-cluster#55, tfroot-cloudflare#21.

- grafana_alerts_token removed from the secrets map (the Grafana service-account path was abandoned for the cluster Alertmanager) - secrets.yaml carries the rotated cloudflare_auth_client_secret: the GitHub Actions service token expired 2026-06-03 and was rotated via the Cloudflare API with duration set to forever - docs updated for the Alertmanager delivery target

tfroot-github manages .github/workflows/dependabot-notify.yml in every active repository, shared-workflows included. Pointing callers at a reusable hosted at that same path guaranteed it would be overwritten by the caller content on every apply (observed: the 2026-08-24 sync replaced the reusable with the caller, breaking dependabot-notify at startup with zero jobs on tfroot-github#16). The reusable now lives at _dependabot-notify.yml in shared-workflows; callers stay managed everywhere.

github-actions · 2026-08-25T12:21:55Z

OpenTofu Plan

OpenTofu will perform the following actions:

  # github_actions_secret.secrets[".github_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = ".github:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets[".github_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key [".github_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:09 +0000 UTC" -> null
      - id                = ".github:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:15 +0000 UTC" -> null
      - repository        = ".github" -> null
      - repository_id     = 1010001455 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:15 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["cflan_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "cflan:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["cflan_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["cflan_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:11 +0000 UTC" -> null
      - id                = "cflan:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:14 +0000 UTC" -> null
      - repository        = "cflan" -> null
      - repository_id     = 988370572 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:14 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["images_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "images:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["images_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["images_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:50 +0000 UTC" -> null
      - id                = "images:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:37:18 +0000 UTC" -> null
      - repository        = "images" -> null
      - repository_id     = 1120383434 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:37:18 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["kustomize-cluster_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "kustomize-cluster:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["kustomize-cluster_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["kustomize-cluster_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:27 +0000 UTC" -> null
      - id                = "kustomize-cluster:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:41 +0000 UTC" -> null
      - repository        = "kustomize-cluster" -> null
      - repository_id     = 1120687049 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:41 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["shared-workflows_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "shared-workflows:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["shared-workflows_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["shared-workflows_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:23:30 +0000 UTC" -> null
      - id                = "shared-workflows:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:16 +0000 UTC" -> null
      - repository        = "shared-workflows" -> null
      - repository_id     = 1120393758 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:16 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["terraform-libvirt-domain_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "terraform-libvirt-domain:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["terraform-libvirt-domain_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["terraform-libvirt-domain_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:54 +0000 UTC" -> null
      - id                = "terraform-libvirt-domain:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:12 +0000 UTC" -> null
      - repository        = "terraform-libvirt-domain" -> null
      - repository_id     = 1120266231 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:12 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["tfroot-aws_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "tfroot-aws:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["tfroot-aws_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["tfroot-aws_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:48 +0000 UTC" -> null
      - id                = "tfroot-aws:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:43 +0000 UTC" -> null
      - repository        = "tfroot-aws" -> null
      - repository_id     = 1120266217 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:43 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["tfroot-cloudflare_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "tfroot-cloudflare:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["tfroot-cloudflare_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["tfroot-cloudflare_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:37 +0000 UTC" -> null
      - id                = "tfroot-cloudflare:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:44 +0000 UTC" -> null
      - repository        = "tfroot-cloudflare" -> null
      - repository_id     = 1120266256 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:44 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["tfroot-github_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "tfroot-github:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["tfroot-github_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["tfroot-github_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:31 +0000 UTC" -> null
      - id                = "tfroot-github:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:38 +0000 UTC" -> null
      - repository        = "tfroot-github" -> null
      - repository_id     = 1120266290 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:38 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["tfroot-libvirt_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "tfroot-libvirt:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["tfroot-libvirt_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["tfroot-libvirt_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:52 +0000 UTC" -> null
      - id                = "tfroot-libvirt:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:17 +0000 UTC" -> null
      - repository        = "tfroot-libvirt" -> null
      - repository_id     = 1120266280 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:17 +0000 UTC" -> null
    }

  # github_actions_secret.secrets["www_CLOUDFLARE_AUTH_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secrets" {
        id                = "www:CLOUDFLARE_AUTH_CLIENT_SECRET"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

  # github_actions_secret.secrets["www_GRAFANA_ALERTS_TOKEN"] will be destroyed
  # (because key ["www_GRAFANA_ALERTS_TOKEN"] is not in for_each map)
  - resource "github_actions_secret" "secrets" {
      - created_at        = "2026-08-24 14:25:34 +0000 UTC" -> null
      - id                = "www:GRAFANA_ALERTS_TOKEN" -> null
      - key_id            = "3380204578043523366" -> null
      - plaintext_value   = (sensitive value) -> null
      - remote_updated_at = "2026-08-24 15:36:19 +0000 UTC" -> null
      - repository        = "www" -> null
      - repository_id     = 987928833 -> null
      - secret_name       = "GRAFANA_ALERTS_TOKEN" -> null
      - updated_at        = "2026-08-24 15:36:19 +0000 UTC" -> null
    }

  # github_branch_protection.protections[".github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOPDNmL84EC8t_"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["cflan"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOOulWjM4EPi_e"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["images"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsexys4EPi_f"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["kustomize-cluster"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsxTyc4EPi_g"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["shared-workflows"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsfaHs4EPi_h"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["terraform-libvirt-domain"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXn984EPi_i"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-aws"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXn6c4EPi_j"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-cloudflare"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoEM4EPi_k"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-github"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoMs4EPi_l"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["tfroot-libvirt"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsXoKM4EPi_n"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_branch_protection.protections["www"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOOuKZAc4EPi_o"
        # (10 unchanged attributes hidden)

      ~ required_pull_request_reviews {
          ~ dismissal_restrictions          = [
              + "makeitworkcloud/admins",
            ]
          ~ pull_request_bypassers          = [
              + "makeitworkcloud/admins",
            ]
            # (5 unchanged attributes hidden)
        }

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "makeitworkcloud/admins",
            ]
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # github_repository_file.dependabot_notify[".github"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = ".github:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["cflan"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "cflan:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["images"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "images:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["kustomize-cluster"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "kustomize-cluster:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["shared-workflows"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "shared-workflows:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["terraform-libvirt-domain"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "terraform-libvirt-domain:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["tfroot-aws"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "tfroot-aws:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["tfroot-cloudflare"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "tfroot-cloudflare:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["tfroot-github"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "tfroot-github:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["tfroot-libvirt"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "tfroot-libvirt:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

  # github_repository_file.dependabot_notify["www"] will be updated in-place
  ~ resource "github_repository_file" "dependabot_notify" {
      ~ content             = <<-EOT
            ---
            # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
            name: dependabot-notify
            
            on:
              pull_request:
                types: [opened, reopened]
            
            permissions: {}
            
            jobs:
              notify:
                if: github.actor == 'dependabot[bot]'
          -     uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
          +     uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
                secrets: inherit
        EOT
        id                  = "www:.github/workflows/dependabot-notify.yml:main"
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 33 to change, 11 to destroy.

xnoto added 2 commits August 25, 2026 06:11

xnoto force-pushed the chore/drop-grafana-alerts-token branch from 6e4e2c9 to 8da6185 Compare August 25, 2026 12:20

xnoto merged commit 9bf1230 into main Aug 25, 2026
3 checks passed

xnoto deleted the chore/drop-grafana-alerts-token branch August 25, 2026 15:26

Navigation Menu

Uh oh!

chore: drop unused Grafana token; rotate CF service token secret - #17

chore: drop unused Grafana token; rotate CF service token secret#17
xnoto merged 2 commits into
mainfrom
chore/drop-grafana-alerts-token

xnoto commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

xnoto commented Aug 24, 2026

What

Validation

Merge order

Uh oh!

github-actions Bot commented Aug 25, 2026

OpenTofu Plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant