From d977f6c6d65df73a2f93126106bc81bda4a21036 Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:11:16 -0500
Subject: [PATCH 1/7] chore: handle nested actions permissions

---
 github/johnko/import.sh          | 23 +++++++++++++---------
 github/johnko/locals-defaults.tf | 33 +++++++++++++++++++++++++++++++-
 github/johnko/locals.tf          | 12 ++++++++++++
 github/johnko/repos-active.tf    | 13 +++++++++++++
 4 files changed, 71 insertions(+), 10 deletions(-)

diff --git a/github/johnko/import.sh b/github/johnko/import.sh
index 5bb5013..fd19dba 100644
--- a/github/johnko/import.sh
+++ b/github/johnko/import.sh
@@ -4,14 +4,19 @@ set -euxo pipefail
 $IAC_BIN state show 'github_repository.archived["deploy"]' ||
   $IAC_BIN import 'github_repository.archived["deploy"]' deploy
 
-$IAC_BIN state show 'github_repository.active["homedir"]' ||
-  $IAC_BIN import 'github_repository.active["homedir"]' homedir
+ACTIVE_REPOS="
+homedir
+iac-github
+lab
+renovate-config
+"
 
-$IAC_BIN state show 'github_repository.active["iac-github"]' ||
-  $IAC_BIN import 'github_repository.active["iac-github"]' iac-github
+for i in $ACTIVE_REPOS ; do
+$IAC_BIN state show "github_repository.active[\"$i\"]" ||
+  $IAC_BIN import "github_repository.active[\"$i\"]" $i
+done
 
-$IAC_BIN state show 'github_repository.active["lab"]' ||
-  $IAC_BIN import 'github_repository.active["lab"]' lab
-
-$IAC_BIN state show 'github_repository.active["renovate-config"]' ||
-  $IAC_BIN import 'github_repository.active["renovate-config"]' renovate-config
+for i in $ACTIVE_REPOS ; do
+$IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
+  $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" $i
+done
diff --git a/github/johnko/locals-defaults.tf b/github/johnko/locals-defaults.tf
index 479121f..d93ae20 100644
--- a/github/johnko/locals-defaults.tf
+++ b/github/johnko/locals-defaults.tf
@@ -36,9 +36,40 @@ locals {
     }
 
     allow_update_branch = true
+
+    actions = {
+      enabled         = false
+      allowed_actions = "selected"
+      allowed_actions_config = {
+        github_owned_allowed = true
+        patterns_allowed = [
+          "hashicorp/setup-terraform@*",
+          "johnko/*",
+          "opentofu/setup-opentofu@*",
+          "renovatebot/github-action@*",
+        ]
+        verified_allowed = false
+      }
+    }
   }
 
-  all_repos_settings = { for k, v in local.repos : k => merge(local.default_repo_settings, v) }
+  all_repos_settings = { for k, v in local.repos :
+    k => merge(
+      local.default_repo_settings,
+      v,
+      contains(keys(v), "security_and_analysis")
+      ? { "security_and_analysis" : merge(
+        local.default_repo_settings.security_and_analysis,
+        v.security_and_analysis
+      ) }
+      : { "security_and_analysis" : local.default_repo_settings.security_and_analysis },
+      contains(keys(v), "actions")
+      ? { "actions" : merge(
+        local.default_repo_settings.actions,
+        v.actions
+      ) }
+      : { "actions" : local.default_repo_settings.actions }
+  ) }
   active_repos_settings = { for k, v in local.all_repos_settings : k => v
     if v.archived == false
   }
diff --git a/github/johnko/locals.tf b/github/johnko/locals.tf
index 2a69699..88e53f7 100644
--- a/github/johnko/locals.tf
+++ b/github/johnko/locals.tf
@@ -7,18 +7,30 @@ locals {
       has_projects = true
     }
     homedir = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     iac-github = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     lab = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     renovate-config = {
+      actions = {
+        enabled = true
+      }
       description = "RenovateBot config"
       has_issues  = true
       visibility  = "public"
diff --git a/github/johnko/repos-active.tf b/github/johnko/repos-active.tf
index 27ae452..807ac6d 100644
--- a/github/johnko/repos-active.tf
+++ b/github/johnko/repos-active.tf
@@ -58,3 +58,16 @@ resource "github_repository" "active" {
     ]
   }
 }
+
+resource "github_actions_repository_permissions" "active" {
+  for_each = local.active_repos_settings
+
+  repository      = github_repository.active[each.key].name
+  allowed_actions = each.value.actions.allowed_actions
+  enabled         = each.value.actions.enabled
+  allowed_actions_config {
+    github_owned_allowed = each.value.actions.allowed_actions_config.github_owned_allowed
+    patterns_allowed     = each.value.actions.allowed_actions_config.patterns_allowed
+    verified_allowed     = each.value.actions.allowed_actions_config.verified_allowed
+  }
+}

From 2b7d287f252db8019246ed0a1450c06a7abfd21f Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:12:13 -0500
Subject: [PATCH 2/7] fix SC2086

---
 github/johnko/import.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/github/johnko/import.sh b/github/johnko/import.sh
index fd19dba..c5b29ac 100644
--- a/github/johnko/import.sh
+++ b/github/johnko/import.sh
@@ -13,10 +13,10 @@ renovate-config
 
 for i in $ACTIVE_REPOS ; do
 $IAC_BIN state show "github_repository.active[\"$i\"]" ||
-  $IAC_BIN import "github_repository.active[\"$i\"]" $i
+  $IAC_BIN import "github_repository.active[\"$i\"]" "$i"
 done
 
 for i in $ACTIVE_REPOS ; do
 $IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
-  $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" $i
+  $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" "$i"
 done

From c67ef3bb2494b6b138146143ccd580f9271e1aa0 Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:13:18 -0500
Subject: [PATCH 3/7] shfmt

---
 github/johnko/import.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/github/johnko/import.sh b/github/johnko/import.sh
index c5b29ac..6faff42 100644
--- a/github/johnko/import.sh
+++ b/github/johnko/import.sh
@@ -11,12 +11,12 @@ lab
 renovate-config
 "
 
-for i in $ACTIVE_REPOS ; do
-$IAC_BIN state show "github_repository.active[\"$i\"]" ||
-  $IAC_BIN import "github_repository.active[\"$i\"]" "$i"
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_repository.active[\"$i\"]" ||
+    $IAC_BIN import "github_repository.active[\"$i\"]" "$i"
 done
 
-for i in $ACTIVE_REPOS ; do
-$IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
-  $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" "$i"
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
+    $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" "$i"
 done

From 19a83441b69bd451c4b1b1040e1590d70843d7ac Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:22:04 -0500
Subject: [PATCH 4/7] .

---
 .github/pre-commit.sh | 0
 setup.sh              | 9 +++++++++
 2 files changed, 9 insertions(+)
 create mode 100644 .github/pre-commit.sh
 create mode 100755 setup.sh

diff --git a/.github/pre-commit.sh b/.github/pre-commit.sh
new file mode 100644
index 0000000..e69de29
diff --git a/setup.sh b/setup.sh
new file mode 100755
index 0000000..41a59bb
--- /dev/null
+++ b/setup.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname $0)
+pushd "$SCRIPT_DIR"
+
+if [[ -e .github/pre-commit.sh ]]; then
+  install -m 700 .github/pre-commit.sh .git/hooks/pre-commit
+fi

From 17b92f051815b9f1304723a6d302f8223d487819 Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:31:23 -0500
Subject: [PATCH 5/7] add pre-commit.sh

---
 .github/pre-commit.sh | 34 ++++++++++++++++++++++++++++++++++
 setup.sh              |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/pre-commit.sh b/.github/pre-commit.sh
index e69de29..612642a 100644
--- a/.github/pre-commit.sh
+++ b/.github/pre-commit.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -uxo pipefail
+
+ANY_ERROR=false
+if type tofu &>/dev/null; then
+  bash -ex .github/opentofu-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/opentofu-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+if type terraform &>/dev/null; then
+  bash -ex .github/terraform-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/terraform-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+if type shellcheck &>/dev/null; then
+  bash -ex .github/shellcheck.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+if type shfmt &>/dev/null; then
+  bash -ex .github/shfmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if [[ "true" == "$ANY_ERROR" ]]; then
+  exit 1
+fi
diff --git a/setup.sh b/setup.sh
index 41a59bb..ca7860b 100755
--- a/setup.sh
+++ b/setup.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-SCRIPT_DIR=$(dirname $0)
+SCRIPT_DIR=$(dirname "$0")
 pushd "$SCRIPT_DIR"
 
 if [[ -e .github/pre-commit.sh ]]; then

From f380db515d669672355d3ec9c8b8a5a9c5312db7 Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:32:21 -0500
Subject: [PATCH 6/7] .

---
 .github/pre-commit.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/pre-commit.sh b/.github/pre-commit.sh
index 612642a..6b6c2e9 100644
--- a/.github/pre-commit.sh
+++ b/.github/pre-commit.sh
@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
-set -uxo pipefail
+set -euxo pipefail
 
 ANY_ERROR=false
+
+set +e
+
 if type tofu &>/dev/null; then
   bash -ex .github/opentofu-fmt.sh
   # shellcheck disable=SC2181
@@ -10,6 +13,7 @@ if type tofu &>/dev/null; then
   # shellcheck disable=SC2181
   [[ $? -ne 0 ]] && ANY_ERROR=true
 fi
+
 if type terraform &>/dev/null; then
   bash -ex .github/terraform-fmt.sh
   # shellcheck disable=SC2181
@@ -18,17 +22,21 @@ if type terraform &>/dev/null; then
   # shellcheck disable=SC2181
   [[ $? -ne 0 ]] && ANY_ERROR=true
 fi
+
 if type shellcheck &>/dev/null; then
   bash -ex .github/shellcheck.sh
   # shellcheck disable=SC2181
   [[ $? -ne 0 ]] && ANY_ERROR=true
 fi
+
 if type shfmt &>/dev/null; then
   bash -ex .github/shfmt.sh
   # shellcheck disable=SC2181
   [[ $? -ne 0 ]] && ANY_ERROR=true
 fi
 
+set -e
+
 if [[ "true" == "$ANY_ERROR" ]]; then
   exit 1
 fi

From 81a37b57b5c24016501c3308a14dcc842bbee946 Mon Sep 17 00:00:00 2001
From: johnko <279736+johnko@users.noreply.github.com>
Date: Thu, 6 Nov 2025 08:37:13 -0500
Subject: [PATCH 7/7] README

---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index ee5e89c..d528838 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,10 @@
 # iac-github
 
 ```
+# install pre-commit hook, to reduce some github actions cost
+./setup.sh
+
+# format terraform workspace files
 ./tf.sh github/johnko fmt
 
 ./tf.sh github/johnko validate
@@ -9,5 +13,6 @@
 
 ./tf.sh github/johnko apply
 
+# DANGER: this is an apply -auto-approve, no chance to review plan or cancel
 ./tf.sh github/johnko auto
 ```