chore: handle nested actions permissions

.github/pre-commit.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+ANY_ERROR=false
+
+set +e
+
+if type tofu &>/dev/null; then
+  bash -ex .github/opentofu-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/opentofu-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type terraform &>/dev/null; then
+  bash -ex .github/terraform-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/terraform-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shellcheck &>/dev/null; then
+  bash -ex .github/shellcheck.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shfmt &>/dev/null; then
+  bash -ex .github/shfmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+set -e
+
+if [[ "true" == "$ANY_ERROR" ]]; then
+  exit 1
+fi

README.md

@@ -1,6 +1,10 @@
 # iac-github
 
 ```
+# install pre-commit hook, to reduce some github actions cost
+./setup.sh
+
+# format terraform workspace files
 ./tf.sh github/johnko fmt
 
 ./tf.sh github/johnko validate
@@ -9,5 +13,6 @@
 
 ./tf.sh github/johnko apply
 
+# DANGER: this is an apply -auto-approve, no chance to review plan or cancel
 ./tf.sh github/johnko auto
 ```

github/johnko/import.sh

@@ -4,14 +4,19 @@ set -euxo pipefail
 $IAC_BIN state show 'github_repository.archived["deploy"]' ||
   $IAC_BIN import 'github_repository.archived["deploy"]' deploy
 
-$IAC_BIN state show 'github_repository.active["homedir"]' ||
-  $IAC_BIN import 'github_repository.active["homedir"]' homedir
+ACTIVE_REPOS="
+homedir
+iac-github
+lab
+renovate-config
+"
 
-$IAC_BIN state show 'github_repository.active["iac-github"]' ||
-  $IAC_BIN import 'github_repository.active["iac-github"]' iac-github
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_repository.active[\"$i\"]" ||
+    $IAC_BIN import "github_repository.active[\"$i\"]" "$i"
+done
 
-$IAC_BIN state show 'github_repository.active["lab"]' ||
-  $IAC_BIN import 'github_repository.active["lab"]' lab
-
-$IAC_BIN state show 'github_repository.active["renovate-config"]' ||
-  $IAC_BIN import 'github_repository.active["renovate-config"]' renovate-config
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
+    $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" "$i"
+done

github/johnko/locals-defaults.tf

@@ -36,9 +36,40 @@ locals {
     }
 
     allow_update_branch = true
+
+    actions = {
+      enabled         = false
+      allowed_actions = "selected"
+      allowed_actions_config = {
+        github_owned_allowed = true
+        patterns_allowed = [
+          "hashicorp/setup-terraform@*",
+          "johnko/*",
+          "opentofu/setup-opentofu@*",
+          "renovatebot/github-action@*",
+        ]
+        verified_allowed = false
+      }
+    }
   }
 
-  all_repos_settings = { for k, v in local.repos : k => merge(local.default_repo_settings, v) }
+  all_repos_settings = { for k, v in local.repos :
+    k => merge(
+      local.default_repo_settings,
+      v,
+      contains(keys(v), "security_and_analysis")
+      ? { "security_and_analysis" : merge(
+        local.default_repo_settings.security_and_analysis,
+        v.security_and_analysis
+      ) }
+      : { "security_and_analysis" : local.default_repo_settings.security_and_analysis },
+      contains(keys(v), "actions")
+      ? { "actions" : merge(
+        local.default_repo_settings.actions,
+        v.actions
+      ) }
+      : { "actions" : local.default_repo_settings.actions }
+  ) }
   active_repos_settings = { for k, v in local.all_repos_settings : k => v
     if v.archived == false
   }

github/johnko/locals.tf

@@ -7,18 +7,30 @@ locals {
       has_projects = true
     }
     homedir = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     iac-github = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     lab = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     renovate-config = {
+      actions = {
+        enabled = true
+      }
       description = "RenovateBot config"
       has_issues  = true
       visibility  = "public"

github/johnko/repos-active.tf

@@ -58,3 +58,16 @@ resource "github_repository" "active" {
     ]
   }
 }
+
+resource "github_actions_repository_permissions" "active" {
+  for_each = local.active_repos_settings
+
+  repository      = github_repository.active[each.key].name
+  allowed_actions = each.value.actions.allowed_actions
+  enabled         = each.value.actions.enabled
+  allowed_actions_config {
+    github_owned_allowed = each.value.actions.allowed_actions_config.github_owned_allowed
+    patterns_allowed     = each.value.actions.allowed_actions_config.patterns_allowed
+    verified_allowed     = each.value.actions.allowed_actions_config.verified_allowed
+  }
+}

setup.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname "$0")
+pushd "$SCRIPT_DIR"
+
+if [[ -e .github/pre-commit.sh ]]; then
+  install -m 700 .github/pre-commit.sh .git/hooks/pre-commit
+fi