feat: allow auto-merge on kustomize-cluster for chart pin PRs - #47
Merged
Conversation
Enable GitHub auto-merge on kustomize-cluster so the charts post-publish workflow can flag its generated opencode-server pin pull request for automatic squash merge once the required `test` check passes. Other repositories keep auto-merge disabled. Update the chart updater runbook for the auto-merge behavior and record that this root owns repository merge settings, including the auto-merge allowlist.
Contributor
OpenTofu TestOpenTofu test passed. View run output |
The auto-merge change accidentally normalized four SOPS data key references to match their map keys (onion/www access key entries point at *_aws_* keys in secrets.yaml). Restore the original references; the only intended main.tf change is the auto-merge repository list.
Summary
Enables GitHub auto-merge on
kustomize-clusterso the charts post-publish workflow can flag its generatedopencode-serverpin PR for automatic squash merge once the requiredtestcheck passes.main.tf: newlocal.auto_merge_github_repositoriesallowlist containing onlykustomize-cluster, with a comment explaining the intent.gh-repositories.tf:allow_auto_merge = contains(local.auto_merge_github_repositories, each.key)— every other managed repository keeps auto-merge disabled (explicitfalse, previously unset/default).docs/chart-updater-github-app.md: runbook updated for the auto-merge behavior; ownership table now records that this root owns repository merge settings including the auto-merge allowlist; "Add a new destination repository" now asks whether the destination belongs in the auto-merge list.Expected plan
One attribute change on
github_repository.repositories["kustomize-cluster"](allow_auto_merge: false → true). No new resources, no protection changes, no secret rotation. Branch protections (required checktest, PR required, zero approvals) are unchanged and remain the merge gate — auto-merge does not bypass them.Rollout order
This must merge and complete the environment-gated apply before the companion charts PR (auto-merge enable step) is exercised by a real chart release. If a release lands before the apply, the updater job fails at the enable step after publication; the chart artifact stays valid and the pin PR remains open for manual merge — no broken state.
Companion PR: charts (auto-merge enable step in
update-opencode-gitops).