fix: allow chart updater App through protected merge

[xnoto]

Summary

• resolve the makeitworkbot GitHub App through the provider-supported github_app data source
• add that App's node ID to kustomize-cluster's restrict_pushes.push_allowances
• preserve the required pull request, strict test check, zero-approval policy, admin-team allowance, linear history, and force-push prohibition

Root cause

The first real auto-merge release created kustomize-cluster#120 and passed its required test check, but charts run 33336120370 failed while enabling auto-merge:

User is not authorized for this protected branch (enablePullRequestAutoMerge)

allow_auto_merge was already applied successfully. The remaining restriction is github_branch_protection.protections["kustomize-cluster"].restrict_pushes, which currently allows only the organization admins team.

The updater App installation and token permissions are independently proven: the same run created the branch, commit, and pull request using Contents and Pull requests write permissions.

Safety and scope

• The App allowance applies only to kustomize-cluster.
• A push allowance does not bypass the pull-request or required-status-check rules; it lets GitHub complete an otherwise eligible auto-merge.
• No pull-request bypasser or force-push bypasser is added.
• No App installation, secret, encrypted file, workflow, repository setting, or other repository protection changes.

Expected plan

• Read data.github_app.chart_updater for slug makeitworkbot.
• Update only github_branch_protection.protections["kustomize-cluster"] in place by adding one App node ID to restrict_pushes.push_allowances.
• Preserve every other repository's branch protection unchanged.

PR CI plan is authoritative. No local init, validation, plan, apply, import, state, or secret operation was run from the shared server. The agent-knowledge discovery revision used was 299e833e2b9817c56f6cbd27e4bc2fe156e83a45.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # github_branch_protection.protections["kustomize-cluster"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsxTyc4EPi_g"
        # (10 unchanged attributes hidden)

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "A_kwHOC6ciJM4ASGn_",
                # (1 unchanged element hidden)
            ]
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # github_branch_protection.protections["kustomize-cluster"] will be updated in-place
  ~ resource "github_branch_protection" "protections" {
        id                              = "BPR_kwDOQsxTyc4EPi_g"
        # (10 unchanged attributes hidden)

      ~ restrict_pushes {
          ~ push_allowances  = [
              + "A_kwHOC6ciJM4ASGn_",
                # (1 unchanged element hidden)
            ]
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.