feat: Initial commit

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+- package-ecosystem: terraform
+  directory: "/"
+  schedule:
+    interval: weekly
+  commit-message:
+    prefix: "fix(deps):"
+    prefix-development: "chore(deps):"

.github/workflows/ci.yml

@@ -0,0 +1,12 @@
+name: CI and releases
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  ci:
+    uses: relaycorp/shared-workflows/.github/workflows/tfmodule-ci.yml@main
+  release:
+    needs: ci
+    uses: relaycorp/shared-workflows/.github/workflows/tfmodule-release.yml@main

.github/workflows/prs.yml

@@ -0,0 +1,12 @@
+name: Process PRs
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  pr-ci:
+    uses: relaycorp/shared-workflows/.github/workflows/pr-ci.yml@main

.gitignore

@@ -0,0 +1 @@
+.terraform

.releaserc.yml

@@ -0,0 +1,5 @@
+branches: [main]
+plugins:
+  - "@semantic-release/commit-analyzer"
+  - "@semantic-release/release-notes-generator"
+  - "@semantic-release/github"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021-2024 Relaycorp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,2 +1,14 @@
-# terraform-github-closed-source
-Terraform module for closed source projects by Relaycorp
+# Terraform module for closed source projects by Relaycorp
+
+This module is used by the Relaycorp team to manage their closed source projects.
+
+See also the [open source project module](https://github.com/relaycorp/terraform-github-oss-project).
+
+## Third-party contributions
+
+Since this module is meant to be 100% specific to Relaycorp,
+we will only accept bug fixes from third parties.
+New features won't be accepted.
+If you see anything you like here,
+feel free to use it under the terms of the [licence](https://github.com/relaycorp/terraform-github-oss-project/blob/main/LICENSE).
+Backwards compatibility isn't guaranteed.

locals.tf

@@ -0,0 +1,4 @@
+locals {
+  // Work around https://github.com/integrations/terraform-provider-github/issues/1009
+  github_actions_app_node_id = "MDM6QXBwMTUzNjg=" // https://api.github.com/apps/github-actions
+}

main.tf

@@ -0,0 +1,55 @@
+resource "github_repository" "main" {
+  name         = var.name
+  description  = var.description
+  homepage_url = var.homepage_url
+  visibility   = "private"
+
+  // PR merging
+  allow_merge_commit          = false
+  allow_rebase_merge          = false
+  squash_merge_commit_title   = "PR_TITLE"
+  squash_merge_commit_message = "PR_BODY"
+  allow_auto_merge            = true
+  delete_branch_on_merge      = true
+
+  has_issues      = false
+  has_discussions = false
+  has_downloads   = false
+  auto_init       = true
+
+  vulnerability_alerts = true
+
+  lifecycle {
+    // Prevent imported repos from being recreated
+    ignore_changes = [auto_init]
+  }
+}
+
+resource "github_branch_protection" "main" {
+  repository_id = github_repository.main.node_id
+  pattern       = "main"
+
+  required_linear_history         = true
+  require_conversation_resolution = true
+
+  required_status_checks {
+    strict = true
+    contexts = concat(
+      var.support_releases ? ["pr-ci / semantic-pr-title", "release / release"] : [],
+      var.ci_contexts,
+      ["license/cla"]
+    )
+  }
+
+  required_pull_request_reviews {
+    dismiss_stale_reviews           = true
+    required_approving_review_count = 1
+  }
+
+  restrict_pushes {
+    blocks_creations = true
+    push_allowances = [
+      local.github_actions_app_node_id, # Allow @semantic-release/github to create GH releases
+    ]
+  }
+}

outputs.tf

@@ -0,0 +1,3 @@
+output "name" {
+  value = var.name
+}

providers.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = ">= 6.0.0, < 7.0.0"
+    }
+  }
+
+  required_version = ">= 1.5.0"
+}

variables.tf

@@ -0,0 +1,20 @@
+variable "name" {
+  description = "GitHub project name"
+}
+variable "description" {
+  description = "GitHub project description"
+}
+variable "homepage_url" {
+  default     = ""
+  description = "GitHub project homepage"
+}
+variable "ci_contexts" {
+  default     = []
+  type        = list(string)
+  description = "Required CI contexts for PRs to merged in the main branch"
+}
+
+variable "support_releases" {
+  default     = true
+  description = "Whether the project uses Semantic Releases"
+}