Breaak terraform to modules

[cunla]

The goal is to make the GitHub workflows faster by separating to two modules

Separate moduiles

• members - manage org-memberships and org-teams
  • Update workflows to members-plan/members-apply
• repos - manage repositories, repo-teams, environments, etc.
  • Update workflows to repos-plan/repos-apply

Additional changes

• Update terraform gh-actions to the latest version (v2.2.2)
• Use labels in terraform gh-actions to support multiple PR comments.

Other notes

• The zizmor alert is outdated
• The suggested changes in the repos module relate to the fact org.tfvars is not used – instead, I am importing github_team.admins_team (which should probably be super_admins, but one thing at a time).

[cunla]

Terraform plan for members

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in Plan org membership changes and list them in a PR #10

[cunla]

Terraform plan for repos

Plan: 0 to add, 14 to change, 0 to destroy. Changes to Outputs.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # github_repository_collaborators.this["axe-selenium-python"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "axe-selenium-python"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["best-practices"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "best-practices"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-click"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-click"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-cookie-consent"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-cookie-consent"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-debug-toolbar"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-debug-toolbar"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-enum"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-enum"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-fsm-2"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-fsm-2"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-prometheus"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-prometheus"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-simple-history"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-simple-history"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-tailwind-cli"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-tailwind-cli"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-tasks-scheduler"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-tasks-scheduler"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-typer"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-typer"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-valkey"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-valkey"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["drf-excel"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "drf-excel"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

Plan: 0 to add, 14 to change, 0 to destroy.

Changes to Outputs:
-   invalid_users = [] -> null

📝 Plan generated in Plan org-repositories changes and list them in a PR #10

[Copilot]

Pull request overview

This PR restructures the Terraform configuration by splitting it into two separate modules: members (for managing organization memberships) and repos (for managing repositories, teams, and environments). The changes include updating GitHub Actions workflows to support separate plan and apply operations for each module, updating to the latest Terraform GitHub Actions version (v2.2.2), and implementing label support for distinguishing multiple PR comments.

• Splits Terraform configuration into members and repos modules for better separation of concerns
• Updates all GitHub Actions workflows to use v2.2.2 with labels for multi-comment support
• Removes large tfstate.json file and configures separate state management per module

Reviewed changes

Copilot reviewed 16 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
terraform/tfstate.json	Removes the monolithic state file (to be replaced with per-module state files)
terraform/repos/variables.tf	Defines variables for repos module, removing member-related variables
terraform/repos/resources-repos.tf	Manages repository resources with import blocks
terraform/repos/resources-repo-teams.tf	Updates to use local admins from data source
terraform/repos/resources-repo-committer-teams.tf	Manages repository committer teams
terraform/repos/resources-repo-admin-teams.tf	Updates to use local admins from data source
terraform/repos/resources-environments.tf	Manages PyPI deployment environments
terraform/repos/resources-collaborators.tf	Updates to use data source for admins team
terraform/repos/main.tf	Provider and configuration setup for repos module
terraform/repos/locals.tf	Fetches admins team data and defines local values
terraform/repos/backend.tf	Configures local backend for repos module state
terraform/repos/README.md	Documentation for the repos module
terraform/members/variables.tf	Defines variables for members module
terraform/members/resources-org.tf	Manages organization memberships and teams
terraform/members/resources-designers.tf	Manages the designers team
terraform/members/main.tf	Provider and configuration setup for members module
terraform/members/locals.tf	Empty locals block for future use
terraform/members/backend.tf	Configures local backend for members module state
terraform/members/README.md	Documentation for the members module
terraform/production/org.tfvars	Removes unused organization_secrets variable
.github/workflows/repos-plan.yml	Workflow for planning repository changes
.github/workflows/repos-apply.yml	Workflow for applying repository changes
.github/workflows/members-plan.yml	Workflow for planning membership changes
.github/workflows/members-apply.yml	Workflow for applying membership changes

[Copilot]

There is an unnecessary blank line at the end of the backend configuration block. Remove the blank line before the closing brace to maintain consistent formatting.

Suggested change

[cunla]

Love that it recommended it for repos but not for members :D