feat: manage infra IAM repository

src/tf/modules/repository/main.tf

@@ -13,7 +13,7 @@ resource "github_repository" "this" {
   allow_merge_commit  = false
   allow_squash_merge  = true
   allow_rebase_merge  = true
-  allow_auto_merge    = true
+  allow_auto_merge    = var.allow_auto_merge
   allow_update_branch = true
 
   squash_merge_commit_title   = "PR_TITLE"
@@ -31,6 +31,8 @@ resource "github_team_repository" "this" {
 }
 
 resource "github_repository_ruleset" "main" {
+  count = var.enable_ruleset ? 1 : 0
+
   # Keep approval enforcement in place until the review-only ruleset exists.
   depends_on = [github_repository_ruleset.required_reviews]
 
@@ -88,7 +90,7 @@ resource "github_repository_ruleset" "main" {
 }
 
 resource "github_repository_ruleset" "required_reviews" {
-  count = length(var.review_exempt_integrations) == 0 ? 0 : 1
+  count = var.enable_ruleset && length(var.review_exempt_integrations) > 0 ? 1 : 0
 
   name        = "Require pull request reviews"
   repository  = github_repository.this.name

src/tf/modules/repository/outputs.tf

@@ -5,5 +5,5 @@ output "name" {
 
 output "ruleset_id" {
   description = "Main branch ruleset ID"
-  value       = github_repository_ruleset.main.id
+  value       = one(github_repository_ruleset.main[*].id)
 }

src/tf/modules/repository/variables.tf

@@ -69,6 +69,18 @@ variable "ruleset_enforcement" {
   }
 }
 
+variable "enable_ruleset" {
+  description = "Whether to manage a main branch ruleset"
+  type        = bool
+  default     = true
+}
+
+variable "allow_auto_merge" {
+  description = "Whether to allow pull requests to merge automatically"
+  type        = bool
+  default     = true
+}
+
 variable "teams" {
   description = "Teams with access to the repository"
   type = list(object({

src/tf/repositories.tf

@@ -21,6 +21,13 @@ locals {
     infra-gh = {
       required_check = "Terraform checks"
     }
+    infra-iam = {
+      allow_auto_merge = false
+      description      = "Manages SGF Devs human identities and access assignments."
+      enable_ruleset   = false
+      required_check   = "Terraform checks"
+      visibility       = "private"
+    }
     infra-k8s-apps = {
       required_check             = "checks / Kubernetes checks"
       review_exempt_integrations = [local.deployment_automation_app_id]
@@ -36,8 +43,12 @@ module "infrastructure_repository" {
 
   source = "./modules/repository"
 
-  name   = each.key
-  topics = ["infra"]
+  name             = each.key
+  description      = try(each.value.description, null)
+  visibility       = try(each.value.visibility, "public")
+  topics           = ["infra"]
+  allow_auto_merge = try(each.value.allow_auto_merge, true)
+  enable_ruleset   = try(each.value.enable_ruleset, true)
   required_checks = [{
     context        = each.value.required_check
     integration_id = local.github_actions_integration_id