feat: template repo support + bug fixes

modules/private_repository/README.md

@@ -37,6 +37,7 @@ No resources.
 | <a name="input_name"></a> [name](#input\_name) | The name of the repository to create/import. | `string` | n/a | yes |
 | <a name="input_protected_branches"></a> [protected\_branches](#input\_protected\_branches) | A list of ref names or patterns that should be protected. Defaults `["main"]` | `list(string)` | <pre>[<br>  "main"<br>]</pre> | no |
 | <a name="input_repository_team_permissions"></a> [repository\_team\_permissions](#input\_repository\_team\_permissions) | A map where the keys are github team slugs and the value is the permissions the team should have in the repository | `map(string)` | n/a | yes |
+| <a name="input_template_repository"></a> [template\_repository](#input\_template\_repository) | A list of template repositories to use for the repository | <pre>object({<br>    owner                = string<br>    repository           = string<br>    include_all_branches = bool<br>  })</pre> | `null` | no |
 | <a name="input_topics"></a> [topics](#input\_topics) | The topics to apply to the repository | `list(string)` | `[]` | no |
 
 ## Outputs

modules/private_repository/repository.tf

@@ -30,4 +30,6 @@ module "repository_base" {
   action_secrets     = var.action_secrets
 
   environments = var.environments
+
+  template_repository = var.template_repository
 }

modules/private_repository/variables.tf

@@ -86,4 +86,14 @@ variable "environments" {
     action_secrets = optional(map(string))
   }))
   default = {}
+}
+
+variable "template_repository" {
+  description = "A list of template repositories to use for the repository"
+  type        = object({
+    owner                = string
+    repository           = string
+    include_all_branches = bool
+  })
+  default = null
 }

modules/public_repository/README.md

@@ -37,6 +37,7 @@ No resources.
 | <a name="input_name"></a> [name](#input\_name) | The name of the repository to create/import. | `string` | n/a | yes |
 | <a name="input_protected_branches"></a> [protected\_branches](#input\_protected\_branches) | A list of ref names or patterns that should be protected. Defaults `["main"]` | `list(string)` | <pre>[<br>  "main"<br>]</pre> | no |
 | <a name="input_repository_team_permissions"></a> [repository\_team\_permissions](#input\_repository\_team\_permissions) | A map where the keys are github team slugs and the value is the permissions the team should have in the repository | `map(string)` | n/a | yes |
+| <a name="input_template_repository"></a> [template\_repository](#input\_template\_repository) | A list of template repositories to use for the repository | <pre>object({<br>    owner                = string<br>    repository           = string<br>    include_all_branches = bool<br>  })</pre> | `null` | no |
 | <a name="input_topics"></a> [topics](#input\_topics) | The topics to apply to the repository | `list(string)` | `[]` | no |
 
 ## Outputs

modules/public_repository/repository.tf

@@ -30,4 +30,6 @@ module "repository_base" {
   action_secrets     = var.action_secrets
 
   environments = var.environments
+
+  template_repository = var.template_repository
 }

modules/public_repository/variables.tf

@@ -86,4 +86,14 @@ variable "environments" {
     action_secrets = optional(map(string))
   }))
   default = {}
+}
+
+variable "template_repository" {
+  description = "A list of template repositories to use for the repository"
+  type        = object({
+    owner                = string
+    repository           = string
+    include_all_branches = bool
+  })
+  default = null
 }

modules/repository_base/README.md

@@ -56,6 +56,7 @@ No modules.
 | <a name="input_repository_team_permissions"></a> [repository\_team\_permissions](#input\_repository\_team\_permissions) | A map where the keys are github team slugs and the value is the permissions the team should have in the repository | `map(string)` | n/a | yes |
 | <a name="input_secret_scanning"></a> [secret\_scanning](#input\_secret\_scanning) | Enables secret scanning for the repository. If repository is private `advance_security` must also be enabled. | `bool` | `true` | no |
 | <a name="input_secret_scanning_on_push"></a> [secret\_scanning\_on\_push](#input\_secret\_scanning\_on\_push) | Enables secret scanning push protection for the repository. If repository is private `advance_security` must also be enabled. | `bool` | `true` | no |
+| <a name="input_template_repository"></a> [template\_repository](#input\_template\_repository) | A list of template repositories to use for the repository | <pre>object({<br>    owner                = string<br>    repository           = string<br>    include_all_branches = bool<br>  })</pre> | `null` | no |
 | <a name="input_topics"></a> [topics](#input\_topics) | The topics to apply to the repository | `list(string)` | `[]` | no |
 | <a name="input_visibility"></a> [visibility](#input\_visibility) | Sets the visibility property of a repository. Defaults to "private" | `string` | `"private"` | no |
 

modules/repository_base/environments.tf

@@ -1,5 +1,5 @@
 resource "github_repository_environment" "environemnt" {
-  for_each    = keys(var.environments)
+  for_each    = toset(keys(var.environments))
   repository  = github_repository.repository.name
   environment = each.value
 }

modules/repository_base/repository.tf

@@ -41,6 +41,17 @@ resource "github_repository" "repository" {
       }
     }
   }
+
+  # Use a template repo if one is specified
+  dynamic "template" {
+    for_each = var.template_repository == null ? [] : [1]
+    content {
+      owner                = var.template_repository.owner
+      repository           = var.template_repository.name
+      include_all_branches = var.template_repository.include_all_branches
+    }
+  }
+
 }
 
 resource "github_repository_dependabot_security_updates" "automated_security_fixes" {

modules/repository_base/secrets.tf

@@ -1,11 +1,11 @@
 locals {
-  environment_actions_secrets = concat(values({
+  environment_actions_secrets = try(concat(values({
     for env_name, env in var.environments : env_name => [for secret_name, secret in env.action_secrets : {
       name            = secret_name
       encrypted_value = secret
       environment     = env_name
-    }] if env.action_secrets != null
-  }))
+    }] if env.action_secrets != null 
+  })), [])
 }
 
 resource "github_actions_secret" "actions_secret" {

modules/repository_base/variables.tf

@@ -140,4 +140,14 @@ variable "environments" {
     action_secrets = optional(map(string))
   }))
   default = {}
+}
+
+variable "template_repository" {
+  description = "A list of template repositories to use for the repository"
+  type        = object({
+    owner                = string
+    repository           = string
+    include_all_branches = bool
+  })
+  default = null
 }

modules/repository_set/README.md

@@ -25,8 +25,8 @@ No resources.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_default_repository_team_permissions"></a> [default\_repository\_team\_permissions](#input\_default\_repository\_team\_permissions) | A map where the keys are github team slugs and the value is the permissions the team should have by default for every repository. If an entry exists in `repository_team_permissions_override` for a repository then that will take precedence over this default. | `map(string)` | n/a | yes |
-| <a name="input_private_repositories"></a> [private\_repositories](#input\_private\_repositories) | A map of private repositories where the key is the repository name and the value is the configuration | <pre>map(object({<br>    description                          = string<br>    default_branch                       = string<br>    repository_team_permissions_override = map(string)<br>    protected_branches                   = list(string)<br>    advance_security                     = bool<br>    has_vulnerability_alerts             = bool<br>    topics                               = list(string)<br>    homepage                             = string<br>    delete_head_on_merge                 = bool<br>    allow_auto_merge                     = bool<br>    dependabot_security_updates          = bool<br>    action_secrets                       = optional(map(string))<br>    codespace_secrets                    = optional(map(string))<br>    dependabot_secrets                   = optional(map(string))<br>    environemnts = optional(map(object({<br>      action_secrets = optional(map(string))<br>    })))<br>  }))</pre> | n/a | yes |
-| <a name="input_public_repositories"></a> [public\_repositories](#input\_public\_repositories) | A map of public repositories where the key is the repository name and the value is the configuration | <pre>map(object({<br>    description                          = string<br>    default_branch                       = string<br>    repository_team_permissions_override = map(string)<br>    protected_branches                   = list(string)<br>    advance_security                     = bool<br>    topics                               = list(string)<br>    homepage                             = string<br>    delete_head_on_merge                 = bool<br>    allow_auto_merge                     = bool<br>    dependabot_security_updates          = bool<br>    action_secrets                       = optional(map(string))<br>    codespace_secrets                    = optional(map(string))<br>    dependabot_secrets                   = optional(map(string))<br>    environemnts = optional(map(object({<br>      action_secrets = optional(map(string))<br>    })))<br>  }))</pre> | n/a | yes |
+| <a name="input_private_repositories"></a> [private\_repositories](#input\_private\_repositories) | A map of private repositories where the key is the repository name and the value is the configuration | <pre>map(object({<br>    description                          = string<br>    default_branch                       = string<br>    repository_team_permissions_override = map(string)<br>    protected_branches                   = list(string)<br>    advance_security                     = bool<br>    has_vulnerability_alerts             = bool<br>    topics                               = list(string)<br>    homepage                             = string<br>    delete_head_on_merge                 = bool<br>    allow_auto_merge                     = bool<br>    dependabot_security_updates          = bool<br>    action_secrets                       = optional(map(string))<br>    codespace_secrets                    = optional(map(string))<br>    dependabot_secrets                   = optional(map(string))<br>    environments                         = optional(map(object({<br>      action_secrets = optional(map(string))<br>    })))<br>    template_repository                  = optional(object({<br>      owner                = string<br>      repository           = string<br>      include_all_branches = bool<br>    }))<br>  }))</pre> | n/a | yes |
+| <a name="input_public_repositories"></a> [public\_repositories](#input\_public\_repositories) | A map of public repositories where the key is the repository name and the value is the configuration | <pre>map(object({<br>    description                          = string<br>    default_branch                       = string<br>    repository_team_permissions_override = map(string)<br>    protected_branches                   = list(string)<br>    advance_security                     = bool<br>    topics                               = list(string)<br>    homepage                             = string<br>    delete_head_on_merge                 = bool<br>    allow_auto_merge                     = bool<br>    dependabot_security_updates          = bool<br>    action_secrets                       = optional(map(string))<br>    codespace_secrets                    = optional(map(string))<br>    dependabot_secrets                   = optional(map(string))<br>    environments                         = optional(map(object({<br>      action_secrets = optional(map(string))<br>    })))<br>    template_repository                  = optional(object({<br>      owner                = string<br>      repository           = string<br>      include_all_branches = bool<br>    }))<br>  }))</pre> | n/a | yes |
 
 ## Outputs
 

modules/repository_set/repositories.tf

@@ -18,6 +18,7 @@ module "public_repositories" {
   codespace_secrets           = each.value.codespace_secrets
   dependabot_secrets          = each.value.dependabot_secrets
   environments                = each.value.environments
+  template_repository         = each.value.template_repository
 }
 
 module "private_repositories" {
@@ -40,4 +41,5 @@ module "private_repositories" {
   codespace_secrets           = each.value.codespace_secrets
   dependabot_secrets          = each.value.dependabot_secrets
   environments                = each.value.environments
+  template_repository         = each.value.template_repository
 }

modules/repository_set/variables.tf

@@ -14,9 +14,14 @@ variable "private_repositories" {
     action_secrets                       = optional(map(string))
     codespace_secrets                    = optional(map(string))
     dependabot_secrets                   = optional(map(string))
-    environemnts = optional(map(object({
+    environments                         = optional(map(object({
       action_secrets = optional(map(string))
     })))
+    template_repository                  = optional(object({
+      owner                = string
+      repository           = string
+      include_all_branches = bool
+    }))
   }))
   description = "A map of private repositories where the key is the repository name and the value is the configuration"
 }
@@ -36,9 +41,14 @@ variable "public_repositories" {
     action_secrets                       = optional(map(string))
     codespace_secrets                    = optional(map(string))
     dependabot_secrets                   = optional(map(string))
-    environemnts = optional(map(object({
+    environments                         = optional(map(object({
       action_secrets = optional(map(string))
     })))
+    template_repository                  = optional(object({
+      owner                = string
+      repository           = string
+      include_all_branches = bool
+    }))
   }))
   description = "A map of public repositories where the key is the repository name and the value is the configuration"
 }