diff --git a/examples/github-gcloud-oidc/main.tf b/examples/github-gcloud-oidc/main.tf new file mode 100644 index 0000000..2e9be49 --- /dev/null +++ b/examples/github-gcloud-oidc/main.tf @@ -0,0 +1,17 @@ +module "gcp_oidc_setup" { + source = "../../modules/github-gcloud-oidc" + + organization_id = "123456789012" + folder_create = false + id = "123456789012" + project_name = "my-oidc-project" + billing_account = "ABCDEF-123456-ABCDEF" + auto_create_network = false + labels = { "team" = "devops" } + services = ["cloudresourcemanager.googleapis.com", "iam.googleapis.com", "storage.googleapis.com"] + bucket_name = "my-terraform-state-bucket" + location = "europe-west3" + storage_class = "STANDARD" + uniform_bucket_level_access = true + github_foundations_organization_name = "my-github-org" +} diff --git a/examples/organization/main.tf b/examples/organization/main.tf new file mode 100644 index 0000000..a2b98aa --- /dev/null +++ b/examples/organization/main.tf @@ -0,0 +1,27 @@ +module "organization" { + source = "../../modules/organization" + + github_organization_id = "FociSolutions" + github_organization_billing_email = "org-billing@focisolutions.com" + github_organization_email = "info@focisolutions.com" + github_organization_blog = "https://www.focisolutions.com/articles/" + github_organization_location = "Ottawa" + + github_organization_blocked_users = [] + github_organization_enable_ghas = false + github_organization_enable_dependabot_alerts = true + github_organization_enable_dependabot_updates = true + github_organization_enable_dependancy_graph = true + github_organization_enable_secret_scanning = true + github_organization_enable_secret_scanning_push_protection = true + github_organization_requires_web_commit_signing = true + github_organization_repository_settings = { + members_can_create_public = true, + members_can_create_internal = true, + members_can_create_private = true + } + + github_organization_members = ["blastdan"] + + custom_repository_roles = {} +} diff --git a/examples/repository/README.md b/examples/repository/README.md new file mode 100644 index 0000000..442e3c6 --- /dev/null +++ b/examples/repository/README.md @@ -0,0 +1,7 @@ + +#### Overview +This Terraform module creates a private GitHub repository with configurable options such as branch protection rules, team permissions, topics, homepage URL, auto-merge settings, security updates, and more. It allows for detailed customization of repository settings, including action, codespace, and dependabot secrets, as well as defining environments and applying license templates. + +#### Notes +- Customize the variable values to fit your specific requirements. +- For secrets (`action_secrets`, `codespace_secrets`, `dependabot_secrets`), ensure the values are encrypted using the GH CLI as explained [here](https://github.com/FociSolutions/github-foundations/blob/main/docs/gh-secrets.md). \ No newline at end of file diff --git a/examples/repository/private.tf b/examples/repository/private.tf new file mode 100644 index 0000000..671112d --- /dev/null +++ b/examples/repository/private.tf @@ -0,0 +1,46 @@ +module "github_repository_example" { + source = "../../modules/private_repository" + + name = "example-repository" + description = "This is an example repository created using Terraform." + homepage = "https://example.com" + topics = ["terraform", "automation", "github"] + + repository_team_permissions = { + "devs" = "push", + "ops" = "admin" + } + + default_branch = "main" + protected_branches = ["main", "develop"] + delete_head_on_merge = true + allow_auto_merge = true + + dependabot_security_updates = true + advance_security = true + + action_secrets = { + "GH_TOKEN" = "*****" + } + + codespace_secrets = { + "CODESPACE_DB" = "*****" + } + + dependabot_secrets = { + "NPM_TOKEN" = "*****" + } + + environments = { + "staging" = { + action_secrets = { + "STAGE_API_KEY" = "*****" + } + } + } + + template_repository = null + license_template = "mit" + + rulesets = {} +} diff --git a/examples/repository/public.tf b/examples/repository/public.tf new file mode 100644 index 0000000..3f987b7 --- /dev/null +++ b/examples/repository/public.tf @@ -0,0 +1,41 @@ +module "public_github_repository" { + source = "../../modules/public_repository" + + name = "example-public-repo" + description = "An example public GitHub repository created with Terraform." + default_branch = "main" + repository_team_permissions = { + "dev-team" = "push", + "ops-team" = "admin" + } + protected_branches = ["main"] + topics = ["terraform", "public", "example"] + homepage = "https://example.com" + delete_head_on_merge = true + allow_auto_merge = true + dependabot_security_updates = true + advance_security = true + action_secrets = { + "SECRET_KEY" = "encrypted_value" + } + codespace_secrets = { + "DATABASE_URL" = "encrypted_value" + } + dependabot_secrets = { + "NPM_TOKEN" = "encrypted_value" + } + environments = { + "production" = { + action_secrets = { + "AWS_ACCESS_KEY_ID" = "encrypted_value", + "AWS_SECRET_ACCESS_KEY" = "encrypted_value" + } + } + } + template_repository = { + owner = "example-org", + repository = "template-repo", + include_all_branches = false + } + license_template = "mit" +} diff --git a/examples/ruleset/organization-ruleset.tf b/examples/ruleset/organization-ruleset.tf new file mode 100644 index 0000000..1d24a5b --- /dev/null +++ b/examples/ruleset/organization-ruleset.tf @@ -0,0 +1,26 @@ +module "github_org_ruleset" { + source = "../../modules/ruleset" + + name = "org-wide-main-pr-rules" + bypass_actors = { + organization_admins = [ + { user_id = "admin_id", always_bypass = true } + ] + } + rules = { + branch_name_pattern = { + operator = "equals", + pattern = "main", + name = "Main Branch Protection", + negate = false + }, + pull_request = { + dismiss_stale_reviews_on_push = true, + require_code_owner_review = true, + required_approving_review_count = 1 + } + } + target = "branch" + ruleset_type = "organization" + enforcement = "active" +} diff --git a/examples/ruleset/repository-ruleset.tf b/examples/ruleset/repository-ruleset.tf new file mode 100644 index 0000000..a9ac852 --- /dev/null +++ b/examples/ruleset/repository-ruleset.tf @@ -0,0 +1,49 @@ +module "github_repo_ruleset" { + source = "../../modules/ruleset" + + name = "repo-specific-ruleset" + bypass_actors = { + repository_roles = [ + { role_id = "maintainer_id", always_bypass = true } + ], + teams = [ + { team_id = "team_id", always_bypass = false } + ] + } + rules = { + branch_name_pattern = { + operator = "equals", + pattern = "release/*", + negate = false + }, + commit_message_pattern = { + operator = "matches", + pattern = "^(feat|fix|chore|docs|style|refactor|perf|test):\\s.+", + negate = false + }, + pull_request = { + dismiss_stale_reviews_on_push = true, + require_code_owner_review = true, + required_approving_review_count = 2, + required_review_thread_resolution = true + }, + required_status_checks = { + required_check = [ + { context = "ci/build", integration_id = 12345 } + ], + strict_required_status_check_policy = true + } + } + ref_name_inclusions = ["release/*", "main"] + repository_name_inclusions = ["my-target-repo"] # This field is ignored in repository-specific rulesets but included for clarity. + conditions = { + ref_name = { + include = ["release/*", "main"], + exclude = [] + } + } + target = "branch" + ruleset_type = "repository" + enforcement = "active" + repository = "my-target-repo" +} diff --git a/examples/team/README.md b/examples/team/README.md new file mode 100644 index 0000000..7c228b0 --- /dev/null +++ b/examples/team/README.md @@ -0,0 +1,2 @@ +### Overview +This Terraform module allows for the creation and configuration of a GitHub team within an organization. It supports setting the team's name, privacy level, description, and specifying maintainers and members. Additionally, the module can handle nesting teams by specifying a parent team ID. \ No newline at end of file diff --git a/examples/team/main.tf b/examples/team/main.tf new file mode 100644 index 0000000..75d686a --- /dev/null +++ b/examples/team/main.tf @@ -0,0 +1,10 @@ +module "example_github_team" { + source = "../../modules/team" + + team_name = "devops-team" + privacy = "closed" + team_description = "Responsible for CI/CD pipelines and infrastructure." + team_maintainers = ["alice", "bob"] + team_members = ["carol", "dave"] + parent_id = "123456789" # Optional: Include this only if you're creating a nested team. +}