Switch the project to manage the terraform state on S3. - #514
Switch the project to manage the terraform state on S3.#514tim-schilling wants to merge 10 commits into
Conversation
This moves the terraform state to a dynamo db stored on Tim's AWS account. This allows both the repos and members plans to make changes in the same PR without having to have a separate commit. There are instructions on how to migrate to the AWS configuration in the aws/README.md This also starts utilizing the 1Password team account by storing sensitive variables in there such as admin emails and the AWS account id.
Resolves conflicts from main's migration from the Terraform to the OpenTofu dflook actions: - Keep the OpenTofu actions (tofu-plan/tofu-apply) from main, with the AWS OIDC credential step and id-token permission from this branch. - Keep this branch's removal of the "Commit changes" step in both apply workflows: state now lives in S3, so there is nothing to commit back. With that step gone the apply jobs no longer need contents: write, and the checkout comment about the PAT/persist-credentials interaction no longer applies. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
The repository's workflows run OpenTofu (#522), so the manually-applied aws/ configuration and its docs should too. - README: tofu init/apply/import, and prose referring to OpenTofu. The local state migration steps now use `tofu init -migrate-state` so the migrated state is written by the same tool CI runs. - .terraform.lock.hcl: point at registry.opentofu.org, matching what `tofu init` did to the members/repositories lock files in ed55eea. The zh: hashes are unchanged (identical artifacts); tofu init backfills the additional per-platform h1: hashes on its next run. - backend.tf: link the OpenTofu S3 backend docs. - Descriptions and comments that mention Terraform where they mean the tool rather than a resource name. AWS-visible names (the state bucket, lock table, TerraformStateAccess permission set, and the inline policy names) are deliberately unchanged: renaming them would destroy and recreate live resources. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
|
OpenTofu plan for members Plan: 145 to add, 0 to change, 0 to destroy. Changes to Outputs.OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
OpenTofu will perform the following actions:
# github_membership.this["2ykwang"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "2ykwang"
}
# github_membership.this["Ashish8329"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Ashish8329"
}
# github_membership.this["Ceasar15"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Ceasar15"
}
# github_membership.this["Chiemezuo"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Chiemezuo"
}
# github_membership.this["Daksh777"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Daksh777"
}
# github_membership.this["DhavalGojiya"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "DhavalGojiya"
}
# github_membership.this["Dresdn"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Dresdn"
}
# github_membership.this["EliShteinman"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "EliShteinman"
}
# github_membership.this["Faakhir30"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Faakhir30"
}
# github_membership.this["FlipperPA"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "FlipperPA"
}
# github_membership.this["Freed-Wu"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Freed-Wu"
}
# github_membership.this["GaretJax"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "GaretJax"
}
# github_membership.this["Haroonhsa007"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Haroonhsa007"
}
# github_membership.this["Hopiu"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Hopiu"
}
# github_membership.this["Horlawhumy-dev"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Horlawhumy-dev"
}
# github_membership.this["Insaida"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Insaida"
}
# github_membership.this["JohananOppongAmoateng"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "JohananOppongAmoateng"
}
# github_membership.this["Josephchinedu"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Josephchinedu"
}
# github_membership.this["Knowledgex187"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Knowledgex187"
}
# github_membership.this["M97Chahboun"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "M97Chahboun"
}
# github_membership.this["Mogost"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Mogost"
}
# github_membership.this["MrCordeiro"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "MrCordeiro"
}
# github_membership.this["Nathan-Bransby-NMT"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Nathan-Bransby-NMT"
}
# github_membership.this["Natim"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Natim"
}
# github_membership.this["Ndungu9039"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Ndungu9039"
}
# github_membership.this["RealOrangeOne"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "RealOrangeOne"
}
# github_membership.this["SaeedRz96"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "SaeedRz96"
}
# github_membership.this["SamChawla"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "SamChawla"
}
# github_membership.this["Shrikantgiri25"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Shrikantgiri25"
}
# github_membership.this["SinkuKumar"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "SinkuKumar"
}
# github_membership.this["Stormheg"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "admin"
+ username = "Stormheg"
}
# github_membership.this["TildaDares"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "TildaDares"
}
# github_membership.this["TimothyMalahy"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "TimothyMalahy"
}
# github_membership.this["VeldaKiara"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "VeldaKiara"
}
# github_membership.this["Violette-Allotey"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Violette-Allotey"
}
# github_membership.this["Zakui"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "Zakui"
}
# github_membership.this["aayardev"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "aayardev"
}
# github_membership.this["adRn-s"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "adRn-s"
}
# github_membership.this["adamghill"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "adamghill"
}
# github_membership.this["akshayvinchurkar"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "akshayvinchurkar"
}
# github_membership.this["albertyw"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "albertyw"
}
# github_membership.this["aleksihakli"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "aleksihakli"
}
# github_membership.this["alex-dicko"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "alex-dicko"
}
# github_membership.this["amirreza-sf80"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "amirreza-sf80"
}
# github_membership.this["andoriyaprashant"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "andoriyaprashant"
}
# github_membership.this["asherf"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "asherf"
}
# github_membership.this["atanioyinbunua"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "atanioyinbunua"
}
# github_membership.this["ayimdomnic"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "ayimdomnic"
}
# github_membership.this["bahoo"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "bahoo"
}
# github_membership.this["bckohan"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "bckohan"
}
# github_membership.this["blingblin-g"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "blingblin-g"
}
# github_membership.this["browniebroke"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "browniebroke"
}
# github_membership.this["bryan-oginga"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "bryan-oginga"
}
# github_membership.this["camilonova"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "camilonova"
}
# github_membership.this["carltongibson"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "carltongibson"
}
# github_membership.this["cgl"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "cgl"
}
# github_membership.this["clintonb"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "clintonb"
}
# github_membership.this["codingjoe"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "codingjoe"
}
# github_membership.this["cunla"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "admin"
+ username = "cunla"
}
# github_membership.this["danmoz"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "danmoz"
}
# github_membership.this["ddabble"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "ddabble"
}
# github_membership.this["deronnax"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "deronnax"
}
# github_membership.this["devatbosch"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "devatbosch"
}
# github_membership.this["dgravitate"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "dgravitate"
}
# github_membership.this["dmpayton"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "dmpayton"
}
# github_membership.this["dr-rompecabezas"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "dr-rompecabezas"
}
# github_membership.this["elineda"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "elineda"
}
# github_membership.this["federicobond"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "federicobond"
}
# github_membership.this["fladi"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "fladi"
}
# github_membership.this["forwardyoung"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "forwardyoung"
}
# github_membership.this["fsbraun"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "fsbraun"
}
# github_membership.this["g-nie"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "g-nie"
}
# github_membership.this["gav-fyi"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "gav-fyi"
}
# github_membership.this["giovannicimolin"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "giovannicimolin"
}
# github_membership.this["input"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "input"
}
# github_membership.this["jacklinke"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jacklinke"
}
# github_membership.this["jburns6789"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jburns6789"
}
# github_membership.this["jcjudkins"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jcjudkins"
}
# github_membership.this["jezdez"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jezdez"
}
# github_membership.this["jmgutu"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jmgutu"
}
# github_membership.this["jnovinger"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "jnovinger"
}
# github_membership.this["johnatanmoran"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "johnatanmoran"
}
# github_membership.this["johnfraney"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "johnfraney"
}
# github_membership.this["joshuadavidthomas"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "joshuadavidthomas"
}
# github_membership.this["justbackend"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "justbackend"
}
# github_membership.this["justinmayer"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "justinmayer"
}
# github_membership.this["kevin-brown"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "kevin-brown"
}
# github_membership.this["knyghty"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "knyghty"
}
# github_membership.this["korfuri"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "korfuri"
}
# github_membership.this["kytta"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "kytta"
}
# github_membership.this["lander151"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "lander151"
}
# github_membership.this["leogregianin"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "leogregianin"
}
# github_membership.this["louzt"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "louzt"
}
# github_membership.this["luiscontrerasdo"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "luiscontrerasdo"
}
# github_membership.this["manelclos"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "manelclos"
}
# github_membership.this["marcosalvesdev"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "marcosalvesdev"
}
# github_membership.this["matthiask"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "matthiask"
}
# github_membership.this["mdehsan873"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mdehsan873"
}
# github_membership.this["mgrdcm"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mgrdcm"
}
# github_membership.this["mgstabrani"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mgstabrani"
}
# github_membership.this["mihrab34"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mihrab34"
}
# github_membership.this["mkalioby"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mkalioby"
}
# github_membership.this["mnislam01"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mnislam01"
}
# github_membership.this["mounirmesselmeni"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mounirmesselmeni"
}
# github_membership.this["mzemlickis"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "mzemlickis"
}
# github_membership.this["nanorepublica"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "nanorepublica"
}
# github_membership.this["niltonpimentel02"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "niltonpimentel02"
}
# github_membership.this["nwanduka"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "nwanduka"
}
# github_membership.this["okotdaniel"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "okotdaniel"
}
# github_membership.this["oliverandrich"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "oliverandrich"
}
# github_membership.this["ontowhee"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "ontowhee"
}
# github_membership.this["pauloxnet"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "pauloxnet"
}
# github_membership.this["peterthomassen"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "peterthomassen"
}
# github_membership.this["pfouque"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "pfouque"
}
# github_membership.this["priyapahwa"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "priyapahwa"
}
# github_membership.this["riconnon"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "riconnon"
}
# github_membership.this["rptmat57"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "rptmat57"
}
# github_membership.this["ryancheley"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "admin"
+ username = "ryancheley"
}
# github_membership.this["salty-ivy"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "salty-ivy"
}
# github_membership.this["sankarebarri"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "sankarebarri"
}
# github_membership.this["sergei-maertens"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "sergei-maertens"
}
# github_membership.this["sidmitra"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "sidmitra"
}
# github_membership.this["sobolevn"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "sobolevn"
}
# github_membership.this["spapas"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "spapas"
}
# github_membership.this["stereodamage"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "stereodamage"
}
# github_membership.this["sureshvv"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "sureshvv"
}
# github_membership.this["testSchilling"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "testSchilling"
}
# github_membership.this["thibaudcolas"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "thibaudcolas"
}
# github_membership.this["ticosax"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "ticosax"
}
# github_membership.this["tim-schilling"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "admin"
+ username = "tim-schilling"
}
# github_membership.this["tintayadev"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "tintayadev"
}
# github_membership.this["ulgens"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "ulgens"
}
# github_membership.this["unmonoqueteclea"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "unmonoqueteclea"
}
# github_membership.this["vacarme"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "vacarme"
}
# github_membership.this["vinlawz"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "vinlawz"
}
# github_membership.this["viscofuse"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "viscofuse"
}
# github_membership.this["whitebumblebee"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "whitebumblebee"
}
# github_membership.this["williln"] will be created
+ resource "github_membership" "this" {
+ downgrade_on_destroy = false
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ username = "williln"
}
# github_organization_role_team.admins_security_manager will be created
+ resource "github_organization_role_team" "admins_security_manager" {
+ id = (known after apply)
+ role_id = 138
+ team_slug = (known after apply)
}
# github_team.org_designers_team will be created
+ resource "github_team" "org_designers_team" {
+ create_default_maintainer = false
+ description = "Django Commons designers"
+ etag = (known after apply)
+ id = (known after apply)
+ members_count = (known after apply)
+ name = "Designers"
+ node_id = (known after apply)
+ parent_team_read_id = (known after apply)
+ parent_team_read_slug = (known after apply)
+ privacy = "closed"
+ slug = (known after apply)
}
# github_team.org_teams["Admins"] will be created
+ resource "github_team" "org_teams" {
+ create_default_maintainer = false
+ description = "Django Commons administrators. This team is responsible for the overall management of the organization."
+ etag = (known after apply)
+ id = (known after apply)
+ members_count = (known after apply)
+ name = "Admins"
+ node_id = (known after apply)
+ parent_team_read_id = (known after apply)
+ parent_team_read_slug = (known after apply)
+ privacy = "closed"
+ slug = (known after apply)
}
# github_team.org_teams["super-admins"] will be created
+ resource "github_team" "org_teams" {
+ create_default_maintainer = false
+ description = "Django Commons super administrators. This team is responsible for performing privileged operations."
+ etag = (known after apply)
+ id = (known after apply)
+ members_count = (known after apply)
+ name = "super-admins"
+ node_id = (known after apply)
+ parent_team_read_id = (known after apply)
+ parent_team_read_slug = (known after apply)
+ privacy = "closed"
+ slug = (known after apply)
}
# github_team_members.org_designers_team_members will be created
+ resource "github_team_members" "org_designers_team_members" {
+ id = (known after apply)
+ team_id = (known after apply)
+ members {
+ role = "member"
+ username = "Daksh777"
}
+ members {
+ role = "member"
+ username = "Knowledgex187"
}
+ members {
+ role = "member"
+ username = "Ndungu9039"
}
+ members {
+ role = "member"
+ username = "Shrikantgiri25"
}
+ members {
+ role = "member"
+ username = "Violette-Allotey"
}
+ members {
+ role = "member"
+ username = "Zakui"
}
+ members {
+ role = "member"
+ username = "akshayvinchurkar"
}
+ members {
+ role = "member"
+ username = "federicobond"
}
+ members {
+ role = "member"
+ username = "jmgutu"
}
+ members {
+ role = "member"
+ username = "johnatanmoran"
}
+ members {
+ role = "member"
+ username = "louzt"
}
+ members {
+ role = "member"
+ username = "mzemlickis"
}
+ members {
+ role = "member"
+ username = "nwanduka"
}
+ members {
+ role = "member"
+ username = "okotdaniel"
}
+ members {
+ role = "member"
+ username = "tintayadev"
}
+ members {
+ role = "member"
+ username = "vinlawz"
}
+ members {
+ role = "member"
+ username = "viscofuse"
}
}
# github_team_members.org_team_members["Admins"] will be created
Plan is too large to fit in a PR comment. See the full plan in the workflow log.📝 Plan generated in Plan org membership changes and list them in a PR #142 |
Resolves conflicts from main's migration from the Terraform to the OpenTofu dflook actions (#7), matching the resolution used on django-commons/membership#514: - Keep the OpenTofu actions (tofu-plan/tofu-apply) from main, with the AWS OIDC credential step and id-token permission from this branch. - Keep this branch's removal of the "Commit changes" step in both apply workflows: state now lives in S3, so there is nothing to commit back. With that step gone the apply jobs no longer need contents: write, and the checkout comment about the PAT/persist-credentials interaction no longer applies. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
The previous commit rewrote the lock file by hand, changing only the registry host and keeping the Terraform registry's checksums. That works for integrations/github, which OpenTofu mirrors from the same GitHub release artifacts, but not for hashicorp/aws: registry.opentofu.org serves its own repackaged, separately-signed builds, so every h1: and zh: hash differs and `tofu init` fails checksum verification. Regenerated with `tofu providers lock` (OpenTofu 1.12.6) for linux_amd64, linux_arm64, darwin_amd64 and darwin_arm64, so the file covers CI and both Intel and Apple Silicon laptops. Verified with `tofu init`, `tofu validate` and `tofu fmt -check`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012o5Q68D6xFJuenqb2jmGE5
|
@tim-schilling I updated to tofu also the aws stuff. I am getting errors:
Is IAM enabled in the AWS account? Do I ( |
This moves the terraform state to a dynamo db stored on Tim's AWS account. This allows both the repos and members plans to make changes in the same PR without having to have a separate commit. There are instructions on how to migrate to the AWS configuration in the aws/README.md
This also starts utilizing the 1Password team account by storing sensitive variables in there such as admin emails and the AWS account id.