Break terraform to modules

[cunla]

The goal is to make the GitHub workflows faster by separating to two modules

Separate moduiles

• members - manage org-memberships and org-teams
  • Update workflows to members-plan/members-apply
• repos - manage repositories, repo-teams, environments, etc.
  • Update workflows to repos-plan/repos-apply

Additional changes

• Update terraform gh-actions to the latest version (v2.2.2)
• Use labels in terraform gh-actions to support multiple PR comments.

Other notes

• The zizmor alert is outdated
• The suggested changes in the repos module relate to the fact org.tfvars is not used – instead, I am importing github_team.admins_team (which should probably be super_admins, but one thing at a time).

[cunla]

Terraform plan for members

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # github_team_members.org_designers_team_members will be updated in-place
!~  resource "github_team_members" "org_designers_team_members" {
        id      = "14084892"
#        (1 unchanged attribute hidden)

+       members {
+           role     = "member"
+           username = "GODSPE1"
        }

#        (12 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

✅ Plan applied in Apply org membership changes #1

Outputs

invalid_users = []

[cunla]

Terraform plan for repos

Plan: 0 to add, 14 to change, 0 to destroy. Changes to Outputs.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # github_repository_collaborators.this["axe-selenium-python"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "axe-selenium-python"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["best-practices"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "best-practices"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-click"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-click"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-cookie-consent"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-cookie-consent"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-debug-toolbar"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-debug-toolbar"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-enum"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-enum"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-fsm-2"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-fsm-2"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-prometheus"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-prometheus"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-simple-history"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-simple-history"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-tailwind-cli"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-tailwind-cli"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-tasks-scheduler"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-tasks-scheduler"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-typer"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-typer"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["django-valkey"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "django-valkey"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

  # github_repository_collaborators.this["drf-excel"] will be updated in-place
!~  resource "github_repository_collaborators" "this" {
        id             = "drf-excel"
#        (2 unchanged attributes hidden)

-       ignore_team {
-           team_id = "admins" -> null
        }
+       ignore_team {
+           team_id = "******"
        }

#        (3 unchanged blocks hidden)
    }

Plan: 0 to add, 14 to change, 0 to destroy.

Changes to Outputs:
-   invalid_users = [] -> null

📝 Plan generated in Plan org repositories changes and list them in a PR #25

[Copilot]

Pull request overview

This PR restructures the Terraform configuration by splitting it into two separate modules: members (for managing organization memberships) and repos (for managing repositories, teams, and environments). The changes include updating GitHub Actions workflows to support separate plan and apply operations for each module, updating to the latest Terraform GitHub Actions version (v2.2.2), and implementing label support for distinguishing multiple PR comments.

• Splits Terraform configuration into members and repos modules for better separation of concerns
• Updates all GitHub Actions workflows to use v2.2.2 with labels for multi-comment support
• Removes large tfstate.json file and configures separate state management per module

Reviewed changes

Copilot reviewed 16 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
terraform/tfstate.json	Removes the monolithic state file (to be replaced with per-module state files)
terraform/repos/variables.tf	Defines variables for repos module, removing member-related variables
terraform/repos/resources-repos.tf	Manages repository resources with import blocks
terraform/repos/resources-repo-teams.tf	Updates to use local admins from data source
terraform/repos/resources-repo-committer-teams.tf	Manages repository committer teams
terraform/repos/resources-repo-admin-teams.tf	Updates to use local admins from data source
terraform/repos/resources-environments.tf	Manages PyPI deployment environments
terraform/repos/resources-collaborators.tf	Updates to use data source for admins team
terraform/repos/main.tf	Provider and configuration setup for repos module
terraform/repos/locals.tf	Fetches admins team data and defines local values
terraform/repos/backend.tf	Configures local backend for repos module state
terraform/repos/README.md	Documentation for the repos module
terraform/members/variables.tf	Defines variables for members module
terraform/members/resources-org.tf	Manages organization memberships and teams
terraform/members/resources-designers.tf	Manages the designers team
terraform/members/main.tf	Provider and configuration setup for members module
terraform/members/locals.tf	Empty locals block for future use
terraform/members/backend.tf	Configures local backend for members module state
terraform/members/README.md	Documentation for the members module
terraform/production/org.tfvars	Removes unused organization_secrets variable
.github/workflows/repos-plan.yml	Workflow for planning repository changes
.github/workflows/repos-apply.yml	Workflow for applying repository changes
.github/workflows/members-plan.yml	Workflow for planning membership changes
.github/workflows/members-apply.yml	Workflow for applying membership changes

[ryancheley]

I'm not going to pretend like I understand all of what was done here, but based on what I do know about Terraform this looks good to me. Great work @cunla 💯!

[tim-schilling]

I left a few other small nitpicky comments, but this looks great! Switching to approved. Let me know if you want help with testing.

[tim-schilling]

@cunla I'm going to hold off on merging more of the new member PRs until you give me the go ahead. It seems like you're working on this and me merging those is going to cause issues.