-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathvariables.tf
More file actions
153 lines (131 loc) · 6.04 KB
/
Copy pathvariables.tf
File metadata and controls
153 lines (131 loc) · 6.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
# ---------------------------------------------------------------------------
# tf_mod_github_codespaces — variables
#
# Aggregation module for GitHub Codespaces secrets across three secret-bearing
# scopes (repository, organization, user) plus the selected-repository allow-list
# that pairs with `selected`-visibility organization secrets. Four role-named
# collections, each a map(object) keyed on a stable, caller-supplied handle
# (never a list index): repository_secrets (repo), organization_secrets (org),
# secret_repository_access (allow), user_secrets (user). Every collection
# defaults to {} so a caller enables only the scopes it uses.
#
# The three secret-bearing collections (repository_secrets, organization_secrets,
# user_secrets) are marked sensitive = true because they carry plaintext/encrypted
# secret values. Auth and the target org (owner / GITHUB_OWNER) are provider
# concerns and are NOT module variables.
#
# NOTE: Codespaces must be ENABLED for the organization (and billing configured)
# before org/repo Codespaces secrets can be created. Org-scoped Codespaces secrets
# additionally require a GitHub Team or Enterprise Cloud plan. Many regulated orgs
# disable Codespaces entirely — confirm Codespaces is part of the org footprint
# before adopting this module.
# ---------------------------------------------------------------------------
variable "repository_secrets" {
description = <<EOT
Repository-scoped Codespaces secrets, keyed by a stable caller handle.
Marked sensitive — it carries secret values. Supply exactly one of
`plaintext_value` or `encrypted_value` per secret; prefer `encrypted_value`
(pre-encrypted with the repository Codespaces public key). Secret values are
write-only (no remote drift detection); changing `repository` or `secret_name`
forces replacement.
map(object({
repository = string # repo name that owns the secret (ForceNew)
secret_name = string # Codespaces secret name (ForceNew)
plaintext_value = optional(string) # plaintext value (provider encrypts) — sensitive
encrypted_value = optional(string) # pre-encrypted Base64 value (preferred) — sensitive
}))
EOT
type = map(object({
repository = string
secret_name = string
plaintext_value = optional(string)
encrypted_value = optional(string)
}))
default = {}
sensitive = true
}
variable "organization_secrets" {
description = <<EOT
Organization-scoped Codespaces secrets, keyed by a stable caller handle.
Marked sensitive — it carries secret values. Supply exactly one of
`plaintext_value` or `encrypted_value` per secret; prefer `encrypted_value`.
`visibility` controls which repositories can read the secret:
- "all" — every repository in the org (incl. public)
- "private" — all private/internal repositories (secure default)
- "selected" — only repositories named in an allow-list
For `selected` visibility, own the allow-list in exactly ONE place: either inline
via `selected_repository_ids` here, OR via the `secret_repository_access`
variable — never both for the same secret.
Org Codespaces secrets require a GitHub Team or Enterprise Cloud plan and an
org-owner identity. Secret values are write-only (no remote drift detection).
map(object({
secret_name = string # org secret name (ForceNew)
visibility = optional(string, "private") # all | private | selected
plaintext_value = optional(string) # plaintext value — sensitive
encrypted_value = optional(string) # pre-encrypted Base64 value (preferred) — sensitive
selected_repository_ids = optional(list(number), []) # numeric repo ids when visibility = "selected"
}))
EOT
type = map(object({
secret_name = string
visibility = optional(string, "private")
plaintext_value = optional(string)
encrypted_value = optional(string)
selected_repository_ids = optional(list(number), [])
}))
default = {}
sensitive = true
validation {
# nonsensitive() strips the sensitive mark so the condition yields a plain
# bool; only the non-secret `visibility` field is inspected.
condition = alltrue([
for k, v in nonsensitive(var.organization_secrets): contains(["all", "private", "selected"], v.visibility)
])
error_message = "Each organization_secrets 'visibility' must be one of 'all', 'private', or 'selected'."
}
}
variable "secret_repository_access" {
description = <<EOT
Selected-repository allow-lists for `selected`-visibility organization Codespaces
secrets, keyed by a stable caller handle. Use this when the allow-list is managed
separately from the secret definition; do not also set inline
`selected_repository_ids` on the same secret in `organization_secrets`.
Contains no secret material, so it is not marked sensitive. The named org secret
must already exist (or be defined in `organization_secrets`) with
`visibility = "selected"`.
map(object({
secret_name = string # name of an existing org Codespaces secret (visibility = "selected")
selected_repository_ids = list(number) # numeric repo ids granted access
}))
EOT
type = map(object({
secret_name = string
selected_repository_ids = list(number)
}))
default = {}
}
variable "user_secrets" {
description = <<EOT
User-scoped Codespaces secrets for the authenticated user, keyed by a stable
caller handle. Marked sensitive — it carries secret values. Supply exactly one
of `plaintext_value` or `encrypted_value` per secret; prefer `encrypted_value`
(pre-encrypted with the user Codespaces public key). Secret values are write-only
(no remote drift detection).
`selected_repository_ids` lists the repositories (by numeric id) that may read the
secret inside the user's Codespaces; leave empty to grant no repositories.
map(object({
secret_name = string # user secret name (ForceNew)
plaintext_value = optional(string) # plaintext value — sensitive
encrypted_value = optional(string) # pre-encrypted Base64 value (preferred) — sensitive
selected_repository_ids = optional(list(number), []) # numeric repo ids granted access to the secret
}))
EOT
type = map(object({
secret_name = string
plaintext_value = optional(string)
encrypted_value = optional(string)
selected_repository_ids = optional(list(number), [])
}))
default = {}
sensitive = true
}