Skip to content
This repository was archived by the owner on May 16, 2026. It is now read-only.

Add service-repo module for aws-service-infrahouse-app#274

Merged
akuzminsky merged 3 commits into
mainfrom
service-repo
May 5, 2026
Merged

Add service-repo module for aws-service-infrahouse-app#274
akuzminsky merged 3 commits into
mainfrom
service-repo

Conversation

@akuzminsky
Copy link
Copy Markdown
Collaborator

@akuzminsky akuzminsky commented May 5, 2026

Summary

  • Add modules/service-repo — a pure GitHub module for managing Terraform root repos (no AWS provider needed beyond state/IAM)
  • Create aws-service-infrahouse-app repo using the new module with sandbox environment, state bucket, and GHA IAM roles
  • Rename module identifiers from test_service to aws_service_infrahouse_app to match the managed repo
  • Replace hardcoded strings with local.gh_org_name, local.aws_default_region, and team references
  • Remove unused gh_secrets data source and clean up locals

Test plan

  • terraform plan shows expected resources for the new repo
  • No unexpected changes to existing repos
  • Verify service-repo module injects correct files (CODEOWNERS, workflows, terraform configs)

🤖 Generated with Claude Code

akuzminsky and others added 2 commits May 4, 2026 12:55
@akuzminsky @claude
Rebuild service-repo module as pure GitHub module
b26a71f 
Replace the old service-repo module (broken local gha-admin fork) with a new
implementation per the service-repo-module spec. The module now takes an
arbitrary environments map, has zero AWS dependencies, and auto-generates
per-environment backend config, GitHub environments with deploy gating,
and function-based CODEOWNERS. Also pins CI/CD workflows to ubuntu-24.04.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@akuzminsky @claude
Rename test_service modules and clean up hardcoded values
74b12b7 
Rename module identifiers from test_service to aws_service_infrahouse_app
to match the repo being managed. Replace hardcoded strings with locals
and team references. Remove unused gh_secrets data source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 5, 2026

State s3://infrahouse-github-control-state/terraform.tfstate

Affected resources counts

Success 🟢 Add 🟡 Change Destroy
✅ 38 90 0

Affected resources by action

Action Resources
🟢 module.aws_service_infrahouse_app.github_actions_variable.aws_default_region
🟢 module.aws_service_infrahouse_app.github_actions_variable.role_admin
🟢 module.aws_service_infrahouse_app.github_actions_variable.role_github
🟢 module.aws_service_infrahouse_app.github_actions_variable.role_state_manager
🟢 module.aws_service_infrahouse_app.github_actions_variable.state_bucket
🟢 module.aws_service_infrahouse_app.github_branch_default.main
🟢 module.aws_service_infrahouse_app.github_repository.this
🟢 module.aws_service_infrahouse_app.github_repository_environment.cd["sandbox"]
🟢 module.aws_service_infrahouse_app.github_repository_environment.ci["sandbox"]
🟢 module.aws_service_infrahouse_app.github_repository_file.codeowners[0]
🟢 module.aws_service_infrahouse_app.github_repository_file.releases_auto_tfvars["sandbox"]
🟢 module.aws_service_infrahouse_app.github_repository_file.secrets_scanner[0]
🟢 module.aws_service_infrahouse_app.github_repository_file.terraform_drift[0]
🟢 module.aws_service_infrahouse_app.github_repository_file.terraform_drift_wrapper[0]
🟢 module.aws_service_infrahouse_app.github_repository_file.terraform_tf["sandbox"]
🟢 module.aws_service_infrahouse_app.github_repository_file.terraform_tfvars["sandbox"]
🟢 module.aws_service_infrahouse_app.github_repository_file.vuln_scanner[0]
🟢 module.aws_service_infrahouse_app.github_repository_ruleset.main
🟢 module.aws_service_infrahouse_app.github_team_repository.admins["admins"]
🟢 module.aws_service_infrahouse_app.github_team_repository.committers["developers"]
🟢 module.aws_service_infrahouse_app.random_integer.minute
🟢 module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github
🟢 module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin
🟢 module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.github
🟢 module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.admin
🟢 module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.github
🟢 module.aws_service_infrahouse_app_state.aws_dynamodb_table.terraform_locks
🟢 module.aws_service_infrahouse_app_state.aws_s3_bucket.state-bucket
🟢 module.aws_service_infrahouse_app_state.aws_s3_bucket_policy.state-bucke
🟢 module.aws_service_infrahouse_app_state.aws_s3_bucket_public_access_block.public_access
🟢 module.aws_service_infrahouse_app_state.aws_s3_bucket_server_side_encryption_configuration.default
🟢 module.aws_service_infrahouse_app_state.aws_s3_bucket_versioning.enabled
🟢 module.aws_service_infrahouse_app_state.random_pet.suffix
🟢 module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_ro
🟢 module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_rw
🟢 module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager
🟢 module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro
🟢 module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0]
🟡 module.ih_8_repos["github-control"].github_actions_secret.secret["IH_GH_TF_APP_KEY"]
🟡 module.repos["aws-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["aws-control"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["aws-control-289256138624"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["aws-control-289256138624"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["aws-control-303467602807"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["aws-control-303467602807"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["aws-control-338531211565"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["aws-control-338531211565"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["aws-control-493370826424"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["aws-control-493370826424"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["cookiecutter-github-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["hiera-aws-sm"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["PAT_TOKEN"]
🟡 module.repos["infrahouse-com"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-com"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["infrahouse-core"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-core"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["infrahouse-core"].github_actions_secret.secret["PYPI_API_TOKEN"]
🟡 module.repos["infrahouse-puppet-data"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-puppet-data"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-toolkit"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["infrahouse-toolkit"].github_actions_secret.secret["CODACY_PROJECT_TOKEN"]
🟡 module.repos["infrahouse-toolkit"].github_actions_secret.secret["HOMEBREW_TAP_TOKEN"]
🟡 module.repos["infrahouse-toolkit"].github_actions_secret.secret["PYPI_API_TOKEN"]
🟡 module.repos["infrahouse-ubuntu-pro"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-website-infra"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["infrahouse-website-infra"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["osv-scanner"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["osv-scanner"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["prometheus-elasticsearch-exporter"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["proxysql-sandbox"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["puppet-code"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["puppet-code"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["pytest-infrahouse"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["pytest-infrahouse"].github_actions_secret.secret["AWS_DEFAULT_REGION"]
🟡 module.repos["pytest-infrahouse"].github_actions_secret.secret["PYPI_API_TOKEN"]
🟡 module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["CI_TEST_TOKEN"]
🟡 module.repos["terraform-aws-bookstack"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-ci-cd"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-cloud-init"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-cloudcraft-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-cost-alert"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-debian-repo"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-dms"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-ecr"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-elasticsearch"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-emrserverless"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-gh-identity-provider"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-gha-admin"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-github-backup"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-github-backup-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-github-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-guardduty-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-http-redirect"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-instance-profile"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-iso27001"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-jumphost"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-key"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-kibana"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-lambda-monitored"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-openclaw"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-openvpn"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-openvpn"].github_actions_secret.secret["OPENVPN_CLIENT_SECRET"]
🟡 module.repos["terraform-aws-org-governance"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-percona-server"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-pmm-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-postfix"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-pypiserver"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-registry"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-s3-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-secret"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-secret-policy"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-service-network"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-sqs-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-sqs-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-state-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-state-manager"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-tags-override"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-tcp-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-teleport"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-teleport-agent"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-terraformer"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-truststore"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-update-dns"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
🟡 module.repos["terraform-aws-website-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"]
STDOUT 
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # module.aws_service_infrahouse_app.github_actions_variable.aws_default_region will be created
  + resource "github_actions_variable" "aws_default_region" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = jsonencode(
            {
              + sandbox = "us-west-1"
            }
        )
      + variable_name = "AWS_DEFAULT_REGION"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_admin will be created
  + resource "github_actions_variable" "role_admin" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_ADMIN"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_github will be created
  + resource "github_actions_variable" "role_github" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_GITHUB"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.role_state_manager will be created
  + resource "github_actions_variable" "role_state_manager" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = (known after apply)
      + variable_name = "ROLE_STATE_MANAGER"
    }

  # module.aws_service_infrahouse_app.github_actions_variable.state_bucket will be created
  + resource "github_actions_variable" "state_bucket" {
      + created_at    = (known after apply)
      + id            = (known after apply)
      + repository    = "aws-service-infrahouse-app"
      + updated_at    = (known after apply)
      + value         = "infrahouse-github-control-aws-service-infrahouse-app"
      + variable_name = "STATE_BUCKET"
    }

  # module.aws_service_infrahouse_app.github_branch_default.main will be created
  + resource "github_branch_default" "main" {
      + branch     = "main"
      + etag       = (known after apply)
      + id         = (known after apply)
      + rename     = false
      + repository = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository.this will be created
  + resource "github_repository" "this" {
      + allow_auto_merge            = false
      + allow_merge_commit          = true
      + allow_rebase_merge          = true
      + allow_squash_merge          = true
      + allow_update_branch         = true
      + archived                    = false
      + default_branch              = (known after apply)
      + delete_branch_on_merge      = true
      + description                 = "AWS infrastructure for the InfraHouse product app"
      + etag                        = (known after apply)
      + full_name                   = (known after apply)
      + git_clone_url               = (known after apply)
      + has_downloads               = true
      + has_issues                  = true
      + has_projects                = true
      + has_wiki                    = true
      + html_url                    = (known after apply)
      + http_clone_url              = (known after apply)
      + id                          = (known after apply)
      + merge_commit_message        = "PR_TITLE"
      + merge_commit_title          = "MERGE_MESSAGE"
      + name                        = "aws-service-infrahouse-app"
      + node_id                     = (known after apply)
      + primary_language            = (known after apply)
      + private                     = (known after apply)
      + repo_id                     = (known after apply)
      + squash_merge_commit_message = "COMMIT_MESSAGES"
      + squash_merge_commit_title   = "COMMIT_OR_PR_TITLE"
      + ssh_clone_url               = (known after apply)
      + svn_url                     = (known after apply)
      + topics                      = (known after apply)
      + visibility                  = "private"
      + vulnerability_alerts        = true
      + web_commit_signoff_required = false

      + security_and_analysis (known after apply)

      + template {
          + include_all_branches = false
          + owner                = "infrahouse"
          + repository           = "terraform-root-template"
        }
    }

  # module.aws_service_infrahouse_app.github_repository_environment.cd["sandbox"] will be created
  + resource "github_repository_environment" "cd" {
      + can_admins_bypass   = true
      + environment         = "live-sandbox"
      + id                  = (known after apply)
      + prevent_self_review = false
      + repository          = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository_environment.ci["sandbox"] will be created
  + resource "github_repository_environment" "ci" {
      + can_admins_bypass   = true
      + environment         = "continuous-integration-sandbox"
      + id                  = (known after apply)
      + prevent_self_review = false
      + repository          = "aws-service-infrahouse-app"
    }

  # module.aws_service_infrahouse_app.github_repository_file.codeowners[0] will be created
  + resource "github_repository_file" "codeowners" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Update CODEOWNERS"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            
            * @infrahouse/developers
            environments/*/releases.auto.tfvars @infrahouse/admins
            .github/workflows/** @infrahouse/admins
        EOT
      + file                         = ".github/CODEOWNERS"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.releases_auto_tfvars["sandbox"] will be created
  + resource "github_repository_file" "releases_auto_tfvars" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add releases.auto.tfvars for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # Release-managed values — bumped by CI pipelines or release managers.
            # This file is owned by the service repo, not github-control.
            docker_image_tag = "latest"
        EOT
      + file                         = "environments/sandbox/releases.auto.tfvars"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.secrets_scanner[0] will be created
  + resource "github_repository_file" "secrets_scanner" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add secrets-scanner.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            ---
            name: Leaked Secrets Scan
            on:  # yamllint disable-line rule:truthy
              pull_request:
              merge_group:
                branches: [main]
            
            jobs:
              TruffleHog:
                runs-on: ubuntu-latest
                steps:
                  - name: Checkout code
                    uses: actions/checkout@v6
                    with:
                      fetch-depth: 0
                  - name: TruffleHog OSS
                    uses: trufflesecurity/trufflehog@main
                    with:
                      path: ./
                      base: ${{ github.event.repository.default_branch }}
                      head: HEAD
                      extra_args: --only-verified
        EOT
      + file                         = ".github/workflows/secrets-scanner.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_drift[0] will be created
  + resource "github_repository_file" "terraform_drift" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add terraform-drift.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            ---
            name: "Terraform Drift Detection"
            
            on:  # yamllint disable-line rule:truthy
              workflow_call:
                inputs:
                  env:
                    type: "string"
                    required: true
            
            permissions:
              id-token: "write"  # This is required for requesting the JWT
              contents: "write"
              pull-requests: "write"
              issues: "write"  # Required to create and apply labels
            
            concurrency:
              group: "terraform-drift-${{ inputs.env }}"
              cancel-in-progress: false
            
            jobs:
              terraform-drift:
                name: "Terraform Drift Detection"
                runs-on: ubuntu-24.04
                environment: "continuous-integration-${{ inputs.env }}"
                timeout-minutes: 15
                env:
                  GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
                  REGION_JSON: "${{ vars.AWS_DEFAULT_REGION }}"
            
                defaults:
                  run:
                    shell: "bash"
                    working-directory: "environments/${{ inputs.env }}"
            
                steps:
                  - name: "Checkout"
                    uses: "actions/checkout@v6"
            
                  - name: "Extract Variables"
                    id: "extract_vars"
                    env:
                      REGION_JSON_CONTENT: ${{ env.REGION_JSON }}
                      TARGET_ENV: ${{ inputs.env }}
                    run: |
                      REGION=$(echo "$REGION_JSON_CONTENT" | jq -r ".${TARGET_ENV}")
                      echo "REGION=$REGION" >> "$GITHUB_OUTPUT"
            
                  - name: "Configure AWS Credentials"
                    uses: "aws-actions/configure-aws-credentials@v6"
                    with:
                      role-to-assume: "${{ vars.ROLE_GITHUB }}"
                      role-session-name: "github-actions-${{ inputs.env }}"
                      aws-region: "${{ steps.extract_vars.outputs.REGION }}"
            
                  - name: "Set Terraform version"
                    id: "terraform_version"
                    run: |
                      echo "IH_TF_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
            
                  - name: "Setup Terraform"
                    uses: "hashicorp/setup-terraform@v4"
                    with:
                      terraform_version: "${{ steps.terraform_version.outputs.IH_TF_VERSION }}"
            
                  - name: "Set up Python"
                    uses: "actions/setup-python@v6"
                    with:
                      python-version: "3.14"
            
                  - name: "Setup Python Environment"
                    run: |
                      make bootstrap-ci
            
                  - name: "Terraform Init"
                    run: |
                      terraform init -input=false
            
                  - name: "Check if any changes are planned"
                    id: "check_drift"
                    run: |
                      terraform plan -no-color -input=false -detailed-exitcode
            
                  - name: Cleanup working dir
                    run: git clean -df
            
                  - name: "Record Config Drift Log Entry"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      git \
                      -c user.name="${{ github.actor }}" \
                      -c user.email="${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com" \
                      commit -m "Reconcile configuration drift" --allow-empty
            
                  - name: "Check for open PR with label"
                    id: "check_label"
                    if: "steps.check_drift.outputs.exitcode == 2"
                    run: |
                      LABEL="config-drift"
                      REPO="${{ github.repository }}"
                      COUNT=$(gh pr list --repo "$REPO" --label "$LABEL" --state open --json number --jq 'length')
                      echo "Found $COUNT open PR(s) with label '$LABEL'"
                      if [[ $COUNT -gt 0 ]]; then
                        echo "label_exists=true" >> $GITHUB_OUTPUT
                      else
                        echo "label_exists=false" >> $GITHUB_OUTPUT
                      fi
            
                  - name: "Create Pull Request"
                    if: "steps.check_label.outputs.label_exists == 'false'"
                    uses: "peter-evans/create-pull-request@v8"
                    with:
                      token: "${{ steps.app-token.outputs.token }}"
                      base: "main"
                      branch: "create-pull-request/config-drift"
                      title: "[config-drift] Reconcile Terraform configuration drift in ${{ inputs.env }}"
                      commit-message: "[config-drift] Configuration drift record for ${{ inputs.env }}"
                      team-reviewers: "devops-members"
                      labels: |
                        config-drift
        EOT
      + file                         = ".github/workflows/terraform-drift.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_drift_wrapper[0] will be created
  + resource "github_repository_file" "terraform_drift_wrapper" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add terraform-drift-wrapper.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = ".github/workflows/terraform-drift-wrapper.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_tf["sandbox"] will be created
  + resource "github_repository_file" "terraform_tf" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add terraform.tf for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = "environments/sandbox/terraform.tf"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.terraform_tfvars["sandbox"] will be created
  + resource "github_repository_file" "terraform_tfvars" {
      + autocreate_branch_source_sha = (known after apply)
      + branch                       = "main"
      + commit_message               = "Add terraform.tfvars for sandbox environment"
      + commit_sha                   = (known after apply)
      + content                      = (known after apply)
      + file                         = "environments/sandbox/terraform.tfvars"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_file.vuln_scanner[0] will be created
  + resource "github_repository_file" "vuln_scanner" {
      + autocreate_branch_source_sha = (known after apply)
      + commit_message               = "Add vuln-scanner-pr.yml workflow"
      + commit_sha                   = (known after apply)
      + content                      = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            ---
            name: OSV-Scanner PR Scan
            
            on:  # yamllint disable-line rule:truthy
              pull_request:
                branches: [main]
              merge_group:
                branches: [main]
            
            permissions:
              contents: read
              pull-requests: write
            
            env:
              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
            
            jobs:
              vulnerability-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Detect vulnerabilities
                    run: |
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github scan \
                        --repo ${{ github.repository }} \
                        --pull-request ${{ github.event.pull_request.number }}
                      else
                        ih-github scan
                      fi
            
              sast-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Set up Python
                    uses: actions/setup-python@v6
                    with:
                      python-version: "3.14"
            
                  - name: SAST
                    run: |
                      pip install --upgrade semgrep
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github run \
                        ${{ github.repository }} \
                        ${{ github.event.pull_request.number }} \
                        semgrep scan --error
                      else
                        semgrep scan --error
                      fi
        EOT
      + file                         = ".github/workflows/vuln-scanner-pr.yml"
      + id                           = (known after apply)
      + overwrite_on_create          = true
      + ref                          = (known after apply)
      + repository                   = "aws-service-infrahouse-app"
      + sha                          = (known after apply)
    }

  # module.aws_service_infrahouse_app.github_repository_ruleset.main will be created
  + resource "github_repository_ruleset" "main" {
      + enforcement = "active"
      + etag        = (known after apply)
      + id          = (known after apply)
      + name        = "Main Branch Protection"
      + node_id     = (known after apply)
      + repository  = "aws-service-infrahouse-app"
      + ruleset_id  = (known after apply)
      + target      = "branch"

      + bypass_actors {
          + actor_id    = 1016363
          + actor_type  = "Integration"
          + bypass_mode = "always"
        }

      + conditions {
          + ref_name {
              + exclude = []
              + include = [
                  + "~DEFAULT_BRANCH",
                ]
            }
        }

      + rules {
          + update_allows_fetch_and_merge = false

          + pull_request {
              + dismiss_stale_reviews_on_push     = true
              + require_code_owner_review         = true
              + require_last_push_approval        = false
              + required_approving_review_count   = 1
              + required_review_thread_resolution = false
            }

          + required_status_checks {
              + do_not_enforce_on_create             = false
              + strict_required_status_checks_policy = true

              + required_check {
                  + context        = "Terraform Plan sandbox"
                  + integration_id = 0
                }
              + required_check {
                  + context        = "TruffleHog"
                  + integration_id = 0
                }
              + required_check {
                  + context        = "vulnerability-check"
                  + integration_id = 0
                }
            }
        }
    }

  # module.aws_service_infrahouse_app.github_team_repository.admins["admins"] will be created
  + resource "github_team_repository" "admins" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "admin"
      + repository = "aws-service-infrahouse-app"
      + team_id    = "14268696"
    }

  # module.aws_service_infrahouse_app.github_team_repository.committers["developers"] will be created
  + resource "github_team_repository" "committers" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "push"
      + repository = "aws-service-infrahouse-app"
      + team_id    = "7332815"
    }

  # module.aws_service_infrahouse_app.random_integer.minute will be created
  + resource "random_integer" "minute" {
      + id     = (known after apply)
      + max    = 59
      + min    = 0
      + result = (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.admin-trust will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "admin-trust" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions = [
              + "sts:AssumeRole",
            ]

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.data.aws_iam_policy_document.github-permissions will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "github-permissions" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "sts:AssumeRole",
            ]
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_policy.github will be created
  + resource "aws_iam_policy" "github" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-github"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.admin will be created
  + resource "aws_iam_role" "admin" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + description           = "Role to manage AWS account"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-admin"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
          + "module_version"    = "3.6.1"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
          + "module_version"    = "3.6.1"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role.github will be created
  + resource "aws_iam_role" "github" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringEquals = {
                              + "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
                            }
                          + StringLike   = {
                              + "token.actions.githubusercontent.com:sub" = "repo:infrahouse/aws-service-infrahouse-app:*"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::303467602807:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + description           = "Role for a GitHub Actions runner in repo aws-service-infrahouse-app"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-github"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/gha-admin/aws"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.admin will be created
  + resource "aws_iam_role_policy_attachment" "admin" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
      + role       = "ih-tf-aws-service-infrahouse-app-admin"
    }

  # module.aws_service_infrahouse_app_gha_sandbox.aws_iam_role_policy_attachment.github will be created
  + resource "aws_iam_role_policy_attachment" "github" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-github"
    }

  # module.aws_service_infrahouse_app_state.data.aws_iam_policy_document.enforce_ssl_policy will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "enforce_ssl_policy" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:*",
            ]
          + effect    = "Deny"
          + resources = [
              + (known after apply),
              + (known after apply),
            ]
          + sid       = "AllowSSLRequestsOnly"

          + condition {
              + test     = "Bool"
              + values   = [
                  + "false",
                ]
              + variable = "aws:SecureTransport"
            }

          + principals {
              + identifiers = [
                  + "*",
                ]
              + type        = "*"
            }
        }
    }

  # module.aws_service_infrahouse_app_state.aws_dynamodb_table.terraform_locks will be created
  + resource "aws_dynamodb_table" "terraform_locks" {
      + arn              = (known after apply)
      + billing_mode     = "PAY_PER_REQUEST"
      + hash_key         = "LockID"
      + id               = (known after apply)
      + name             = (known after apply)
      + read_capacity    = (known after apply)
      + region           = "us-west-1"
      + stream_arn       = (known after apply)
      + stream_label     = (known after apply)
      + stream_view_type = (known after apply)
      + tags             = {
          + "VantaNoAlert"      = "Table used for Terraform state lock and does not contain user data"
          + "created_by_module" = "infrahouse/state-bucket/aws"
          + "state_bucket"      = "infrahouse-github-control-aws-service-infrahouse-app"
        }
      + tags_all         = {
          + "VantaNoAlert"      = "Table used for Terraform state lock and does not contain user data"
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-bucket/aws"
          + "state_bucket"      = "infrahouse-github-control-aws-service-infrahouse-app"
        }
      + write_capacity   = (known after apply)

      + attribute {
          + name = "LockID"
          + type = "S"
        }

      + global_secondary_index (known after apply)

      + global_table_witness (known after apply)

      + point_in_time_recovery (known after apply)

      + server_side_encryption (known after apply)

      + ttl (known after apply)

      + warm_throughput (known after apply)
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket.state-bucket will be created
  + resource "aws_s3_bucket" "state-bucket" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "infrahouse-github-control-aws-service-infrahouse-app"
      + bucket_domain_name          = (known after apply)
      + bucket_namespace            = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "us-west-1"
      + request_payer               = (known after apply)
      + tags                        = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_policy.state-bucke will be created
  + resource "aws_s3_bucket_policy" "state-bucke" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + policy = (known after apply)
      + region = "us-west-1"
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_public_access_block.public_access will be created
  + resource "aws_s3_bucket_public_access_block" "public_access" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + region                  = "us-west-1"
      + restrict_public_buckets = true
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_server_side_encryption_configuration.default will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "us-west-1"

      + rule {
          + blocked_encryption_types = (known after apply)
          + bucket_key_enabled       = (known after apply)

          + apply_server_side_encryption_by_default {
              + kms_master_key_id = (known after apply)
              + sse_algorithm     = "AES256"
            }
        }
    }

  # module.aws_service_infrahouse_app_state.aws_s3_bucket_versioning.enabled will be created
  + resource "aws_s3_bucket_versioning" "enabled" {
      + bucket = (known after apply)
      + id     = (known after apply)
      + region = "us-west-1"

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

  # module.aws_service_infrahouse_app_state.random_pet.suffix will be created
  + resource "random_pet" "suffix" {
      + id        = (known after apply)
      + length    = 2
      + prefix    = "infrahouse-github-control-aws-service-infrahouse-app"
      + separator = "-"
    }

  # module.ih_8_repos["github-control"].github_actions_secret.secret["IH_GH_TF_APP_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "github-control:IH_GH_TF_APP_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-289256138624"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-289256138624:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-289256138624"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-289256138624:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-303467602807"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-303467602807:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-303467602807"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-303467602807:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-338531211565"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-338531211565:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-338531211565"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-338531211565:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-493370826424"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-493370826424:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["aws-control-493370826424"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "aws-control-493370826424:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["cookiecutter-github-control"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "cookiecutter-github-control:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["hiera-aws-sm"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "hiera-aws-sm:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "homebrew-infrahouse-toolkit:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["homebrew-infrahouse-toolkit"].github_actions_secret.secret["PAT_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "homebrew-infrahouse-toolkit:PAT_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-com"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-com:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-com"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-com:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-core"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-core:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-puppet-data"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-puppet-data:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-puppet-data"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-puppet-data:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["CODACY_PROJECT_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:CODACY_PROJECT_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["HOMEBREW_TAP_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:HOMEBREW_TAP_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-toolkit"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-toolkit:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-ubuntu-pro"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-ubuntu-pro:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-website-infra"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-website-infra:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["infrahouse-website-infra"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "infrahouse-website-infra:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["osv-scanner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "osv-scanner:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["osv-scanner"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "osv-scanner:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["prometheus-elasticsearch-exporter"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "prometheus-elasticsearch-exporter:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["proxysql-sandbox"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "proxysql-sandbox:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["puppet-code"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "puppet-code:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["puppet-code"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "puppet-code:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["AWS_DEFAULT_REGION"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:AWS_DEFAULT_REGION"
        # (6 unchanged attributes hidden)
    }

  # module.repos["pytest-infrahouse"].github_actions_secret.secret["PYPI_API_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "pytest-infrahouse:PYPI_API_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-actions-runner:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-actions-runner"].github_actions_secret.secret["CI_TEST_TOKEN"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-actions-runner:CI_TEST_TOKEN"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-bookstack"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-bookstack:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ci-cd"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ci-cd:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloud-init"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cloud-init:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cloudcraft-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cloudcraft-role:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-cost-alert"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-cost-alert:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-debian-repo"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-debian-repo:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-dms"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-dms:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecr"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ecr:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-elasticsearch"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-elasticsearch:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-emrserverless"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-emrserverless:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gh-identity-provider"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-gh-identity-provider:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-gha-admin"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-gha-admin:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-backup:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-backup-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-backup-configuration:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-github-role"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-github-role:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-guardduty-configuration"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-guardduty-configuration:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-http-redirect"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-http-redirect:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-instance-profile"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-instance-profile:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-iso27001"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-iso27001:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-jumphost"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-jumphost:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-key"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-key:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-kibana"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-kibana:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-lambda-monitored"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-lambda-monitored:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openclaw"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openclaw:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openvpn:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-openvpn"].github_actions_secret.secret["OPENVPN_CLIENT_SECRET"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-openvpn:OPENVPN_CLIENT_SECRET"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-org-governance"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-org-governance:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-percona-server"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-percona-server:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pmm-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-pmm-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-postfix"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-postfix:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-pypiserver"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-pypiserver:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-registry"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-registry:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-s3-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-s3-bucket:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-secret:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-secret-policy"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-secret-policy:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-service-network"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-service-network:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-ecs"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-sqs-ecs:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-sqs-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-sqs-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-bucket"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-state-bucket:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-state-manager"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-state-manager:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tags-override"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-tags-override:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-tcp-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-tcp-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-teleport:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-teleport-agent"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-teleport-agent:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-terraformer"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-terraformer:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-truststore"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-truststore:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-update-dns"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-update-dns:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.repos["terraform-aws-website-pod"].github_actions_secret.secret["ANTHROPIC_API_KEY"] will be updated in-place
  ~ resource "github_actions_secret" "secret" {
      + destroy_on_drift = true
        id               = "terraform-aws-website-pod:ANTHROPIC_API_KEY"
        # (6 unchanged attributes hidden)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.data.aws_iam_policy_document.assume will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "assume" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions = [
              + "sts:AssumeRole",
            ]
          + sid     = "000"

          + principals {
              + identifiers = [
                  + (known after apply),
                ]
              + type        = "AWS"
            }
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.data.aws_iam_policy_document.permissions_rw will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "permissions_rw" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "s3:DeleteObject",
              + "s3:PutObject",
            ]
          + resources = [
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/*.zip",
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/plans/*",
              + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/terraform.tfstate",
            ]
        }
      + statement {
          + actions   = [
              + "dynamodb:DeleteItem",
              + "dynamodb:DescribeTable",
              + "dynamodb:GetItem",
              + "dynamodb:PutItem",
            ]
          + resources = [
              + (known after apply),
            ]
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_ro will be created
  + resource "aws_iam_policy" "permissions_ro" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-state-manager-ro"
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "s3:ListBucket"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app"
                    },
                  + {
                      + Action   = "s3:GetObject"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/terraform.tfstate",
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/plans/*",
                          + "arn:aws:s3:::infrahouse-github-control-aws-service-infrahouse-app/*.zip",
                        ]
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_policy.permissions_rw will be created
  + resource "aws_iam_policy" "permissions_rw" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = (known after apply)
      + name_prefix      = "ih-tf-aws-service-infrahouse-app-state-manager-rw"
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags             = {
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
      + tags_all         = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
        }
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role.state-manager will be created
  + resource "aws_iam_role" "state-manager" {
      + arn                   = (known after apply)
      + assume_role_policy    = (known after apply)
      + create_date           = (known after apply)
      + description           = "Role to manage a terraform state of a repo"
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 43200
      + name                  = "ih-tf-aws-service-infrahouse-app-state-manager"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "created_by_module" = "infrahouse/state-manager/aws"
          + "module_version"    = "1.4.2"
        }
      + tags_all              = {
          + "created_by"        = "infrahouse8/github-control"
          + "created_by_module" = "infrahouse/state-manager/aws"
          + "module_version"    = "1.4.2"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-ro will be created
  + resource "aws_iam_role_policy_attachment" "state-manager-ro" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-state-manager"
    }

  # module.aws_service_infrahouse_app_gha_sandbox.module.state-manager.aws_iam_role_policy_attachment.state-manager-rw[0] will be created
  + resource "aws_iam_role_policy_attachment" "state-manager-rw" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "ih-tf-aws-service-infrahouse-app-state-manager"
    }

Plan: 38 to add, 90 to change, 0 to destroy.

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"
metadata 
eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMzgsICJjaGFuZ2UiOiA5MCwgImRlc3Ryb3kiOiAwfX0=

@akuzminsky akuzminsky merged commit b72947d into main May 5, 2026
1 check passed
@akuzminsky akuzminsky deleted the service-repo branch May 5, 2026 17:03
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@akuzminsky