GitHub Repository Creation

Create new GitHub repositories by adding OpenTofu modules to the github-infrastructure repo.

Workflow

1. Gather Parameters

Collect from the user:

Parameter	Required	Default	Notes
name	Yes	-	kebab-case, e.g. my-new-repo
description	Yes	-	One-line description
visibility	No	private	private or public
is_template	No	false	true for template repos
default_branch	No	main	Branch to protect (main or master)
extra_branches	No	[]	Additional branches to protect
status_checks	No	["Claude Code Review", "CodeRabbit", "Lint"]	CI checks to require
category	No	infer	Projects, Specs, Infrastructure, or Templates

Category inference: name ends with -spec → Specs; ends with -template → Templates; contains infrastructure, ci-, org- → Infrastructure; else → Projects.

2. Clone to Temp Directory

WORK_DIR=$(mktemp -d)
git clone --depth 1 git@github.com:OlechowskiMichal/github-infrastructure.git "$WORK_DIR/github-infrastructure"
cd "$WORK_DIR/github-infrastructure"
git checkout -b feat/add-<repo-name>

All subsequent file operations happen inside $WORK_DIR/github-infrastructure.

3. Create Module Files

Create tofu/repositories/<repo-name>/ with three files. Use the exact templates from references/templates.md.

4. Update Root Module

tofu/main.tf — Add under the correct category comment (# Projects, # Specs, # Infrastructure, # Templates):

module "<module_name>" {
  source = "./repositories/<repo-name>"
}

Module name: replace hyphens and dots with underscores, strip leading dots.

tofu/outputs.tf — Add to both repositories and branch_protections outputs under the same category:

# In repositories:
"<repo-name>" = module.<module_name>.repository

# In branch_protections:
"<repo-name>" = module.<module_name>.branch_protection

5. Commit, Push, and Create PR

cd "$WORK_DIR/github-infrastructure"
tofu -chdir=tofu fmt -recursive
git add tofu/
git commit -m "feat: add <repo-name> repository"
git push -u origin feat/add-<repo-name>
gh pr create --title "feat: add <repo-name> repository" --body "Add OpenTofu module for <repo-name>"

6. Clean Up

[ -n "$WORK_DIR" ] && [ -d "$WORK_DIR" ] && rm -rf "$WORK_DIR"

Report the PR URL to the user.

OPA Policy Requirements

CI will reject violations. These are mandatory:

• vulnerability_alerts = true
• delete_branch_on_merge = true
• allow_merge_commit = false
• allow_squash_merge = true
• has_wiki = false
• has_projects = false
• has_issues = true
• Branch protection with required_status_checks and required_pull_request_reviews
• allows_force_pushes = false, allows_deletions = false
• At least 1 approving review
• github_branch_protection.extra block always present (even with for_each = toset([]))
• lifecycle { prevent_destroy = true } on repository resource
• archive_on_destroy = true