GitHub Repository Creation

Create new GitHub repositories by adding OpenTofu modules to the github-infrastructure repo.

Workflow

1. Gather Parameters

Collect from the user:

Parameter Required Default Notes

name

Yes

kebab-case, e.g. my-new-repo

description

Yes

One-line description

visibility

No private

private or public

is_template

No false

true for template repos

default_branch

No main

Branch to protect (main or master )

extra_branches

No []

Additional branches to protect

status_checks

No ["Claude Code Review", "CodeRabbit", "Lint"]

CI checks to require

category

No infer Projects , Specs , Infrastructure , or Templates

Category inference: name ends with -spec → Specs; ends with -template → Templates; contains infrastructure , ci- , org- → Infrastructure; else → Projects.

2. Clone to Temp Directory

WORK_DIR=$(mktemp -d) git clone --depth 1 git@github.com:OlechowskiMichal/github-infrastructure.git "$WORK_DIR/github-infrastructure" cd "$WORK_DIR/github-infrastructure" git checkout -b feat/add-<repo-name>

All subsequent file operations happen inside $WORK_DIR/github-infrastructure .

3. Create Module Files

Create tofu/repositories/<repo-name>/ with three files. Use the exact templates from references/templates.md.

4. Update Root Module

tofu/main.tf — Add under the correct category comment (# Projects , # Specs , # Infrastructure , # Templates ):

module "<module_name>" { source = "./repositories/<repo-name>" }

Module name: replace hyphens and dots with underscores, strip leading dots.

tofu/outputs.tf — Add to both repositories and branch_protections outputs under the same category:

In repositories:

"<repo-name>" = module.<module_name>.repository

In branch_protections:

"<repo-name>" = module.<module_name>.branch_protection

5. Commit, Push, and Create PR

cd "$WORK_DIR/github-infrastructure" tofu -chdir=tofu fmt -recursive git add tofu/ git commit -m "feat: add <repo-name> repository" git push -u origin feat/add-<repo-name> gh pr create --title "feat: add <repo-name> repository" --body "Add OpenTofu module for <repo-name>"

6. Clean Up

[ -n "$WORK_DIR" ] && [ -d "$WORK_DIR" ] && rm -rf "$WORK_DIR"

Report the PR URL to the user.

OPA Policy Requirements

CI will reject violations. These are mandatory:

• vulnerability_alerts = true

• delete_branch_on_merge = true

• allow_merge_commit = false

• allow_squash_merge = true

• has_wiki = false

• has_projects = false

• has_issues = true

• Branch protection with required_status_checks and required_pull_request_reviews

• allows_force_pushes = false , allows_deletions = false

• At least 1 approving review

• github_branch_protection.extra block always present (even with for_each = toset([]) )

• lifecycle { prevent_destroy = true } on repository resource

• archive_on_destroy = true