ScottyLabs/governance
Watch
20
2
Fork
You've already forked governance
 184
Code Issues 12 Pull requests 29 Projects Releases Packages Wiki Activity Actions 27

feat: add slop-cop and forge-triage to devops #462

Open
thesuperRL wants to merge 1 commit from add-slop-cop-and-forge-triage into main
pull from: add-slop-cop-and-forge-triage
merge into: ScottyLabs:main
Conversation 3 Commits 1 Files changed 13 +559
thesuperRL commented 2026-09-29 19:15:22 +00:00
Owner
Copy link
No description provided.
feat: add slop-cop and forge-triage to devops
Some checks failed
atlantis/plan 5/5 projects planned successfully.
CI / build (pull_request) Has been skipped
Details
kennel/build skipped: no services or static sites defined
Details
atlantis/plan: openbao Plan: 12 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: litellm Plan: 10 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: keycloak Plan: 8 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: git Plan: 24 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: sentry Plan: 6 to add, 0 to change, 0 to destroy.
Details
Validate / Governance (pull_request_target) Failing after 10m53s
Details
CI / check-1 (pull_request) Failing after 10m55s
Details
CI / check (pull_request) Failing after 0s
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
3804141c32
scottylabs-bot commented 2026-09-29 19:16:35 +00:00
Owner
Copy link

Ran Plan for 5 projects:

  1. project: openbao dir: tofu/openbao workspace: default
  2. project: litellm dir: tofu/litellm workspace: default
  3. project: keycloak dir: tofu/keycloak workspace: default
  4. project: git dir: tofu/git workspace: default
  5. project: sentry dir: tofu/sentry workspace: default

1. project: openbao dir: tofu/openbao workspace: default

Show Output 
Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 7.84s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # vault_identity_group.forge-triage_admins will be created
+ resource "vault_identity_group" "forge-triage_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "forge-triage-admins"
+       policies                   = [
+           "forge-triage-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.forge-triage_members will be created
+ resource "vault_identity_group" "forge-triage_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "forge-triage-members"
+       policies                   = [
+           "forge-triage-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slop-cop_admins will be created
+ resource "vault_identity_group" "slop-cop_admins" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slop-cop-admins"
+       policies                   = [
+           "slop-cop-prod",
        ]
+       type                       = "external"
    }

  # vault_identity_group.slop-cop_members will be created
+ resource "vault_identity_group" "slop-cop_members" {
+       external_member_entity_ids = false
+       external_member_group_ids  = false
+       external_policies          = false
+       id                         = (known after apply)
+       name                       = "slop-cop-members"
+       policies                   = [
+           "slop-cop-dev",
        ]
+       type                       = "external"
    }

  # vault_identity_group_alias.forge-triage_admins will be created
+ resource "vault_identity_group_alias" "forge-triage_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/forge-triage/admins"
    }

  # vault_identity_group_alias.forge-triage_members will be created
+ resource "vault_identity_group_alias" "forge-triage_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/forge-triage"
    }

  # vault_identity_group_alias.slop-cop_admins will be created
+ resource "vault_identity_group_alias" "slop-cop_admins" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slop-cop/admins"
    }

  # vault_identity_group_alias.slop-cop_members will be created
+ resource "vault_identity_group_alias" "slop-cop_members" {
+       canonical_id   = (known after apply)
+       id             = (known after apply)
+       mount_accessor = "auth_oidc_375ac979"
+       name           = "/projects/slop-cop"
    }

  # vault_policy.forge-triage_dev will be created
+ resource "vault_policy" "forge-triage_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "forge-triage-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/forge-triage/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/forge-triage/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/forge-triage/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/forge-triage/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.forge-triage_prod will be created
+ resource "vault_policy" "forge-triage_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "forge-triage-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/forge-triage/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/forge-triage/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/forge-triage/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/forge-triage/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/forge-triage/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/forge-triage/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slop-cop_dev will be created
+ resource "vault_policy" "slop-cop_dev" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slop-cop-dev"
+       policy          = <<-EOT
            path "secret/data/secretspec/slop-cop/dev/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slop-cop/dev/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slop-cop/preview/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slop-cop/preview/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

  # vault_policy.slop-cop_prod will be created
+ resource "vault_policy" "slop-cop_prod" {
+       allow_overwrite = (known after apply)
+       id              = (known after apply)
+       name            = "slop-cop-prod"
+       policy          = <<-EOT
            path "secret/data/secretspec/slop-cop/prod/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slop-cop/prod/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slop-cop/staging/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slop-cop/staging/*" {
              capabilities = ["list", "read", "delete"]
            }
            
            path "secret/data/secretspec/slop-cop/ci/*" {
              capabilities = ["create", "read", "update", "patch", "delete", "list"]
            }
            
            path "secret/metadata/secretspec/slop-cop/ci/*" {
              capabilities = ["list", "read", "delete"]
            }
        EOT
    }

Plan: 12 to add, 0 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p openbao
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p openbao

Plan: 12 to add, 0 to change, 0 to destroy.

2. project: litellm dir: tofu/litellm workspace: default

Show Output 
Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 7.87s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # litellm_key.forge_triage_dev will be created
+ resource "litellm_key" "forge_triage_dev" {
+       aliases                    = (known after apply)
+       allowed_cache_controls     = (known after apply)
+       allowed_passthrough_routes = (known after apply)
+       allowed_routes             = (known after apply)
+       blocked                    = (known after apply)
+       budget_duration            = "monthly"
+       config                     = (known after apply)
+       config_json                = (sensitive value)
+       enforced_params            = (known after apply)
+       guardrails                 = (known after apply)
+       id                         = (known after apply)
+       key                        = (sensitive value)
+       key_alias                  = "forge-triage-dev"
+       key_wo                     = (write-only attribute)
+       max_budget                 = 5
+       max_parallel_requests      = 20
+       metadata                   = (sensitive value)
+       metadata_json              = (sensitive value)
+       model_max_budget           = (known after apply)
+       model_rpm_limit            = (known after apply)
+       model_tpm_limit            = (known after apply)
+       models                     = (known after apply)
+       permissions                = (known after apply)
+       permissions_json           = (sensitive value)
+       prompts                    = (known after apply)
+       rpm_limit                  = 200
+       send_invite_email          = (write-only attribute)
+       soft_budget                = (known after apply)
+       tags                       = (known after apply)
+       team_id                    = "1dfbef19-a385-460a-9220-5b23e05ddaae"
+       tpm_limit                  = 1000000
    }

  # litellm_key.forge_triage_prod will be created
+ resource "litellm_key" "forge_triage_prod" {
+       aliases                    = (known after apply)
+       allowed_cache_controls     = (known after apply)
+       allowed_passthrough_routes = (known after apply)
+       allowed_routes             = (known after apply)
+       blocked                    = (known after apply)
+       budget_duration            = "monthly"
+       config                     = (known after apply)
+       config_json                = (sensitive value)
+       enforced_params            = (known after apply)
+       guardrails                 = (known after apply)
+       id                         = (known after apply)
+       key                        = (sensitive value)
+       key_alias                  = "forge-triage-prod"
+       key_wo                     = (write-only attribute)
+       max_budget                 = 20
+       max_parallel_requests      = 100
+       metadata                   = (sensitive value)
+       metadata_json              = (sensitive value)
+       model_max_budget           = (known after apply)
+       model_rpm_limit            = (known after apply)
+       model_tpm_limit            = (known after apply)
+       models                     = (known after apply)
+       permissions                = (known after apply)
+       permissions_json           = (sensitive value)
+       prompts                    = (known after apply)
+       rpm_limit                  = 1000
+       send_invite_email          = (write-only attribute)
+       soft_budget                = (known after apply)
+       tags                       = (known after apply)
+       team_id                    = "1dfbef19-a385-460a-9220-5b23e05ddaae"
+       tpm_limit                  = 4000000
    }

  # vault_kv_secret_v2.forge_triage_dev_litellm_api_key will be created
+ resource "vault_kv_secret_v2" "forge_triage_dev_litellm_api_key" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/dev/LITELLM_API_KEY"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_dev_litellm_base_url will be created
+ resource "vault_kv_secret_v2" "forge_triage_dev_litellm_base_url" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/dev/LITELLM_BASE_URL"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_preview_litellm_api_key will be created
+ resource "vault_kv_secret_v2" "forge_triage_preview_litellm_api_key" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/preview/LITELLM_API_KEY"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_preview_litellm_base_url will be created
+ resource "vault_kv_secret_v2" "forge_triage_preview_litellm_base_url" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/preview/LITELLM_BASE_URL"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_prod_litellm_api_key will be created
+ resource "vault_kv_secret_v2" "forge_triage_prod_litellm_api_key" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/prod/LITELLM_API_KEY"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_prod_litellm_base_url will be created
+ resource "vault_kv_secret_v2" "forge_triage_prod_litellm_base_url" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/prod/LITELLM_BASE_URL"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_staging_litellm_api_key will be created
+ resource "vault_kv_secret_v2" "forge_triage_staging_litellm_api_key" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/staging/LITELLM_API_KEY"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.forge_triage_staging_litellm_base_url will be created
+ resource "vault_kv_secret_v2" "forge_triage_staging_litellm_base_url" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/staging/LITELLM_BASE_URL"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

Plan: 10 to add, 0 to change, 0 to destroy.
╷
│ Warning: Deprecated Resource
│ 
│   with data.vault_kv_secret_v2.litellm_master_key,
│   on data.tf.json line 7, in data.vault_kv_secret_v2.litellm_master_key:
│    7:       }
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
│ 
│ (and one more similar warning elsewhere)
╵
╷
│ Warning: Value derived from a deprecated source
│ 
│   on providers.tf.json line 33, in provider.litellm:
│   33:     },
│ 
│ This value is derived from data.vault_kv_secret_v2.litellm_master_key,
│ which is deprecated with the following message:
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
╵
  • ▶️ To apply this plan, comment: 
    atlantis apply -p litellm
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p litellm

Plan: 10 to add, 0 to change, 0 to destroy.

3. project: keycloak dir: tofu/keycloak workspace: default

Show Output 
Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
   Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-schema)
   Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-core)
   Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-tfgen)
   Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-cli)
    Finished `release` profile [optimized] target(s) in 7.85s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # keycloak_group.project_devops_forge-triage will be created
+ resource "keycloak_group" "project_devops_forge-triage" {
+       id        = (known after apply)
+       name      = "forge-triage"
+       parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25"
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_devops_forge-triage_admins will be created
+ resource "keycloak_group" "project_devops_forge-triage_admins" {
+       id        = (known after apply)
+       name      = "admins"
+       parent_id = (known after apply)
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_devops_slop-cop will be created
+ resource "keycloak_group" "project_devops_slop-cop" {
+       id        = (known after apply)
+       name      = "slop-cop"
+       parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25"
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group.project_devops_slop-cop_admins will be created
+ resource "keycloak_group" "project_devops_slop-cop_admins" {
+       id        = (known after apply)
+       name      = "admins"
+       parent_id = (known after apply)
+       path      = (known after apply)
+       realm_id  = "scottylabs"
    }

  # keycloak_group_memberships.project_devops_forge-triage will be created
+ resource "keycloak_group_memberships" "project_devops_forge-triage" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "aszhou",
+           "azzhou",
+           "brightz",
+           "jhhan2",
+           "joohank",
+           "junwonp",
+           "rjwu",
+           "ryanli2",
+           "saniyav",
+           "spola2",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_devops_forge-triage_admins will be created
+ resource "keycloak_group_memberships" "project_devops_forge-triage_admins" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "ryanli2",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_devops_slop-cop will be created
+ resource "keycloak_group_memberships" "project_devops_slop-cop" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "aszhou",
+           "azzhou",
+           "brightz",
+           "jhhan2",
+           "joohank",
+           "junwonp",
+           "rjwu",
+           "ryanli2",
+           "saniyav",
+           "spola2",
        ]
+       realm_id = "scottylabs"
    }

  # keycloak_group_memberships.project_devops_slop-cop_admins will be created
+ resource "keycloak_group_memberships" "project_devops_slop-cop_admins" {
+       group_id = (known after apply)
+       id       = (known after apply)
+       members  = [
+           "apallati",
+           "ryanli2",
        ]
+       realm_id = "scottylabs"
    }

Plan: 8 to add, 0 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p keycloak
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p keycloak

Plan: 8 to add, 0 to change, 0 to destroy.

4. project: git dir: tofu/git workspace: default

Show Output 
Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 7.85s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # forgejo_repository.devops_forge_triage will be created
+ resource "forgejo_repository" "devops_forge_triage" {
+       allow_manual_merge          = false
+       allow_merge_commits         = true
+       allow_rebase                = true
+       allow_rebase_explicit       = true
+       allow_squash_merge          = true
+       archive_on_destroy          = false
+       archived                    = false
+       auto_init                   = true
+       autodetect_manual_merge     = false
+       avatar_url                  = (known after apply)
+       clone_url                   = (known after apply)
+       created_at                  = (known after apply)
+       default_branch              = "main"
+       default_merge_style         = "merge"
+       description                 = "LLM-powered issue/PR triage bot for git.cmu.dev"
+       empty                       = (known after apply)
+       external_tracker            = (known after apply)
+       external_wiki               = (known after apply)
+       fork                        = (known after apply)
+       forks_count                 = (known after apply)
+       full_name                   = (known after apply)
+       has_actions                 = true
+       has_issues                  = true
+       has_packages                = true
+       has_projects                = true
+       has_pull_requests           = true
+       has_releases                = true
+       has_wiki                    = true
+       html_url                    = (known after apply)
+       id                          = (known after apply)
+       ignore_whitespace_conflicts = false
+       internal                    = (known after apply)
+       internal_tracker            = (known after apply)
+       labels                      = false
+       lfs                         = false
+       milestones                  = false
+       mirror                      = false
+       mirror_interval             = (known after apply)
+       mirror_updated              = (known after apply)
+       name                        = "forge-triage"
+       open_issues_count           = (known after apply)
+       open_pr_counter             = (known after apply)
+       owner                       = "ScottyLabs"
+       parent_id                   = (known after apply)
+       permissions                 = (known after apply)
+       private                     = false
+       release_counter             = (known after apply)
+       size                        = (known after apply)
+       ssh_url                     = (known after apply)
+       stars_count                 = (known after apply)
+       template                    = false
+       trust_model                 = "default"
+       updated_at                  = (known after apply)
+       watchers_count              = (known after apply)
    }

  # forgejo_repository.devops_slop_cop will be created
+ resource "forgejo_repository" "devops_slop_cop" {
+       allow_manual_merge          = false
+       allow_merge_commits         = true
+       allow_rebase                = true
+       allow_rebase_explicit       = true
+       allow_squash_merge          = true
+       archive_on_destroy          = false
+       archived                    = false
+       auto_init                   = true
+       autodetect_manual_merge     = false
+       avatar_url                  = (known after apply)
+       clone_url                   = (known after apply)
+       created_at                  = (known after apply)
+       default_branch              = "main"
+       default_merge_style         = "merge"
+       description                 = "Forgejo webhook bot that cites AI-generated comments and PR descriptions"
+       empty                       = (known after apply)
+       external_tracker            = (known after apply)
+       external_wiki               = (known after apply)
+       fork                        = (known after apply)
+       forks_count                 = (known after apply)
+       full_name                   = (known after apply)
+       has_actions                 = true
+       has_issues                  = true
+       has_packages                = true
+       has_projects                = true
+       has_pull_requests           = true
+       has_releases                = true
+       has_wiki                    = true
+       html_url                    = (known after apply)
+       id                          = (known after apply)
+       ignore_whitespace_conflicts = false
+       internal                    = (known after apply)
+       internal_tracker            = (known after apply)
+       labels                      = false
+       lfs                         = false
+       milestones                  = false
+       mirror                      = false
+       mirror_interval             = (known after apply)
+       mirror_updated              = (known after apply)
+       name                        = "slop-cop"
+       open_issues_count           = (known after apply)
+       open_pr_counter             = (known after apply)
+       owner                       = "ScottyLabs"
+       parent_id                   = (known after apply)
+       permissions                 = (known after apply)
+       private                     = false
+       release_counter             = (known after apply)
+       size                        = (known after apply)
+       ssh_url                     = (known after apply)
+       stars_count                 = (known after apply)
+       template                    = false
+       trust_model                 = "default"
+       updated_at                  = (known after apply)
+       watchers_count              = (known after apply)
    }

  # forgejo_team.forge-triage_leads will be created
+ resource "forgejo_team" "forge-triage_leads" {
+       can_create_org_repo       = false
+       description               = "Forge Triage leads"
+       id                        = (known after apply)
+       includes_all_repositories = false
+       name                      = "forge-triage-leads"
+       organization              = (known after apply)
+       organization_id           = 3
+       permission                = "admin"
+       units_map                 = {
          + "repo.actions"    = "admin"
          + "repo.code"       = "admin"
          + "repo.ext_issues" = "admin"
          + "repo.ext_wiki"   = "admin"
          + "repo.issues"     = "admin"
          + "repo.packages"   = "admin"
          + "repo.projects"   = "admin"
          + "repo.pulls"      = "admin"
          + "repo.releases"   = "admin"
          + "repo.wiki"       = "admin"
        }
    }

  # forgejo_team.slop-cop_leads will be created
+ resource "forgejo_team" "slop-cop_leads" {
+       can_create_org_repo       = false
+       description               = "Slop Cop leads"
+       id                        = (known after apply)
+       includes_all_repositories = false
+       name                      = "slop-cop-leads"
+       organization              = (known after apply)
+       organization_id           = 3
+       permission                = "admin"
+       units_map                 = {
          + "repo.actions"    = "admin"
          + "repo.code"       = "admin"
          + "repo.ext_issues" = "admin"
          + "repo.ext_wiki"   = "admin"
          + "repo.issues"     = "admin"
          + "repo.packages"   = "admin"
          + "repo.projects"   = "admin"
          + "repo.pulls"      = "admin"
          + "repo.releases"   = "admin"
          + "repo.wiki"       = "admin"
        }
    }

  # forgejo_team_member.forge-triage_leads_anish will be created
+ resource "forgejo_team_member" "forge-triage_leads_anish" {
+       team_id = (known after apply)
+       user    = "anish"
    }

  # forgejo_team_member.forge-triage_leads_thesuperrl will be created
+ resource "forgejo_team_member" "forge-triage_leads_thesuperrl" {
+       team_id = (known after apply)
+       user    = "thesuperrl"
    }

  # forgejo_team_member.slop-cop_leads_anish will be created
+ resource "forgejo_team_member" "slop-cop_leads_anish" {
+       team_id = (known after apply)
+       user    = "anish"
    }

  # forgejo_team_member.slop-cop_leads_thesuperrl will be created
+ resource "forgejo_team_member" "slop-cop_leads_thesuperrl" {
+       team_id = (known after apply)
+       user    = "thesuperrl"
    }

  # forgejo_team_repository.devops_forge_triage will be created
+ resource "forgejo_team_repository" "devops_forge_triage" {
+       owner      = "ScottyLabs"
+       repository = "forge-triage"
+       team_id    = 4
    }

  # forgejo_team_repository.devops_slop_cop will be created
+ resource "forgejo_team_repository" "devops_slop_cop" {
+       owner      = "ScottyLabs"
+       repository = "slop-cop"
+       team_id    = 4
    }

  # forgejo_team_repository.forge-triage_leads_forge_triage will be created
+ resource "forgejo_team_repository" "forge-triage_leads_forge_triage" {
+       owner      = "ScottyLabs"
+       repository = "forge-triage"
+       team_id    = (known after apply)
    }

  # forgejo_team_repository.slop-cop_leads_slop_cop will be created
+ resource "forgejo_team_repository" "slop-cop_leads_slop_cop" {
+       owner      = "ScottyLabs"
+       repository = "slop-cop"
+       team_id    = (known after apply)
    }

  # github_actions_repository_permissions.devops_forge_triage_actions will be created
+ resource "github_actions_repository_permissions" "devops_forge_triage_actions" {
+       enabled              = false
+       id                   = (known after apply)
+       repository           = "forge-triage"
+       sha_pinning_required = (known after apply)
    }

  # github_actions_repository_permissions.devops_slop_cop_actions will be created
+ resource "github_actions_repository_permissions" "devops_slop_cop_actions" {
+       enabled              = false
+       id                   = (known after apply)
+       repository           = "slop-cop"
+       sha_pinning_required = (known after apply)
    }

  # github_repository.devops_forge_triage will be created
+ resource "github_repository" "devops_forge_triage" {
+       allow_auto_merge                        = false
+       allow_forking                           = (known after apply)
+       allow_merge_commit                      = true
+       allow_rebase_merge                      = true
+       allow_squash_merge                      = true
+       archived                                = false
+       default_branch                          = (known after apply)
+       delete_branch_on_merge                  = false
+       description                             = "READ-ONLY MIRROR"
+       etag                                    = (known after apply)
+       fork                                    = (known after apply)
+       full_name                               = (known after apply)
+       git_clone_url                           = (known after apply)
+       has_discussions                         = false
+       has_issues                              = false
+       has_projects                            = false
+       has_wiki                                = false
+       homepage_url                            = "https://git.cmu.dev/ScottyLabs/forge-triage"
+       html_url                                = (known after apply)
+       http_clone_url                          = (known after apply)
+       id                                      = (known after apply)
+       ignore_vulnerability_alerts_during_read = false
+       merge_commit_message                    = "PR_TITLE"
+       merge_commit_title                      = "MERGE_MESSAGE"
+       name                                    = "forge-triage"
+       node_id                                 = (known after apply)
+       primary_language                        = (known after apply)
+       private                                 = (known after apply)
+       repo_id                                 = (known after apply)
+       source_owner                            = (known after apply)
+       source_repo                             = (known after apply)
+       squash_merge_commit_message             = "COMMIT_MESSAGES"
+       squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
+       ssh_clone_url                           = (known after apply)
+       svn_url                                 = (known after apply)
+       topics                                  = (known after apply)
+       visibility                              = "public"
+       vulnerability_alerts                    = (known after apply)
+       web_commit_signoff_required             = (known after apply)

+       security_and_analysis (known after apply)
    }

  # github_repository.devops_slop_cop will be created
+ resource "github_repository" "devops_slop_cop" {
+       allow_auto_merge                        = false
+       allow_forking                           = (known after apply)
+       allow_merge_commit                      = true
+       allow_rebase_merge                      = true
+       allow_squash_merge                      = true
+       archived                                = false
+       default_branch                          = (known after apply)
+       delete_branch_on_merge                  = false
+       description                             = "READ-ONLY MIRROR"
+       etag                                    = (known after apply)
+       fork                                    = (known after apply)
+       full_name                               = (known after apply)
+       git_clone_url                           = (known after apply)
+       has_discussions                         = false
+       has_issues                              = false
+       has_projects                            = false
+       has_wiki                                = false
+       homepage_url                            = "https://git.cmu.dev/ScottyLabs/slop-cop"
+       html_url                                = (known after apply)
+       http_clone_url                          = (known after apply)
+       id                                      = (known after apply)
+       ignore_vulnerability_alerts_during_read = false
+       merge_commit_message                    = "PR_TITLE"
+       merge_commit_title                      = "MERGE_MESSAGE"
+       name                                    = "slop-cop"
+       node_id                                 = (known after apply)
+       primary_language                        = (known after apply)
+       private                                 = (known after apply)
+       repo_id                                 = (known after apply)
+       source_owner                            = (known after apply)
+       source_repo                             = (known after apply)
+       squash_merge_commit_message             = "COMMIT_MESSAGES"
+       squash_merge_commit_title               = "COMMIT_OR_PR_TITLE"
+       ssh_clone_url                           = (known after apply)
+       svn_url                                 = (known after apply)
+       topics                                  = (known after apply)
+       visibility                              = "public"
+       vulnerability_alerts                    = (known after apply)
+       web_commit_signoff_required             = (known after apply)

+       security_and_analysis (known after apply)
    }

  # github_repository_deploy_key.devops_forge_triage_mirror_deploy_key will be created
+ resource "github_repository_deploy_key" "devops_forge_triage_mirror_deploy_key" {
+       etag       = (known after apply)
+       id         = (known after apply)
+       key        = (known after apply)
+       read_only  = false
+       repository = "forge-triage"
+       title      = "Forgejo mirror"
    }

  # github_repository_deploy_key.devops_slop_cop_mirror_deploy_key will be created
+ resource "github_repository_deploy_key" "devops_slop_cop_mirror_deploy_key" {
+       etag       = (known after apply)
+       id         = (known after apply)
+       key        = (known after apply)
+       read_only  = false
+       repository = "slop-cop"
+       title      = "Forgejo mirror"
    }

  # github_repository_ruleset.devops_forge_triage_ruleset will be created
+ resource "github_repository_ruleset" "devops_forge_triage_ruleset" {
+       enforcement = "active"
+       etag        = (known after apply)
+       id          = (known after apply)
+       name        = "Default"
+       node_id     = (known after apply)
+       repository  = "forge-triage"
+       ruleset_id  = (known after apply)
+       target      = "branch"

+       bypass_actors {
+           actor_id    = (known after apply)
+           actor_type  = "DeployKey"
+           bypass_mode = "always"
        }

+       conditions {
+           ref_name {
+               exclude = []
+               include = [
+                   "~ALL",
                ]
            }
        }

+       rules {
+           creation                      = true
+           deletion                      = true
+           non_fast_forward              = true
+           update                        = true
+           update_allows_fetch_and_merge = false

+           pull_request {
+               allowed_merge_methods             = (known after apply)
+               dismiss_stale_reviews_on_push     = false
+               require_code_owner_review         = false
+               require_last_push_approval        = false
+               required_approving_review_count   = 1
+               required_review_thread_resolution = false
            }
        }
    }

  # github_repository_ruleset.devops_slop_cop_ruleset will be created
+ resource "github_repository_ruleset" "devops_slop_cop_ruleset" {
+       enforcement = "active"
+       etag        = (known after apply)
+       id          = (known after apply)
+       name        = "Default"
+       node_id     = (known after apply)
+       repository  = "slop-cop"
+       ruleset_id  = (known after apply)
+       target      = "branch"

+       bypass_actors {
+           actor_id    = (known after apply)
+           actor_type  = "DeployKey"
+           bypass_mode = "always"
        }

+       conditions {
+           ref_name {
+               exclude = []
+               include = [
+                   "~ALL",
                ]
            }
        }

+       rules {
+           creation                      = true
+           deletion                      = true
+           non_fast_forward              = true
+           update                        = true
+           update_allows_fetch_and_merge = false

+           pull_request {
+               allowed_merge_methods             = (known after apply)
+               dismiss_stale_reviews_on_push     = false
+               require_code_owner_review         = false
+               require_last_push_approval        = false
+               required_approving_review_count   = 1
+               required_review_thread_resolution = false
            }
        }
    }

  # restapi_object.devops_forge_triage_kennel_webhook will be created
+ resource "restapi_object" "devops_forge_triage_kennel_webhook" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = (sensitive value)
+       id              = (known after apply)
+       id_attribute    = "id"
+       path            = "/api/v1/repos/ScottyLabs/forge-triage/hooks"
+       update_method   = "PATCH"
    }

  # restapi_object.devops_forge_triage_push_mirror will be created
+ resource "restapi_object" "devops_forge_triage_push_mirror" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = jsonencode(
            {
+               interval       = "8h0m0s"
+               remote_address = "git@github.com:ScottyLabs/forge-triage.git"
+               sync_on_commit = true
+               use_ssh        = true
            }
        )
+       id              = (known after apply)
+       id_attribute    = "remote_name"
+       path            = "/api/v1/repos/ScottyLabs/forge-triage/push_mirrors"
    }

  # restapi_object.devops_slop_cop_kennel_webhook will be created
+ resource "restapi_object" "devops_slop_cop_kennel_webhook" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = (sensitive value)
+       id              = (known after apply)
+       id_attribute    = "id"
+       path            = "/api/v1/repos/ScottyLabs/slop-cop/hooks"
+       update_method   = "PATCH"
    }

  # restapi_object.devops_slop_cop_push_mirror will be created
+ resource "restapi_object" "devops_slop_cop_push_mirror" {
+       api_data        = (known after apply)
+       api_response    = (known after apply)
+       create_response = (known after apply)
+       data            = jsonencode(
            {
+               interval       = "8h0m0s"
+               remote_address = "git@github.com:ScottyLabs/slop-cop.git"
+               sync_on_commit = true
+               use_ssh        = true
            }
        )
+       id              = (known after apply)
+       id_attribute    = "remote_name"
+       path            = "/api/v1/repos/ScottyLabs/slop-cop/push_mirrors"
    }

Plan: 24 to add, 0 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p git
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p git

Plan: 24 to add, 0 to change, 0 to destroy.

5. project: sentry dir: tofu/sentry workspace: default

Show Output 
Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on build directory
    Finished `release` profile [optimized] target(s) in 7.86s


OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

OpenTofu will perform the following actions:

  # sentry_key.devops_forge_triage will be created
+ resource "sentry_key" "devops_forge_triage" {
+       dsn                      = (sensitive value)
+       dsn_csp                  = (known after apply)
+       dsn_public               = (known after apply)
+       dsn_secret               = (sensitive value)
+       id                       = (known after apply)
+       javascript_loader_script = (known after apply)
+       name                     = "default"
+       organization             = "scottylabs"
+       project                  = "forge-triage"
+       project_id               = (known after apply)
+       public                   = (known after apply)
+       rate_limit_count         = (known after apply)
+       rate_limit_window        = (known after apply)
+       secret                   = (sensitive value)
    }

  # sentry_key.devops_slop_cop will be created
+ resource "sentry_key" "devops_slop_cop" {
+       dsn                      = (sensitive value)
+       dsn_csp                  = (known after apply)
+       dsn_public               = (known after apply)
+       dsn_secret               = (sensitive value)
+       id                       = (known after apply)
+       javascript_loader_script = (known after apply)
+       name                     = "default"
+       organization             = "scottylabs"
+       project                  = "slop-cop"
+       project_id               = (known after apply)
+       public                   = (known after apply)
+       rate_limit_count         = (known after apply)
+       rate_limit_window        = (known after apply)
+       secret                   = (sensitive value)
    }

  # sentry_project.devops_forge_triage will be created
+ resource "sentry_project" "devops_forge_triage" {
+       client_security       = (known after apply)
+       digests_max_delay     = (known after apply)
+       digests_min_delay     = (known after apply)
+       features              = (known after apply)
+       filters               = (known after apply)
+       fingerprinting_rules  = (known after apply)
+       grouping_enhancements = (known after apply)
+       highlight_tags        = (known after apply)
+       id                    = (known after apply)
+       internal_id           = (known after apply)
+       name                  = "forge-triage"
+       organization          = "scottylabs"
+       platform              = "rust"
+       resolve_age           = (known after apply)
+       slug                  = "forge-triage"
+       teams                 = [
+           "devops",
        ]
    }

  # sentry_project.devops_slop_cop will be created
+ resource "sentry_project" "devops_slop_cop" {
+       client_security       = (known after apply)
+       digests_max_delay     = (known after apply)
+       digests_min_delay     = (known after apply)
+       features              = (known after apply)
+       filters               = (known after apply)
+       fingerprinting_rules  = (known after apply)
+       grouping_enhancements = (known after apply)
+       highlight_tags        = (known after apply)
+       id                    = (known after apply)
+       internal_id           = (known after apply)
+       name                  = "slop-cop"
+       organization          = "scottylabs"
+       platform              = "rust"
+       resolve_age           = (known after apply)
+       slug                  = "slop-cop"
+       teams                 = [
+           "devops",
        ]
    }

  # vault_kv_secret_v2.devops_forge_triage_sentry_dsn will be created
+ resource "vault_kv_secret_v2" "devops_forge_triage_sentry_dsn" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/forge-triage/prod/SENTRY_DSN"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

  # vault_kv_secret_v2.devops_slop_cop_sentry_dsn will be created
+ resource "vault_kv_secret_v2" "devops_slop_cop_sentry_dsn" {
+       data                = (sensitive value)
+       data_json           = (sensitive value)
+       data_json_wo        = (write-only attribute)
+       delete_all_versions = false
+       disable_read        = false
+       id                  = (known after apply)
+       metadata            = (known after apply)
+       mount               = "secret"
+       name                = "secretspec/slop-cop/prod/SENTRY_DSN"
+       path                = (known after apply)

+       custom_metadata (known after apply)
    }

Plan: 6 to add, 0 to change, 0 to destroy.
  • ▶️ To apply this plan, comment: 
    atlantis apply -p sentry
  • 🚮 To delete this plan and lock, click here
  • 🔁 To plan this project again, comment: 
    atlantis plan -p sentry

Plan: 6 to add, 0 to change, 0 to destroy.

Plan Summary

5 projects, 5 with changes, 0 with no changes, 0 failed

  • ⏩ To apply all unapplied plans from this Pull Request, comment: 
    atlantis apply
  • 🚮 To delete all plans and locks from this Pull Request, comment: 
    atlantis unlock
Ran Plan for 5 projects: 1. project: `openbao` dir: `tofu/openbao` workspace: `default` 1. project: `litellm` dir: `tofu/litellm` workspace: `default` 1. project: `keycloak` dir: `tofu/keycloak` workspace: `default` 1. project: `git` dir: `tofu/git` workspace: `default` 1. project: `sentry` dir: `tofu/sentry` workspace: `default` --- ### 1. project: `openbao` dir: `tofu/openbao` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 7.84s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # vault_identity_group.forge-triage_admins will be created + resource "vault_identity_group" "forge-triage_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "forge-triage-admins" + policies = [ + "forge-triage-prod", ] + type = "external" } # vault_identity_group.forge-triage_members will be created + resource "vault_identity_group" "forge-triage_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "forge-triage-members" + policies = [ + "forge-triage-dev", ] + type = "external" } # vault_identity_group.slop-cop_admins will be created + resource "vault_identity_group" "slop-cop_admins" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slop-cop-admins" + policies = [ + "slop-cop-prod", ] + type = "external" } # vault_identity_group.slop-cop_members will be created + resource "vault_identity_group" "slop-cop_members" { + external_member_entity_ids = false + external_member_group_ids = false + external_policies = false + id = (known after apply) + name = "slop-cop-members" + policies = [ + "slop-cop-dev", ] + type = "external" } # vault_identity_group_alias.forge-triage_admins will be created + resource "vault_identity_group_alias" "forge-triage_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/forge-triage/admins" } # vault_identity_group_alias.forge-triage_members will be created + resource "vault_identity_group_alias" "forge-triage_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/forge-triage" } # vault_identity_group_alias.slop-cop_admins will be created + resource "vault_identity_group_alias" "slop-cop_admins" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slop-cop/admins" } # vault_identity_group_alias.slop-cop_members will be created + resource "vault_identity_group_alias" "slop-cop_members" { + canonical_id = (known after apply) + id = (known after apply) + mount_accessor = "auth_oidc_375ac979" + name = "/projects/slop-cop" } # vault_policy.forge-triage_dev will be created + resource "vault_policy" "forge-triage_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "forge-triage-dev" + policy = <<-EOT path "secret/data/secretspec/forge-triage/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/forge-triage/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/forge-triage/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/forge-triage/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.forge-triage_prod will be created + resource "vault_policy" "forge-triage_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "forge-triage-prod" + policy = <<-EOT path "secret/data/secretspec/forge-triage/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/forge-triage/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/forge-triage/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/forge-triage/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/forge-triage/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/forge-triage/ci/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slop-cop_dev will be created + resource "vault_policy" "slop-cop_dev" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slop-cop-dev" + policy = <<-EOT path "secret/data/secretspec/slop-cop/dev/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slop-cop/dev/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slop-cop/preview/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slop-cop/preview/*" { capabilities = ["list", "read", "delete"] } EOT } # vault_policy.slop-cop_prod will be created + resource "vault_policy" "slop-cop_prod" { + allow_overwrite = (known after apply) + id = (known after apply) + name = "slop-cop-prod" + policy = <<-EOT path "secret/data/secretspec/slop-cop/prod/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slop-cop/prod/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slop-cop/staging/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slop-cop/staging/*" { capabilities = ["list", "read", "delete"] } path "secret/data/secretspec/slop-cop/ci/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] } path "secret/metadata/secretspec/slop-cop/ci/*" { capabilities = ["list", "read", "delete"] } EOT } Plan: 12 to add, 0 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p openbao ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fopenbao%252Fdefault%252Fopenbao) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p openbao ``` Plan: 12 to add, 0 to change, 0 to destroy. --- ### 2. project: `litellm` dir: `tofu/litellm` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 7.87s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # litellm_key.forge_triage_dev will be created + resource "litellm_key" "forge_triage_dev" { + aliases = (known after apply) + allowed_cache_controls = (known after apply) + allowed_passthrough_routes = (known after apply) + allowed_routes = (known after apply) + blocked = (known after apply) + budget_duration = "monthly" + config = (known after apply) + config_json = (sensitive value) + enforced_params = (known after apply) + guardrails = (known after apply) + id = (known after apply) + key = (sensitive value) + key_alias = "forge-triage-dev" + key_wo = (write-only attribute) + max_budget = 5 + max_parallel_requests = 20 + metadata = (sensitive value) + metadata_json = (sensitive value) + model_max_budget = (known after apply) + model_rpm_limit = (known after apply) + model_tpm_limit = (known after apply) + models = (known after apply) + permissions = (known after apply) + permissions_json = (sensitive value) + prompts = (known after apply) + rpm_limit = 200 + send_invite_email = (write-only attribute) + soft_budget = (known after apply) + tags = (known after apply) + team_id = "1dfbef19-a385-460a-9220-5b23e05ddaae" + tpm_limit = 1000000 } # litellm_key.forge_triage_prod will be created + resource "litellm_key" "forge_triage_prod" { + aliases = (known after apply) + allowed_cache_controls = (known after apply) + allowed_passthrough_routes = (known after apply) + allowed_routes = (known after apply) + blocked = (known after apply) + budget_duration = "monthly" + config = (known after apply) + config_json = (sensitive value) + enforced_params = (known after apply) + guardrails = (known after apply) + id = (known after apply) + key = (sensitive value) + key_alias = "forge-triage-prod" + key_wo = (write-only attribute) + max_budget = 20 + max_parallel_requests = 100 + metadata = (sensitive value) + metadata_json = (sensitive value) + model_max_budget = (known after apply) + model_rpm_limit = (known after apply) + model_tpm_limit = (known after apply) + models = (known after apply) + permissions = (known after apply) + permissions_json = (sensitive value) + prompts = (known after apply) + rpm_limit = 1000 + send_invite_email = (write-only attribute) + soft_budget = (known after apply) + tags = (known after apply) + team_id = "1dfbef19-a385-460a-9220-5b23e05ddaae" + tpm_limit = 4000000 } # vault_kv_secret_v2.forge_triage_dev_litellm_api_key will be created + resource "vault_kv_secret_v2" "forge_triage_dev_litellm_api_key" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/dev/LITELLM_API_KEY" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_dev_litellm_base_url will be created + resource "vault_kv_secret_v2" "forge_triage_dev_litellm_base_url" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/dev/LITELLM_BASE_URL" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_preview_litellm_api_key will be created + resource "vault_kv_secret_v2" "forge_triage_preview_litellm_api_key" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/preview/LITELLM_API_KEY" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_preview_litellm_base_url will be created + resource "vault_kv_secret_v2" "forge_triage_preview_litellm_base_url" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/preview/LITELLM_BASE_URL" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_prod_litellm_api_key will be created + resource "vault_kv_secret_v2" "forge_triage_prod_litellm_api_key" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/prod/LITELLM_API_KEY" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_prod_litellm_base_url will be created + resource "vault_kv_secret_v2" "forge_triage_prod_litellm_base_url" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/prod/LITELLM_BASE_URL" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_staging_litellm_api_key will be created + resource "vault_kv_secret_v2" "forge_triage_staging_litellm_api_key" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/staging/LITELLM_API_KEY" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.forge_triage_staging_litellm_base_url will be created + resource "vault_kv_secret_v2" "forge_triage_staging_litellm_base_url" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/staging/LITELLM_BASE_URL" + path = (known after apply) + custom_metadata (known after apply) } Plan: 10 to add, 0 to change, 0 to destroy. ╷ │ Warning: Deprecated Resource │ │ with data.vault_kv_secret_v2.litellm_master_key, │ on data.tf.json line 7, in data.vault_kv_secret_v2.litellm_master_key: │ 7: } │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead │ │ (and one more similar warning elsewhere) ╵ ╷ │ Warning: Value derived from a deprecated source │ │ on providers.tf.json line 33, in provider.litellm: │ 33: }, │ │ This value is derived from data.vault_kv_secret_v2.litellm_master_key, │ which is deprecated with the following message: │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead ╵ ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p litellm ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Flitellm%252Fdefault%252Flitellm) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p litellm ``` Plan: 10 to add, 0 to change, 0 to destroy. --- ### 3. project: `keycloak` dir: `tofu/keycloak` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Compiling governance-schema v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-schema) Compiling governance-core v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-core) Compiling governance-tfgen v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-tfgen) Compiling governance v0.1.0 (/var/lib/atlantis/repos/ScottyLabs/governance/462/default/crates/governance-cli) Finished `release` profile [optimized] target(s) in 7.85s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # keycloak_group.project_devops_forge-triage will be created + resource "keycloak_group" "project_devops_forge-triage" { + id = (known after apply) + name = "forge-triage" + parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_devops_forge-triage_admins will be created + resource "keycloak_group" "project_devops_forge-triage_admins" { + id = (known after apply) + name = "admins" + parent_id = (known after apply) + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_devops_slop-cop will be created + resource "keycloak_group" "project_devops_slop-cop" { + id = (known after apply) + name = "slop-cop" + parent_id = "9e6890c8-50a0-4b82-86b9-91791fffac25" + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group.project_devops_slop-cop_admins will be created + resource "keycloak_group" "project_devops_slop-cop_admins" { + id = (known after apply) + name = "admins" + parent_id = (known after apply) + path = (known after apply) + realm_id = "scottylabs" } # keycloak_group_memberships.project_devops_forge-triage will be created + resource "keycloak_group_memberships" "project_devops_forge-triage" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "aszhou", + "azzhou", + "brightz", + "jhhan2", + "joohank", + "junwonp", + "rjwu", + "ryanli2", + "saniyav", + "spola2", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_devops_forge-triage_admins will be created + resource "keycloak_group_memberships" "project_devops_forge-triage_admins" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "ryanli2", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_devops_slop-cop will be created + resource "keycloak_group_memberships" "project_devops_slop-cop" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "aszhou", + "azzhou", + "brightz", + "jhhan2", + "joohank", + "junwonp", + "rjwu", + "ryanli2", + "saniyav", + "spola2", ] + realm_id = "scottylabs" } # keycloak_group_memberships.project_devops_slop-cop_admins will be created + resource "keycloak_group_memberships" "project_devops_slop-cop_admins" { + group_id = (known after apply) + id = (known after apply) + members = [ + "apallati", + "ryanli2", ] + realm_id = "scottylabs" } Plan: 8 to add, 0 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p keycloak ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fkeycloak%252Fdefault%252Fkeycloak) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p keycloak ``` Plan: 8 to add, 0 to change, 0 to destroy. --- ### 4. project: `git` dir: `tofu/git` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 7.85s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # forgejo_repository.devops_forge_triage will be created + resource "forgejo_repository" "devops_forge_triage" { + allow_manual_merge = false + allow_merge_commits = true + allow_rebase = true + allow_rebase_explicit = true + allow_squash_merge = true + archive_on_destroy = false + archived = false + auto_init = true + autodetect_manual_merge = false + avatar_url = (known after apply) + clone_url = (known after apply) + created_at = (known after apply) + default_branch = "main" + default_merge_style = "merge" + description = "LLM-powered issue/PR triage bot for git.cmu.dev" + empty = (known after apply) + external_tracker = (known after apply) + external_wiki = (known after apply) + fork = (known after apply) + forks_count = (known after apply) + full_name = (known after apply) + has_actions = true + has_issues = true + has_packages = true + has_projects = true + has_pull_requests = true + has_releases = true + has_wiki = true + html_url = (known after apply) + id = (known after apply) + ignore_whitespace_conflicts = false + internal = (known after apply) + internal_tracker = (known after apply) + labels = false + lfs = false + milestones = false + mirror = false + mirror_interval = (known after apply) + mirror_updated = (known after apply) + name = "forge-triage" + open_issues_count = (known after apply) + open_pr_counter = (known after apply) + owner = "ScottyLabs" + parent_id = (known after apply) + permissions = (known after apply) + private = false + release_counter = (known after apply) + size = (known after apply) + ssh_url = (known after apply) + stars_count = (known after apply) + template = false + trust_model = "default" + updated_at = (known after apply) + watchers_count = (known after apply) } # forgejo_repository.devops_slop_cop will be created + resource "forgejo_repository" "devops_slop_cop" { + allow_manual_merge = false + allow_merge_commits = true + allow_rebase = true + allow_rebase_explicit = true + allow_squash_merge = true + archive_on_destroy = false + archived = false + auto_init = true + autodetect_manual_merge = false + avatar_url = (known after apply) + clone_url = (known after apply) + created_at = (known after apply) + default_branch = "main" + default_merge_style = "merge" + description = "Forgejo webhook bot that cites AI-generated comments and PR descriptions" + empty = (known after apply) + external_tracker = (known after apply) + external_wiki = (known after apply) + fork = (known after apply) + forks_count = (known after apply) + full_name = (known after apply) + has_actions = true + has_issues = true + has_packages = true + has_projects = true + has_pull_requests = true + has_releases = true + has_wiki = true + html_url = (known after apply) + id = (known after apply) + ignore_whitespace_conflicts = false + internal = (known after apply) + internal_tracker = (known after apply) + labels = false + lfs = false + milestones = false + mirror = false + mirror_interval = (known after apply) + mirror_updated = (known after apply) + name = "slop-cop" + open_issues_count = (known after apply) + open_pr_counter = (known after apply) + owner = "ScottyLabs" + parent_id = (known after apply) + permissions = (known after apply) + private = false + release_counter = (known after apply) + size = (known after apply) + ssh_url = (known after apply) + stars_count = (known after apply) + template = false + trust_model = "default" + updated_at = (known after apply) + watchers_count = (known after apply) } # forgejo_team.forge-triage_leads will be created + resource "forgejo_team" "forge-triage_leads" { + can_create_org_repo = false + description = "Forge Triage leads" + id = (known after apply) + includes_all_repositories = false + name = "forge-triage-leads" + organization = (known after apply) + organization_id = 3 + permission = "admin" + units_map = { + "repo.actions" = "admin" + "repo.code" = "admin" + "repo.ext_issues" = "admin" + "repo.ext_wiki" = "admin" + "repo.issues" = "admin" + "repo.packages" = "admin" + "repo.projects" = "admin" + "repo.pulls" = "admin" + "repo.releases" = "admin" + "repo.wiki" = "admin" } } # forgejo_team.slop-cop_leads will be created + resource "forgejo_team" "slop-cop_leads" { + can_create_org_repo = false + description = "Slop Cop leads" + id = (known after apply) + includes_all_repositories = false + name = "slop-cop-leads" + organization = (known after apply) + organization_id = 3 + permission = "admin" + units_map = { + "repo.actions" = "admin" + "repo.code" = "admin" + "repo.ext_issues" = "admin" + "repo.ext_wiki" = "admin" + "repo.issues" = "admin" + "repo.packages" = "admin" + "repo.projects" = "admin" + "repo.pulls" = "admin" + "repo.releases" = "admin" + "repo.wiki" = "admin" } } # forgejo_team_member.forge-triage_leads_anish will be created + resource "forgejo_team_member" "forge-triage_leads_anish" { + team_id = (known after apply) + user = "anish" } # forgejo_team_member.forge-triage_leads_thesuperrl will be created + resource "forgejo_team_member" "forge-triage_leads_thesuperrl" { + team_id = (known after apply) + user = "thesuperrl" } # forgejo_team_member.slop-cop_leads_anish will be created + resource "forgejo_team_member" "slop-cop_leads_anish" { + team_id = (known after apply) + user = "anish" } # forgejo_team_member.slop-cop_leads_thesuperrl will be created + resource "forgejo_team_member" "slop-cop_leads_thesuperrl" { + team_id = (known after apply) + user = "thesuperrl" } # forgejo_team_repository.devops_forge_triage will be created + resource "forgejo_team_repository" "devops_forge_triage" { + owner = "ScottyLabs" + repository = "forge-triage" + team_id = 4 } # forgejo_team_repository.devops_slop_cop will be created + resource "forgejo_team_repository" "devops_slop_cop" { + owner = "ScottyLabs" + repository = "slop-cop" + team_id = 4 } # forgejo_team_repository.forge-triage_leads_forge_triage will be created + resource "forgejo_team_repository" "forge-triage_leads_forge_triage" { + owner = "ScottyLabs" + repository = "forge-triage" + team_id = (known after apply) } # forgejo_team_repository.slop-cop_leads_slop_cop will be created + resource "forgejo_team_repository" "slop-cop_leads_slop_cop" { + owner = "ScottyLabs" + repository = "slop-cop" + team_id = (known after apply) } # github_actions_repository_permissions.devops_forge_triage_actions will be created + resource "github_actions_repository_permissions" "devops_forge_triage_actions" { + enabled = false + id = (known after apply) + repository = "forge-triage" + sha_pinning_required = (known after apply) } # github_actions_repository_permissions.devops_slop_cop_actions will be created + resource "github_actions_repository_permissions" "devops_slop_cop_actions" { + enabled = false + id = (known after apply) + repository = "slop-cop" + sha_pinning_required = (known after apply) } # github_repository.devops_forge_triage will be created + resource "github_repository" "devops_forge_triage" { + allow_auto_merge = false + allow_forking = (known after apply) + allow_merge_commit = true + allow_rebase_merge = true + allow_squash_merge = true + archived = false + default_branch = (known after apply) + delete_branch_on_merge = false + description = "READ-ONLY MIRROR" + etag = (known after apply) + fork = (known after apply) + full_name = (known after apply) + git_clone_url = (known after apply) + has_discussions = false + has_issues = false + has_projects = false + has_wiki = false + homepage_url = "https://git.cmu.dev/ScottyLabs/forge-triage" + html_url = (known after apply) + http_clone_url = (known after apply) + id = (known after apply) + ignore_vulnerability_alerts_during_read = false + merge_commit_message = "PR_TITLE" + merge_commit_title = "MERGE_MESSAGE" + name = "forge-triage" + node_id = (known after apply) + primary_language = (known after apply) + private = (known after apply) + repo_id = (known after apply) + source_owner = (known after apply) + source_repo = (known after apply) + squash_merge_commit_message = "COMMIT_MESSAGES" + squash_merge_commit_title = "COMMIT_OR_PR_TITLE" + ssh_clone_url = (known after apply) + svn_url = (known after apply) + topics = (known after apply) + visibility = "public" + vulnerability_alerts = (known after apply) + web_commit_signoff_required = (known after apply) + security_and_analysis (known after apply) } # github_repository.devops_slop_cop will be created + resource "github_repository" "devops_slop_cop" { + allow_auto_merge = false + allow_forking = (known after apply) + allow_merge_commit = true + allow_rebase_merge = true + allow_squash_merge = true + archived = false + default_branch = (known after apply) + delete_branch_on_merge = false + description = "READ-ONLY MIRROR" + etag = (known after apply) + fork = (known after apply) + full_name = (known after apply) + git_clone_url = (known after apply) + has_discussions = false + has_issues = false + has_projects = false + has_wiki = false + homepage_url = "https://git.cmu.dev/ScottyLabs/slop-cop" + html_url = (known after apply) + http_clone_url = (known after apply) + id = (known after apply) + ignore_vulnerability_alerts_during_read = false + merge_commit_message = "PR_TITLE" + merge_commit_title = "MERGE_MESSAGE" + name = "slop-cop" + node_id = (known after apply) + primary_language = (known after apply) + private = (known after apply) + repo_id = (known after apply) + source_owner = (known after apply) + source_repo = (known after apply) + squash_merge_commit_message = "COMMIT_MESSAGES" + squash_merge_commit_title = "COMMIT_OR_PR_TITLE" + ssh_clone_url = (known after apply) + svn_url = (known after apply) + topics = (known after apply) + visibility = "public" + vulnerability_alerts = (known after apply) + web_commit_signoff_required = (known after apply) + security_and_analysis (known after apply) } # github_repository_deploy_key.devops_forge_triage_mirror_deploy_key will be created + resource "github_repository_deploy_key" "devops_forge_triage_mirror_deploy_key" { + etag = (known after apply) + id = (known after apply) + key = (known after apply) + read_only = false + repository = "forge-triage" + title = "Forgejo mirror" } # github_repository_deploy_key.devops_slop_cop_mirror_deploy_key will be created + resource "github_repository_deploy_key" "devops_slop_cop_mirror_deploy_key" { + etag = (known after apply) + id = (known after apply) + key = (known after apply) + read_only = false + repository = "slop-cop" + title = "Forgejo mirror" } # github_repository_ruleset.devops_forge_triage_ruleset will be created + resource "github_repository_ruleset" "devops_forge_triage_ruleset" { + enforcement = "active" + etag = (known after apply) + id = (known after apply) + name = "Default" + node_id = (known after apply) + repository = "forge-triage" + ruleset_id = (known after apply) + target = "branch" + bypass_actors { + actor_id = (known after apply) + actor_type = "DeployKey" + bypass_mode = "always" } + conditions { + ref_name { + exclude = [] + include = [ + "~ALL", ] } } + rules { + creation = true + deletion = true + non_fast_forward = true + update = true + update_allows_fetch_and_merge = false + pull_request { + allowed_merge_methods = (known after apply) + dismiss_stale_reviews_on_push = false + require_code_owner_review = false + require_last_push_approval = false + required_approving_review_count = 1 + required_review_thread_resolution = false } } } # github_repository_ruleset.devops_slop_cop_ruleset will be created + resource "github_repository_ruleset" "devops_slop_cop_ruleset" { + enforcement = "active" + etag = (known after apply) + id = (known after apply) + name = "Default" + node_id = (known after apply) + repository = "slop-cop" + ruleset_id = (known after apply) + target = "branch" + bypass_actors { + actor_id = (known after apply) + actor_type = "DeployKey" + bypass_mode = "always" } + conditions { + ref_name { + exclude = [] + include = [ + "~ALL", ] } } + rules { + creation = true + deletion = true + non_fast_forward = true + update = true + update_allows_fetch_and_merge = false + pull_request { + allowed_merge_methods = (known after apply) + dismiss_stale_reviews_on_push = false + require_code_owner_review = false + require_last_push_approval = false + required_approving_review_count = 1 + required_review_thread_resolution = false } } } # restapi_object.devops_forge_triage_kennel_webhook will be created + resource "restapi_object" "devops_forge_triage_kennel_webhook" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = (sensitive value) + id = (known after apply) + id_attribute = "id" + path = "/api/v1/repos/ScottyLabs/forge-triage/hooks" + update_method = "PATCH" } # restapi_object.devops_forge_triage_push_mirror will be created + resource "restapi_object" "devops_forge_triage_push_mirror" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = jsonencode( { + interval = "8h0m0s" + remote_address = "git@github.com:ScottyLabs/forge-triage.git" + sync_on_commit = true + use_ssh = true } ) + id = (known after apply) + id_attribute = "remote_name" + path = "/api/v1/repos/ScottyLabs/forge-triage/push_mirrors" } # restapi_object.devops_slop_cop_kennel_webhook will be created + resource "restapi_object" "devops_slop_cop_kennel_webhook" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = (sensitive value) + id = (known after apply) + id_attribute = "id" + path = "/api/v1/repos/ScottyLabs/slop-cop/hooks" + update_method = "PATCH" } # restapi_object.devops_slop_cop_push_mirror will be created + resource "restapi_object" "devops_slop_cop_push_mirror" { + api_data = (known after apply) + api_response = (known after apply) + create_response = (known after apply) + data = jsonencode( { + interval = "8h0m0s" + remote_address = "git@github.com:ScottyLabs/slop-cop.git" + sync_on_commit = true + use_ssh = true } ) + id = (known after apply) + id_attribute = "remote_name" + path = "/api/v1/repos/ScottyLabs/slop-cop/push_mirrors" } Plan: 24 to add, 0 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p git ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fgit%252Fdefault%252Fgit) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p git ``` Plan: 24 to add, 0 to change, 0 to destroy. --- ### 5. project: `sentry` dir: `tofu/sentry` workspace: `default` <details><summary>Show Output</summary> ```diff Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on package cache Blocking waiting for file lock on build directory Finished `release` profile [optimized] target(s) in 7.86s OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # sentry_key.devops_forge_triage will be created + resource "sentry_key" "devops_forge_triage" { + dsn = (sensitive value) + dsn_csp = (known after apply) + dsn_public = (known after apply) + dsn_secret = (sensitive value) + id = (known after apply) + javascript_loader_script = (known after apply) + name = "default" + organization = "scottylabs" + project = "forge-triage" + project_id = (known after apply) + public = (known after apply) + rate_limit_count = (known after apply) + rate_limit_window = (known after apply) + secret = (sensitive value) } # sentry_key.devops_slop_cop will be created + resource "sentry_key" "devops_slop_cop" { + dsn = (sensitive value) + dsn_csp = (known after apply) + dsn_public = (known after apply) + dsn_secret = (sensitive value) + id = (known after apply) + javascript_loader_script = (known after apply) + name = "default" + organization = "scottylabs" + project = "slop-cop" + project_id = (known after apply) + public = (known after apply) + rate_limit_count = (known after apply) + rate_limit_window = (known after apply) + secret = (sensitive value) } # sentry_project.devops_forge_triage will be created + resource "sentry_project" "devops_forge_triage" { + client_security = (known after apply) + digests_max_delay = (known after apply) + digests_min_delay = (known after apply) + features = (known after apply) + filters = (known after apply) + fingerprinting_rules = (known after apply) + grouping_enhancements = (known after apply) + highlight_tags = (known after apply) + id = (known after apply) + internal_id = (known after apply) + name = "forge-triage" + organization = "scottylabs" + platform = "rust" + resolve_age = (known after apply) + slug = "forge-triage" + teams = [ + "devops", ] } # sentry_project.devops_slop_cop will be created + resource "sentry_project" "devops_slop_cop" { + client_security = (known after apply) + digests_max_delay = (known after apply) + digests_min_delay = (known after apply) + features = (known after apply) + filters = (known after apply) + fingerprinting_rules = (known after apply) + grouping_enhancements = (known after apply) + highlight_tags = (known after apply) + id = (known after apply) + internal_id = (known after apply) + name = "slop-cop" + organization = "scottylabs" + platform = "rust" + resolve_age = (known after apply) + slug = "slop-cop" + teams = [ + "devops", ] } # vault_kv_secret_v2.devops_forge_triage_sentry_dsn will be created + resource "vault_kv_secret_v2" "devops_forge_triage_sentry_dsn" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/forge-triage/prod/SENTRY_DSN" + path = (known after apply) + custom_metadata (known after apply) } # vault_kv_secret_v2.devops_slop_cop_sentry_dsn will be created + resource "vault_kv_secret_v2" "devops_slop_cop_sentry_dsn" { + data = (sensitive value) + data_json = (sensitive value) + data_json_wo = (write-only attribute) + delete_all_versions = false + disable_read = false + id = (known after apply) + metadata = (known after apply) + mount = "secret" + name = "secretspec/slop-cop/prod/SENTRY_DSN" + path = (known after apply) + custom_metadata (known after apply) } Plan: 6 to add, 0 to change, 0 to destroy. ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p sentry ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](https://atlantis.scottylabs.org/lock?id=ScottyLabs%252Fgovernance%252Ftofu%252Fsentry%252Fdefault%252Fsentry) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p sentry ``` Plan: 6 to add, 0 to change, 0 to destroy. --- ### Plan Summary 5 projects, 5 with changes, 0 with no changes, 0 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```
thesuperRL commented 2026-10-02 01:58:18 +00:00
Author
Owner
Copy link

atlantis unlock

atlantis unlock
scottylabs-bot commented 2026-10-02 01:58:18 +00:00
Owner
Copy link

All Atlantis locks for this PR have been unlocked and plans discarded

All Atlantis locks for this PR have been unlocked and plans discarded
Some checks failed
atlantis/plan 5/5 projects planned successfully.
CI / build (pull_request) Has been skipped
Details
kennel/build skipped: no services or static sites defined
Details
atlantis/plan: openbao Plan: 12 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: litellm Plan: 10 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: keycloak Plan: 8 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: git Plan: 24 to add, 0 to change, 0 to destroy.
Details
atlantis/plan: sentry Plan: 6 to add, 0 to change, 0 to destroy.
Details
Validate / Governance (pull_request_target) Failing after 10m53s
Details
CI / check-1 (pull_request) Failing after 10m55s
Details
CI / check (pull_request) Failing after 0s
Details
atlantis/pre_workflow_hook: Install local-only OpenTofu providers succeeded.
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin add-slop-cop-and-forge-triage:add-slop-cop-and-forge-triage
git switch add-slop-cop-and-forge-triage

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff add-slop-cop-and-forge-triage
git switch add-slop-cop-and-forge-triage
git rebase main
git switch main
git merge --ff-only add-slop-cop-and-forge-triage
git switch add-slop-cop-and-forge-triage
git rebase main
git switch main
git merge --no-ff add-slop-cop-and-forge-triage
git switch main
git merge --squash add-slop-cop-and-forge-triage
git switch main
git merge --ff-only add-slop-cop-and-forge-triage
git switch main
git merge add-slop-cop-and-forge-triage
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
anish
Labels
Clear labels   
needs/linking
Issue is pending on account linking

  
needs/docs
Must have documentation written

  
needs/research
Discuss the ideal implementation with the tech lead

  
needs/upstream
Needs a contribution to an upstream project

  
type/bug
Something not working as intended

  
type/external
Lives outside of code

  
type/feature
New functionality

  
type/refactor
Improving existing code

  
urgency
high
 This is currently causing issues

  
urgency
immediate
 This is making a project or feature unusable

  
urgency
low
 This can happen whenever

  
urgency
medium
 This is expected to cause issues soon

No labels
needs/linking
needs/docs
needs/research
needs/upstream
type/bug
type/external
type/feature
type/refactor
urgency
high
urgency
immediate
urgency
low
urgency
medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ScottyLabs/governance!462
No description provided.