OSAC-3364: Register new osac mono-repo in Terraform

[eliorerz]

Summary

• Registers the new osac repo (OSAC-1732 mono-repo consolidation target) as a proper Terraform-managed resource, before it's created on GitHub
• Disables allow_squash_merge to enforce the migration's git-history preservation constraint at the platform level (subtree-merge history/blame must survive ongoing PRs, which squash-merging would collapse)
• Leaves required_status_checks empty for now — will be added once OSAC-1734 builds the mono-repo's actual CI

Why

OSAC-1732 consolidates fulfillment-service, osac-operator, osac-aap, and osac-installer into a new osac repo. Creating it via the GitHub UI directly (rather than through this Terraform) would mean it's not managed the same way as every other org repo, and the scheduled apply.yaml (every 4h) would have no record of it.

Test plan

• tofu fmt -check clean
• tofu validate passes (only pre-existing deprecation warnings unrelated to this change)
• Review team/permission choices (currently mirrors fulfillment-service/osac-operator: fulfillment-wg push, wg-infra admin)
• Merge — the actual osac repo gets created on the next tofu apply

Tracking: OSAC-1732, OSAC-3364

Summary by CodeRabbit

• New Features
  • Added a new public osac repository with configured team permissions and access controls.
  • Enabled specified infrastructure-team bypass permissions and bot push allowances.
  • Configured repository merging and status-check policies to preserve existing contribution workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d68411e9-1295-4c76-9573-960e3ff3aa18

📥 Commits

Reviewing files that changed from the base of the PR and between 8813a11 and 52b334e.

📒 Files selected for processing (1)

• repositories.tf

---

Walkthrough

Adds a Terraform module configuring the public osac GitHub repository, including team access, merge behavior, status checks, bypass rules, and push allowances.

Changes

OSAC repository setup

Layer / File(s)	Summary
Repository policy and access configuration repositories.tf	Adds the repo_osac module with team permissions, disabled squash merging, no required status checks, wg-infra bypass access, push allowances, and repository-specific configuration comments.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• osac-project/github-config#134: Updates related OSAC repository merge-queue and status-check configuration.

Suggested reviewers: larsks, masayag, liatb-rh

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the new osac repository to Terraform management.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets, credential-shaped literals, embedded creds URLs, or private-key/base64 blobs were found in the changed Terraform file.
No-Weak-Crypto	✅ Passed	The PR only adds a Terraform repo module; no weak crypto primitives or secret/token comparison code appears in the changed file.
No-Injection-Vectors	✅ Passed	New Terraform module only sets static repo metadata and permissions; no SQL/shell/eval/pickle/yaml/os.system/HTML injection patterns are present.
Container-Privileges	✅ Passed	Changed file is only a Terraform GitHub repo module; no container/K8s manifests or privilege flags were added, and repo-wide searches found none.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR only adds Terraform repo config; no new logging, prints, or secret-bearing outputs were introduced, and the added text contains no sensitive data.
Ai-Attribution	✅ Passed	HEAD commit and PR text mention no AI tools and contain no Co-Authored-By/Assisted-by/Generated-by trailers.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}