feat(teams): allow multiple team associations

* feat(teams): allow assigning multiple teams, given a permission

* feat(dev): switch to just from make

* docs: update README

* docs: update README

* docs(teams): update description of var.teams

* fix(teams): update default for var.teams to {} instead of null

* feat(ci): move check to just for local testing, use in ci

* fix(teams): use count.index to find the correct team id

.github/workflows/flake.yaml

@@ -14,4 +14,4 @@ jobs:
  - uses: DeterminateSystems/nix-installer-action@v4
  - uses: DeterminateSystems/magic-nix-cache-action@v2
  - run: nix flake check
- - run: nix build --json --no-link --print-build-logs
+ - run: nix develop -c just check

README.md

@@ -46,7 +46,7 @@ No modules.
 | <a name="input_name"></a> [name](#input\_name) | The name of the repository | `string` | n/a | yes |
 | <a name="input_owner"></a> [owner](#input\_owner) | The name of the repository | `string` | n/a | yes |
 | <a name="input_required_status_checks_contexts"></a> [required\_status\_checks\_contexts](#input\_required\_status\_checks\_contexts) | The list of status checks to require in order to merge into this branch | `list(string)` | `[]` | no |
-| <a name="input_team_slug"></a> [team\_slug](#input\_team\_slug) | The slug of the team to grant access to | `string` | `null` | no |
+| <a name="input_teams"></a> [teams](#input\_teams) | The teams to grant access to, and their permission levels | `map(string)` | `{}` | no |
 | <a name="input_topics"></a> [topics](#input\_topics) | The topics of the repository | `list(string)` | `[]` | no |
 | <a name="input_visibility"></a> [visibility](#input\_visibility) | The visibility of the repository | `string` | `"private"` | no |
 | <a name="input_vulnerability_alerts"></a> [vulnerability\_alerts](#input\_vulnerability\_alerts) | Whether the repository has vulnerability alerts enabled | `bool` | `false` | no |
@@ -63,4 +63,4 @@ No modules.
 | <a name="output_repo_id"></a> [repo\_id](#output\_repo\_id) | The ID of the repository. |
 | <a name="output_ssh_clone_url"></a> [ssh\_clone\_url](#output\_ssh\_clone\_url) | The SSH URL of the repository. |
 | <a name="output_svn_url"></a> [svn\_url](#output\_svn\_url) | The SVN URL of the repository. |
-<!-- END_TF_DOCS -->
+<!-- END_TF_DOCS -->

data.tf

@@ -1,5 +1,5 @@
 data "github_team" "self" {
- count = var.team_slug != null ? 1 : 0
+ count = length(keys(var.teams))
 
- slug = var.team_slug
+ slug = keys(var.teams)[count.index]
 }

flake.nix

@@ -8,6 +8,7 @@
  systems = [ "x86_64-linux" "aarch64-darwin" "x86_64-darwin" ];
  perSystem = { config, self', inputs', pkgs, system, ... }:
  let
+ inherit (pkgs) just terraform terraform-docs;
  terraform-github = pkgs.terraform-providers.mkProvider {
  homepage = "https://registry.terraform.io/providers/integrations/github";
  owner = "integrations";
@@ -42,7 +43,8 @@
 
  devShells = {
  default = pkgs.mkShell {
- buildInputs = with pkgs; [
+ buildInputs = [
+ just
  terraform
  terraform-docs
  ];

makefile → justfile

@@ -1,3 +1,6 @@
+check:
+ nix build --json --no-link --print-build-logs
+
 docs:
  terraform-docs markdown table \
  --output-file README.md \

main.tf

@@ -1,9 +1,9 @@
 resource "github_team_repository" "self" {
- count = var.team_slug != null ? 1 : 0
+ count = length(keys(var.teams))
 
- permission = "admin"
+ permission = var.teams[keys(var.teams)[count.index]]
  repository = github_repository.self.name
- team_id = data.github_team.self[0].id
+ team_id = data.github_team.self[count.index].id
 }
 
 resource "github_repository" "self" {

variables.tf

@@ -85,10 +85,28 @@ variable "required_status_checks_contexts" {
  type = list(string)
 }
 
-variable "team_slug" {
- default = null
- description = "The slug of the team to grant access to"
- type = string
+variable "teams" {
+ default = {}
+ description = "The teams to grant access to, and their permission levels"
+ type = map(string)
+
+ validation {
+ condition = alltrue([
+ for value in var.teams : contains(
+ [
+ // https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository#permission
+ "pull",
+ "triage",
+ "push",
+ "maintain",
+ "admin"
+ ],
+ value
+ )
+ ])
+
+ error_message = "Team permissions must be one of 'pull', 'triage', 'push', 'maintain', 'admin'."
+ }
 }
 
 variable "topics" {