feat: allow existing and no team for github

Author: jaredfholgate

.github/workflows/docs-fmt-test.yml

@@ -1,5 +1,5 @@
 ---
-name: Docs & fmt test
+name: fmt test
 
 on:
   pull_request:
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   docsfmttest:
-    name: Docs & fmt test
+    name: fmt test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -31,14 +31,10 @@ jobs:
           terraform_version: latest
           terraform_wrapper: false
 
-      - name: Install tools
-        run: make tools
-
       - name: Check fmt and docs
         run: |
           echo "==> Running make fmt & make docs"
           make fmt
-          make docs
           echo "==> Testing for changes to tracked files"
           CHANGES=$(git status -suno)
           if [ "$CHANGES" ]; then

Makefile

@@ -4,32 +4,14 @@ default:
 	@echo "Thing is one of:"
 	@echo "docs fmt fmtcheck tfclean tools"
 
-docs:
-	@echo "==> Updating documentation..."
-	find . | egrep "\.md" | grep -v README.md | sort | while read f; do terrafmt fmt $$f; done
-
 fmt:
 	@echo "==> Fixing Terraform code with terraform fmt..."
 	terraform fmt -recursive
-	@echo "==> Fixing embedded Terraform with terrafmt..."
-	find . | egrep "\.md|\.tf" | grep -v README.md | sort | while read f; do terrafmt fmt $$f; done
 
 fmtcheck:
-	@echo "==> Checking source code with gofmt..."
-	@sh "$(CURDIR)/scripts/gofmtcheck.sh"
 	@echo "==> Checking source code with terraform fmt..."
 	terraform fmt -check -recursive
 
-tfclean:
-	@echo "==> Cleaning terraform files..."
-	find . -type d -name '.terraform' | xargs rm -vrf
-	find . -type f -name 'tfplan' | xargs rm -vf
-	find . -type f -name 'terraform.tfstate*' | xargs rm -vf
-	find . -type f -name '.terraform.lock.hcl' | xargs rm -vf
-
-tools:
-	go install github.com/katbyte/terrafmt@latest
-
 # Makefile targets are files, but we aren't using it like this,
 # so have to declare PHONY targets
-.PHONY: docs fmt fmtcheck tfclean tools
+.PHONY: fmt fmtcheck

alz/github/main.tf

@@ -91,6 +91,8 @@ module "github" {
   backend_azure_storage_account_name           = local.resource_names.storage_account
   backend_azure_storage_account_container_name = local.resource_names.storage_container
   approvers                                    = var.apply_approvers
+  create_team                                  = var.apply_approval_team_creation_enabled
+  existing_team_name                           = var.apply_approval_existing_team_name
   team_name                                    = local.resource_names.version_control_system_team
   runner_group_name                            = local.resource_names.version_control_system_runner_group
   use_runner_group                             = local.use_runner_group

alz/github/variables.tf

@@ -194,6 +194,18 @@ variable "apply_approvers" {
   default     = []
 }
 
+variable "apply_approval_team_creation_enabled" {
+  description = "Controls whether to create a team for approvals."
+  type        = bool
+  default     = true
+}
+
+variable "apply_approval_existing_team_name" {
+  description = "The name of an existing team to use for approvals. Only required if 'apply_approval_team_creation_enabled' is 'false'. If this is left null and `apply_approval_team_creation_enabled` is `false`, the module will not set any team for approvals."
+  type        = string
+  default     = null
+}
+
 variable "create_branch_policies" {
   description = "Controls whether to create branch policies for the repositories"
   type        = bool

modules/github/environment.tf

@@ -5,10 +5,10 @@ resource "github_repository_environment" "alz" {
   repository  = github_repository.alz.name
 
   dynamic "reviewers" {
-    for_each = each.key == local.apply_key && length(var.approvers) > 0 ? [1] : []
+    for_each = each.key == local.apply_key && local.approver_count > 0 ? [1] : []
     content {
       teams = [
-        github_team.alz.id
+        local.team_id
       ]
     }
   }

modules/github/repository_module.tf

@@ -32,6 +32,6 @@ resource "github_branch_protection" "alz" {
   required_pull_request_reviews {
     dismiss_stale_reviews           = true
     restrict_dismissals             = true
-    required_approving_review_count = length(var.approvers) > 1 ? 1 : 0
+    required_approving_review_count = local.approver_count > 1 ? 1 : 0
   }
 }

modules/github/repository_templates.tf

@@ -33,7 +33,7 @@ resource "github_branch_protection" "alz_templates" {
   required_pull_request_reviews {
     dismiss_stale_reviews           = true
     restrict_dismissals             = true
-    required_approving_review_count = length(var.approvers) > 1 ? 1 : 0
+    required_approving_review_count = local.approver_count > 1 ? 1 : 0
   }
 }
 

modules/github/team.tf

@@ -20,7 +20,18 @@ locals {
   invalid_approvers = setunion(local.invalid_approvers_by_email, local.invalid_approvers_by_login)
 }
 
+locals {
+  team_id        = var.create_team ? github_team.alz[0].id : var.existing_team_name == null ? null : data.github_team.alz[0].id
+  approver_count = var.create_team ? length(local.approvers) : var.existing_team_name == null ? 0 : (data.github_team.alz[0].members)
+}
+
+data "github_team" "alz" {
+  count = var.create_team ? 0 : 1
+  slug  = var.existing_team_name
+}
+
 resource "github_team" "alz" {
+  count       = var.create_team ? 1 : 0
   name        = var.team_name
   description = "Approvers for the Landing Zone Terraform Apply"
   privacy     = "closed"
@@ -34,14 +45,14 @@ resource "github_team" "alz" {
 }
 
 resource "github_team_membership" "alz" {
-  for_each = { for approver in local.approvers : approver.login => approver }
+  for_each = var.create_team ? { for approver in local.approvers : approver.login => approver } : {}
   team_id  = github_team.alz.id
   username = each.value.login
   role     = "member"
 }
 
 resource "github_team_repository" "alz" {
-  team_id    = github_team.alz.id
+  team_id    = local.team_id
   repository = github_repository.alz.name
   permission = "push"
 }

modules/github/variables.tf

@@ -54,6 +54,14 @@ variable "approvers" {
   type = list(string)
 }
 
+variable "create_team" {
+  type = bool
+}
+
+variable "existing_team_name" {
+  type = string
+}
+
 variable "team_name" {
   type = string
 }