Add secrets sync for private repositories

Author: Taucher2003

modules/github/secret_sync/main.tf

@@ -0,0 +1,13 @@
+module "gl_api_token" {
+  source = "./synced_secret"
+
+  gitlab_secrets_manager_key = "GITHUB_GL_API_TOKEN"
+  github_secret_key = "GL_API_TOKEN"
+}
+
+module "gl_runner_token" {
+  source = "./synced_secret"
+
+  gitlab_secrets_manager_key = "GITHUB_GL_RUNNER_TOKEN"
+  github_secret_key = "GL_RUNNER_TOKEN"
+}

modules/github/secret_sync/synced_secret/main.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = "6.12.1"
+    }
+    gitlab = {
+      source  = "gitlabhq/gitlab"
+      version = "18.11.0"
+    }
+  }
+}

modules/github/secret_sync/synced_secret/secret.tf

@@ -0,0 +1,32 @@
+data "gitlab_project_variable" "secret" {
+  project = "code0-tech/secret-manager"
+  key     = var.gitlab_secrets_manager_key
+}
+
+data "github_repositories" "public" {
+  query = "org:code0-tech props.secret-sync:${var.github_secret_key} visibility:public"
+  include_repo_id = true
+}
+
+data "github_repositories" "private" {
+  query = "org:code0-tech props.secret-sync:${var.github_secret_key} visibility:private"
+}
+
+resource "github_actions_organization_secret" "secret" {
+  secret_name = var.github_secret_key
+  visibility  = "selected"
+  value       = data.gitlab_project_variable.secret.value
+}
+
+resource "github_actions_organization_secret_repositories" "public" {
+  secret_name             = github_actions_organization_secret.secret.secret_name
+  selected_repository_ids = data.github_repositories.public.repo_ids
+}
+
+resource "github_actions_secret" "secret" {
+  for_each = toset(data.github_repositories.private.names)
+
+  repository = each.value
+  secret_name = var.github_secret_key
+  value       = data.gitlab_project_variable.secret.value
+}

modules/github/secret_sync/synced_secret/variables.tf

@@ -0,0 +1,7 @@
+variable "gitlab_secrets_manager_key" {
+  type = string
+}
+
+variable "github_secret_key" {
+  type = string
+}

system/github/main.tf

@@ -38,6 +38,10 @@ module "licenses" {
   source = "../../modules/github/license_files"
 }
 
+module "secret_sync" {
+  source = "../../modules/github/secret_sync"
+}
+
 data "gitlab_project_variable" "github_public_discord_webhook_url" {
   project = "code0-tech/secret-manager"
   key     = "GITHUB_PUBLIC_DISCORD_WEBHOOK_URL"