Skip to content

feat: use app token for shared zizmor workflow#1611

Merged
danieldietzler merged 1 commit into
mainfrom
feat/zizmor-token
May 19, 2026
Merged

feat: use app token for shared zizmor workflow#1611
danieldietzler merged 1 commit into
mainfrom
feat/zizmor-token

Conversation

@bo0tzz

@bo0tzz bo0tzz commented May 19, 2026

Copy link
Copy Markdown
Member

No description provided.

@bo0tzz
bo0tzz requested a review from a team as a code owner May 19, 2026 09:42
@bo0tzz
bo0tzz requested a review from zackpollard May 19, 2026 09:42
@github-actions

Copy link
Copy Markdown

Terraform Plan

Shared

1password/account — No changes
1password/futo-account — No changes
cloudflare/account — No changes
cloudflare/api-keys — No changes
docker/org — No changes
⚠️ github/org — Plan: 1 to add, 28 to change, 0 to destroy.
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place (current -> planned)
  # github_repository_collaborators.repo_collaborators["immich"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "455229168"
      ~ invitation_ids = {
          - "koen-futo"  = "286515056"
          - "martabal"   = "284848949"
          - "martyfuhry" = "284848968"
          - "matthinc"   = "284848954"
          - "sudoicezen" = "284848972"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (57 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["static-pages"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "822727374"
      ~ invitation_ids = {
          - "PixelJonas" = "284848947"
          - "fyfrey"     = "284848959"
          - "kennyfuto"  = "288622006"
          - "koen-futo"  = "286515046"
          - "martabal"   = "284848951"
          - "martyfuhry" = "284848969"
          - "matthinc"   = "284848955"
          - "orhan98"    = "315880176"
          - "sudoicezen" = "284848974"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (56 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["test-assets"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "697157116"
      ~ invitation_ids = {
          - "PixelJonas" = "284848946"
          - "fyfrey"     = "284848960"
          - "kennyfuto"  = "288622000"
          - "koen-futo"  = "286515048"
          - "martabal"   = "284848952"
          - "martyfuhry" = "284848970"
          - "matthinc"   = "284848956"
          - "orhan98"    = "315880175"
          - "sudoicezen" = "284848973"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (56 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["ui"] will be created
  + resource "github_repository_collaborators" "repo_collaborators" {
      + id             = (known after apply)
      + invitation_ids = (known after apply)
      + repository     = "ui"
      + repository_id  = (known after apply)
      + user {
          + permission = "maintain"
          + username   = "C-Otto"
        }
      + user {
          + permission = "maintain"
          + username   = "LeLunZ"
        }
      + user {
          + permission = "maintain"
          + username   = "PixelJonas"
        }
      + user {
          + permission = "maintain"
          + username   = "Snowknight26"
        }
      + user {
          + permission = "maintain"
          + username   = "YarosMallorca"
        }
      + user {
          + permission = "maintain"
          + username   = "adamantike"
        }
      + user {
          + permission = "maintain"
          + username   = "alex-phillips"
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "arnolicious"
        }
      + user {
          + permission = "maintain"
          + username   = "ben-basten"
        }
      + user {
          + permission = "maintain"
          + username   = "benbeckford"
        }
      + user {
          + permission = "maintain"
          + username   = "benmccann"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "brighteyed"
        }
      + user {
          + permission = "maintain"
          + username   = "bwees"
        }
      + user {
          + permission = "maintain"
          + username   = "danieldietzler"
        }
      + user {
          + permission = "maintain"
          + username   = "etnoy"
        }
      + user {
          + permission = "maintain"
          + username   = "fyfrey"
        }
      + user {
          + permission = "maintain"
          + username   = "idubnori"
        }
      + user {
          + permission = "maintain"
          + username   = "insertish"
        }
      + user {
          + permission = "maintain"
          + username   = "jbaez"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "kennyfuto"
        }
      + user {
          + permission = "maintain"
          + username   = "koen-futo"
        }
      + user {
          + permission = "maintain"
          + username   = "martabal"
        }
      + user {
          + permission = "maintain"
          + username   = "martyfuhry"
        }
      + user {
          + permission = "maintain"
          + username   = "matthinc"
        }
      + user {
          + permission = "maintain"
          + username   = "meesfrensel"
        }
      + user {
          + permission = "maintain"
          + username   = "mertalev"
        }
      + user {
          + permission = "maintain"
          + username   = "michelheusschen"
        }
      + user {
          + permission = "maintain"
          + username   = "midzelis"
        }
      + user {
          + permission = "maintain"
          + username   = "nirokato"
        }
      + user {
          + permission = "maintain"
          + username   = "nutgood"
        }
      + user {
          + permission = "maintain"
          + username   = "oddlama"
        }
      + user {
          + permission = "maintain"
          + username   = "onedr0p"
        }
      + user {
          + permission = "maintain"
          + username   = "orhan98"
        }
      + user {
          + permission = "maintain"
          + username   = "samholton"
        }
      + user {
          + permission = "maintain"
          + username   = "santoshakil"
        }
      + user {
          + permission = "maintain"
          + username   = "shenlong-tanwen"
        }
      + user {
          + permission = "maintain"
          + username   = "timonrieger"
        }
      + user {
          + permission = "maintain"
          + username   = "uhthomas"
        }
      + user {
          + permission = "maintain"
          + username   = "xCJPECKOVERx"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
      + user {
          + permission = "triage"
          + username   = "1-tempest"
        }
      + user {
          + permission = "triage"
          + username   = "CrushedAsian255"
        }
      + user {
          + permission = "triage"
          + username   = "DeclanE47"
        }
      + user {
          + permission = "triage"
          + username   = "JW-CH"
        }
      + user {
          + permission = "triage"
          + username   = "Mraedis"
        }
      + user {
          + permission = "triage"
          + username   = "NicholasFlamy"
        }
      + user {
          + permission = "triage"
          + username   = "Xiticks"
        }
      + user {
          + permission = "triage"
          + username   = "aviv926"
        }
      + user {
          + permission = "triage"
          + username   = "dahool"
        }
      + user {
          + permission = "triage"
          + username   = "ddshd"
        }
      + user {
          + permission = "triage"
          + username   = "fhuhne"
        }
      + user {
          + permission = "triage"
          + username   = "github-cli"
        }
      + user {
          + permission = "triage"
          + username   = "mmomjian"
        }
      + user {
          + permission = "triage"
          + username   = "schuhbacca"
        }
      + user {
          + permission = "triage"
          + username   = "skatsubo"
        }
      + user {
          + permission = "triage"
          + username   = "sudoicezen"
        }
    }
  # github_repository_collaborators.repo_collaborators["walkrs"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "1156754889"
      ~ invitation_ids = {
          - "C-Otto"          = "307331486"
          - "PixelJonas"      = "307331438"
          - "adamantike"      = "307331464"
          - "dahool"          = "307331471"
          - "ddshd"           = "307331444"
          - "fyfrey"          = "307331463"
          - "github-cli"      = "307331445"
          - "jbaez"           = "307331428"
          - "kennyfuto"       = "307331447"
          - "koen-futo"       = "307331458"
          - "martabal"        = "307331390"
          - "martyfuhry"      = "307331483"
          - "matthinc"        = "307331420"
          - "michelheusschen" = "307331480"
          - "midzelis"        = "309034718"
          - "orhan98"         = "315880173"
          - "samholton"       = "307331386"
          - "schuhbacca"      = "307331432"
          - "skatsubo"        = "307331414"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (56 unchanged blocks hidden)
    }
  # github_repository_file.default_files[".github/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = ".github:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["base-images/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "base-images:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["data.immich.app/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "data.immich.app:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["devtools/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "devtools:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["discord-bot/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "discord-bot:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["drift/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "drift:.github/workflows/org-zizmor.yml:develop"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["geoshenanigans/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "geoshenanigans:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["immich-charts/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "immich-charts:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["immich/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "immich:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["justified-layout/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "justified-layout:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["ml-models/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "ml-models:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["native_video_player/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "native_video_player:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["one-click/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "one-click:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["pokedex/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "pokedex:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["restic-wrapper-ts/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "restic-wrapper-ts:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["retro/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "retro:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["services/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "services:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["sqlite-libs/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "sqlite-libs:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["static-pages/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "static-pages:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["test-assets/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "test-assets:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["walkrs/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "walkrs:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["yucca-o11y/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "yucca-o11y:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["yucca-slop/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "yucca-slop:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
  # github_repository_file.default_files["yucca/.github/workflows/org-zizmor.yml"] will be updated in-place
  ~ resource "github_repository_file" "default_files" {
      ~ content             = <<-EOT
            name: Zizmor
            on:
              pull_request:
              push:
                branches: [main]
            jobs:
              zizmor:
                name: Zizmor
                uses: <concealed by 1Password>/devtools/.github/workflows/shared-zizmor.yml@main
                permissions:
                  actions: read
                  contents: read
                  security-events: write
          +     secrets: inherit
        EOT
        id                  = "yucca:.github/workflows/org-zizmor.yml:main"
        # (9 unchanged attributes hidden)
    }
Plan: 1 to add, 28 to change, 0 to destroy.
╷
│ Warning: Argument is deprecated
│ 
│   with github_repository.repositories,
│   on repositories.tf line 183, in resource "github_repository" "repositories":183:   has_downloads             = true
│ 
│ This attribute is no longer in use, but it hasn't been removed yet. It will
│ be removed in a future version. See
│ https://github.com/orgs/community/discussions/102145#discussioncomment-8351756
│ 
│ (and 54 more similar warnings elsewhere)
╵
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
github/secrets — No changes
github/webhooks — No changes
zitadel/cloud — No changes
zitadel/self-hosted — No changes

Scoped (dev)

discord/community — No changes
monitoring/grafana — No changes
zitadel/customer — No changes

Scoped (prod)

⚠️ discord/community — Plan: 0 to add, 63 to change, 0 to destroy.
data.external.members: Still reading... [10s elapsed]
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # discord_forum_channel.dev_focus_topic will be updated in-place
  ~ resource "discord_forum_channel" "dev_focus_topic" {
        id                       = "1045707766754451486"
        name                     = "dev-focus-topic"
      ~ position                 = 22 -> 2
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.draft_announcements will be updated in-place
  ~ resource "discord_forum_channel" "draft_announcements" {
        id                       = "1073000522338017381"
        name                     = "draft-announcements"
      ~ position                 = 19 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.focus_discussion will be updated in-place
  ~ resource "discord_forum_channel" "focus_discussion" {
        id                       = "1026327300284887111"
        name                     = "focus-discussion"
      ~ position                 = 6 -> 2
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.help_desk_support will be updated in-place
  ~ resource "discord_forum_channel" "help_desk_support" {
        id                       = "1049703391762321418"
        name                     = "help-desk-support"
      ~ position                 = 4 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.leadership_focus_topic will be updated in-place
  ~ resource "discord_forum_channel" "leadership_focus_topic" {
        id                       = "1229454284479795291"
        name                     = "leadership-focus-topic"
      ~ position                 = 39 -> 3
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.team_focus_topic will be updated in-place
  ~ resource "discord_forum_channel" "team_focus_topic" {
        id                       = "1330248543721754746"
        name                     = "team-focus-topic"
      ~ position                 = 26 -> 3
        # (5 unchanged attributes hidden)
    }
  # discord_forum_channel.team_pull_requests will be updated in-place
  ~ resource "discord_forum_channel" "team_pull_requests" {
        id                       = "1476975523271016661"
        name                     = "team-pull-requests"
      ~ position                 = 27 -> 4
        # (6 unchanged attributes hidden)
    }
  # discord_forum_channel.yucca_focus_topic will be updated in-place
  ~ resource "discord_forum_channel" "yucca_focus_topic" {
        id                       = "1413525610700996739"
        name                     = "yucca-focus-topic"
      ~ position                 = 32 -> 2
        # (6 unchanged attributes hidden)
    }
  # discord_news_channel.github_releases will be updated in-place
  ~ resource "discord_news_channel" "github_releases" {
        id                       = "991477056791658567"
        name                     = "github-releases"
      ~ position                 = 46 -> 5
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.bot_spam will be updated in-place
  ~ resource "discord_text_channel" "bot_spam" {
        id                       = "1159083520027787307"
        name                     = "bot-spam"
      ~ position                 = 47 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.branding will be updated in-place
  ~ resource "discord_text_channel" "branding" {
        id                       = "1215143314358009866"
        name                     = "branding"
      ~ position                 = 54 -> 4
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.build_status will be updated in-place
  ~ resource "discord_text_channel" "build_status" {
        id                       = "981216275210584134"
        name                     = "build-status"
      ~ position                 = 66 -> 16
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.cloudflare_status will be updated in-place
  ~ resource "discord_text_channel" "cloudflare_status" {
        id                       = "1313493521755410443"
        name                     = "cloudflare-status"
      ~ position                 = 42 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.conference_room will be updated in-place
  ~ resource "discord_text_channel" "conference_room" {
        id                       = "1206801539470069810"
        name                     = "conference-room"
      ~ position                 = 53 -> 3
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.contributing will be updated in-place
  ~ resource "discord_text_channel" "contributing" {
        id                       = "1071165397228855327"
        name                     = "contributing"
      ~ position                 = 7 -> 3
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.dev will be updated in-place
  ~ resource "discord_text_channel" "dev" {
        id                       = "979148343693422593"
        name                     = "dev"
      ~ position                 = 20 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_cli will be updated in-place
  ~ resource "discord_text_channel" "dev_cli" {
        id                       = "1175153422866059329"
        name                     = "dev-cli"
      ~ position                 = 64 -> 14
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_fosdem will be updated in-place
  ~ resource "discord_text_channel" "dev_fosdem" {
        id                       = "1291108934861586492"
        name                     = "dev-fosdem"
      ~ position                 = 50 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_ml will be updated in-place
  ~ resource "discord_text_channel" "dev_ml" {
        id                       = "1175513104877101078"
        name                     = "dev-ml"
      ~ position                 = 55 -> 5
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_mobile will be updated in-place
  ~ resource "discord_text_channel" "dev_mobile" {
        id                       = "1069026079349669951"
        name                     = "dev-mobile"
      ~ position                 = 58 -> 8
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_off_topic will be updated in-place
  ~ resource "discord_text_channel" "dev_off_topic" {
        id                       = "1034520166115053638"
        name                     = "dev-off-topic"
      ~ position                 = 21 -> 1
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.dev_ops will be updated in-place
  ~ resource "discord_text_channel" "dev_ops" {
        id                       = "1176633064462487686"
        name                     = "dev-ops"
      ~ position                 = 61 -> 11
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_roles will be updated in-place
  ~ resource "discord_text_channel" "dev_roles" {
        id                       = "1196526624812839034"
        name                     = "dev-roles"
      ~ position                 = 59 -> 9
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_security will be updated in-place
  ~ resource "discord_text_channel" "dev_security" {
        id                       = "1020479445167001650"
        name                     = "dev-security"
      ~ position                 = 60 -> 10
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_server will be updated in-place
  ~ resource "discord_text_channel" "dev_server" {
        id                       = "1155894065062236160"
        name                     = "dev-server"
      ~ position                 = 52 -> 2
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.dev_web will be updated in-place
  ~ resource "discord_text_channel" "dev_web" {
        id                       = "1169697266806820974"
        name                     = "dev-web"
      ~ position                 = 63 -> 13
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.developer_updates will be updated in-place
  ~ resource "discord_text_channel" "developer_updates" {
        id                       = "1361300925788192778"
        name                     = "developer-updates"
      ~ position                 = 41 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.emotes will be updated in-place
  ~ resource "discord_text_channel" "emotes" {
        id                       = "1287169306244943894"
        name                     = "emotes"
      ~ position                 = 48 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.fosdem_2025 will be updated in-place
  ~ resource "discord_text_channel" "fosdem_2025" {
        id                       = "1334949885442654248"
        name                     = "fosdem-2025"
      ~ position                 = 51 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.futo will be updated in-place
  ~ resource "discord_text_channel" "futo" {
        id                       = "1208144146825748491"
        name                     = "futo"
      ~ position                 = 56 -> 6
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.futo_discussion_old will be updated in-place
  ~ resource "discord_text_channel" "futo_discussion_old" {
        id                       = "1238236317729554523"
        name                     = "futo-discussion-old"
      ~ position                 = 62 -> 12
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.github_issues_and_discussion will be updated in-place
  ~ resource "discord_text_channel" "github_issues_and_discussion" {
        id                       = "991483015958106202"
        name                     = "github-issues-and-discussion"
      ~ position                 = 44 -> 3
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.github_pull_requests will be updated in-place
  ~ resource "discord_text_channel" "github_pull_requests" {
        id                       = "991483093179445350"
        name                     = "github-pull-requests"
      ~ position                 = 45 -> 4
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.github_status will be updated in-place
  ~ resource "discord_text_channel" "github_status" {
        id                       = "1240662502912692236"
        name                     = "github-status"
      ~ position                 = 43 -> 2
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.imagegenius_aio will be updated in-place
  ~ resource "discord_text_channel" "imagegenius_aio" {
        id                       = "1178366211675930634"
        name                     = "imagegenius-aio"
      ~ position                 = 11 -> 0
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.immich will be updated in-place
  ~ resource "discord_text_channel" "immich" {
        id                       = "994044917355663450"
        name                     = "immich"
      ~ position                 = 9 -> 5
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.immich_frame will be updated in-place
  ~ resource "discord_text_channel" "immich_frame" {
        id                       = "1217843270244372480"
        name                     = "immich-frame"
      ~ position                 = 13 -> 2
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.immich_go will be updated in-place
  ~ resource "discord_text_channel" "immich_go" {
        id                       = "1178366369423700080"
        name                     = "immich-go"
      ~ position                 = 12 -> 1
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.immich_kiosk will be updated in-place
  ~ resource "discord_text_channel" "immich_kiosk" {
        id                       = "1293191523927851099"
        name                     = "immich-kiosk"
      ~ position                 = 14 -> 3
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.immich_nix will be updated in-place
  ~ resource "discord_text_channel" "immich_nix" {
        id                       = "1288786177952059435"
        name                     = "immich-nix"
      ~ position                 = 57 -> 7
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.immich_power_tools will be updated in-place
  ~ resource "discord_text_channel" "immich_power_tools" {
        id                       = "1278195895594258553"
        name                     = "immich-power-tools"
      ~ position                 = 15 -> 4
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.jasons_adventures_with_unraid_docker_and_networking will be updated in-place
  ~ resource "discord_text_channel" "jasons_adventures_with_unraid_docker_and_networking" {
        id                       = "1230989262325813270"
        name                     = "jasons-adventures-with-unraid-docker-and-networking"
      ~ position                 = 65 -> 15
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.leadership will be updated in-place
  ~ resource "discord_text_channel" "leadership" {
        id                       = "1176686059422232636"
        name                     = "leadership"
      ~ position                 = 36 -> 0
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.leadership_alerts will be updated in-place
  ~ resource "discord_text_channel" "leadership_alerts" {
        id                       = "1260975801625608213"
        name                     = "leadership-alerts"
      ~ position                 = 38 -> 2
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.leadership_off_topic will be updated in-place
  ~ resource "discord_text_channel" "leadership_off_topic" {
        id                       = "1255863786686906489"
        name                     = "leadership-off-topic"
      ~ position                 = 37 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.merch will be updated in-place
  ~ resource "discord_text_channel" "merch" {
        id                       = "1336794023888818288"
        name                     = "merch"
      ~ position                 = 10 -> 6
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.moderator_only will be updated in-place
  ~ resource "discord_text_channel" "moderator_only" {
        id                       = "991930223991988255"
        name                     = "moderator-only"
      ~ position                 = 40 -> 4
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.off_topic will be updated in-place
  ~ resource "discord_text_channel" "off_topic" {
        id                       = "991643870523830382"
        name                     = "off-topic"
      ~ position                 = 49 -> 2
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.package_maintainers will be updated in-place
  ~ resource "discord_text_channel" "package_maintainers" {
        id                       = "1288859036015398974"
        name                     = "package-maintainers"
      ~ position                 = 5 -> 1
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.support_crew will be updated in-place
  ~ resource "discord_text_channel" "support_crew" {
        id                       = "1184258493948117084"
        name                     = "support-crew"
      ~ position                 = 18 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.team will be updated in-place
  ~ resource "discord_text_channel" "team" {
        id                       = "1330248080271999086"
        name                     = "team"
      ~ position                 = 23 -> 0
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.team_alerts will be updated in-place
  ~ resource "discord_text_channel" "team_alerts" {
        id                       = "1360190417643110460"
        name                     = "team-alerts"
      ~ position                 = 29 -> 6
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.team_off_topic will be updated in-place
  ~ resource "discord_text_channel" "team_off_topic" {
        id                       = "1330252547751022632"
        name                     = "team-off-topic"
      ~ position                 = 25 -> 2
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.team_purchases will be updated in-place
  ~ resource "discord_text_channel" "team_purchases" {
        id                       = "1263492970691297300"
        name                     = "team-purchases"
      ~ position                 = 28 -> 5
        # (5 unchanged attributes hidden)
    }
  # discord_text_channel.team_slop will be updated in-place
  ~ resource "discord_text_channel" "team_slop" {
        id                       = "1485644163247640657"
        name                     = "team-slop"
      ~ position                 = 24 -> 1
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.translations will be updated in-place
  ~ resource "discord_text_channel" "translations" {
        id                       = "1250427404976132138"
        name                     = "translations"
      ~ position                 = 8 -> 4
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.truenas will be updated in-place
  ~ resource "discord_text_channel" "truenas" {
        id                       = "1178410588821524561"
        name                     = "truenas"
      ~ position                 = 16 -> 5
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.unraid will be updated in-place
  ~ resource "discord_text_channel" "unraid" {
        id                       = "1228387901889445989"
        name                     = "unraid"
      ~ position                 = 17 -> 6
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.yucca will be updated in-place
  ~ resource "discord_text_channel" "yucca" {
        id                       = "1413525175747608688"
        name                     = "yucca"
      ~ position                 = 30 -> 0
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.yucca_alerts will be updated in-place
  ~ resource "discord_text_channel" "yucca_alerts" {
        id                       = "1413525667429093469"
        name                     = "yucca-alerts"
      ~ position                 = 33 -> 3
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.yucca_alerts_dev will be updated in-place
  ~ resource "discord_text_channel" "yucca_alerts_dev" {
        id                       = "1425822463736021134"
        name                     = "yucca-alerts-dev"
      ~ position                 = 35 -> 5
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.yucca_alerts_testing will be updated in-place
  ~ resource "discord_text_channel" "yucca_alerts_testing" {
        id                       = "1425822461890662460"
        name                     = "yucca-alerts-testing"
      ~ position                 = 34 -> 4
        # (6 unchanged attributes hidden)
    }
  # discord_text_channel.yucca_off_topic will be updated in-place
  ~ resource "discord_text_channel" "yucca_off_topic" {
        id                       = "1413525269192376413"
        name                     = "yucca-off-topic"
      ~ position                 = 31 -> 1
        # (6 unchanged attributes hidden)
    }
Plan: 0 to add, 63 to change, 0 to destroy.
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
discord/futo — No changes
monitoring/grafana — No changes
zitadel/customer — No changes

@danieldietzler
danieldietzler merged commit ff26356 into main May 19, 2026
17 checks passed
@danieldietzler
danieldietzler deleted the feat/zizmor-token branch May 19, 2026 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants