From 6f39b1c35f31c258f34af155dd1b9c2046238558 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Sat, 11 Jul 2026 15:03:08 +0000
Subject: [PATCH] [minor] Authorize application plugin publishers

---
 .github/workflows/terraform.yaml | 45 ++++++++++++++++++++++++++++++++
 README.md                        |  2 +-
 terraform.tfvars.example         |  6 +++++
 variables.tf                     |  6 +++++
 4 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/terraform.yaml

diff --git a/.github/workflows/terraform.yaml b/.github/workflows/terraform.yaml
new file mode 100644
index 0000000..cd75921
--- /dev/null
+++ b/.github/workflows/terraform.yaml
@@ -0,0 +1,45 @@
+name: terraform
+
+on:
+  pull_request:
+    paths:
+      - "**/*.tf"
+      - ".terraform.lock.hcl"
+      - "terraform.tfvars.example"
+      - ".github/workflows/terraform.yaml"
+  push:
+    branches:
+      - main
+    paths:
+      - "**/*.tf"
+      - ".terraform.lock.hcl"
+      - "terraform.tfvars.example"
+      - ".github/workflows/terraform.yaml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+        with:
+          terraform_version: 1.15.2
+
+      - name: Check formatting
+        run: terraform fmt -check -diff
+
+      - name: Initialize without backend
+        run: terraform init -backend=false -lockfile=readonly
+
+      - name: Validate
+        run: terraform validate
diff --git a/README.md b/README.md
index 25942da..be92c14 100644
--- a/README.md
+++ b/README.md
@@ -198,7 +198,7 @@ No modules.
 | <a name="input_dns_zone_name"></a> [dns\_zone\_name](#input\_dns\_zone\_name) | Cloud DNS managed zone name. | `string` | `"packages-libops-io"` | no |
 | <a name="input_github_actors"></a> [github\_actors](#input\_github\_actors) | Optional GitHub actors allowed to use the provider. Leave empty to allow any actor from the approved repositories. | `set(string)` | `[]` | no |
 | <a name="input_github_owner"></a> [github\_owner](#input\_github\_owner) | GitHub organization that owns the repositories allowed to publish packages. | `string` | `"libops"` | no |
-| <a name="input_github_repositories"></a> [github\_repositories](#input\_github\_repositories) | Full GitHub repository names allowed to impersonate the publishing service account. | `set(string)` | <pre>[<br/>  "libops/sitectl",<br/>  "libops/sitectl-drupal",<br/>  "libops/sitectl-isle",<br/>  "libops/sitectl-libops"<br/>]</pre> | no |
+| <a name="input_github_repositories"></a> [github\_repositories](#input\_github\_repositories) | Full GitHub repository names allowed to impersonate the publishing service account. | `set(string)` | <pre>[<br/>  "libops/sitectl",<br/>  "libops/sitectl-app-tmpl",<br/>  "libops/sitectl-archivesspace",<br/>  "libops/sitectl-drupal",<br/>  "libops/sitectl-isle",<br/>  "libops/sitectl-libops",<br/>  "libops/sitectl-ojs",<br/>  "libops/sitectl-omeka-classic",<br/>  "libops/sitectl-omeka-s",<br/>  "libops/sitectl-wp"<br/>]</pre> | no |
 | <a name="input_org_id"></a> [org\_id](#input\_org\_id) | Google Cloud organization ID. | `string` | n/a | yes |
 | <a name="input_package_domain"></a> [package\_domain](#input\_package\_domain) | Fully qualified domain name that will serve the package repository. | `string` | `"packages.libops.io"` | no |
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Google Cloud project ID. | `string` | `"libops-linux-packages"` | no |
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
index 449cc52..9d09337 100644
--- a/terraform.tfvars.example
+++ b/terraform.tfvars.example
@@ -1,8 +1,14 @@
 github_repositories = [
   "libops/sitectl",
+  "libops/sitectl-app-tmpl",
+  "libops/sitectl-archivesspace",
   "libops/sitectl-drupal",
   "libops/sitectl-isle",
   "libops/sitectl-libops",
+  "libops/sitectl-ojs",
+  "libops/sitectl-omeka-classic",
+  "libops/sitectl-omeka-s",
+  "libops/sitectl-wp",
 ]
 
 github_actors = [
diff --git a/variables.tf b/variables.tf
index 243e3a6..a9073ab 100644
--- a/variables.tf
+++ b/variables.tf
@@ -9,9 +9,15 @@ variable "github_repositories" {
   type        = set(string)
   default = [
     "libops/sitectl",
+    "libops/sitectl-app-tmpl",
+    "libops/sitectl-archivesspace",
     "libops/sitectl-drupal",
     "libops/sitectl-isle",
     "libops/sitectl-libops",
+    "libops/sitectl-ojs",
+    "libops/sitectl-omeka-classic",
+    "libops/sitectl-omeka-s",
+    "libops/sitectl-wp",
   ]
 }