From 38962f0b0663bb2cbbd73293cc5a6e506ac31613 Mon Sep 17 00:00:00 2001
From: NWarila <33955773+NWarila@users.noreply.github.com>
Date: Sun, 12 Jul 2026 16:35:56 +0000
Subject: [PATCH] Onboard talos-cluster: manage repo settings + rulesets
 in-band + required checks (P0.3)

Brings nwarila-platform/talos-cluster under Terraform management so its repo
settings and the Branch Safety / Pull Request Gate / Release Tag Protection
rulesets are managed in-band instead of configured out-of-band in the GitHub UI.
The framework default rulesets were verified 2026-07-12 to match the repo's
current manual rulesets exactly (signing + linear history + squash-only +
code-owner review + admin bypass), so adoption preserves all protection.

Adds required_status_checks using only checks that run on every PR (Config Audit,
Gitleaks Secret Scan, org-adr / verify); path-filtered Validate checks are Phase 2.
Existing-repo adoption: the runner must terraform import the repository (and the
rulesets if adopting) before the first apply; the plan on this PR is the drift gate.
---
 .gitignore                               |  1 +
 terraform/repos/public/talos-cluster.yml | 69 ++++++++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 terraform/repos/public/talos-cluster.yml

diff --git a/.gitignore b/.gitignore
index a0de0b8..6b6fa55 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,6 +39,7 @@
 !/terraform/repos/
 !/terraform/repos/public/
 !/terraform/repos/public/.gitkeep
+!/terraform/repos/public/talos-cluster.yml
 !/terraform/repos/private/
 !/terraform/repos/private/.gitkeep
 
diff --git a/terraform/repos/public/talos-cluster.yml b/terraform/repos/public/talos-cluster.yml
new file mode 100644
index 0000000..c4c5124
--- /dev/null
+++ b/terraform/repos/public/talos-cluster.yml
@@ -0,0 +1,69 @@
+# nwarila-platform/talos-cluster — brought under Terraform management (P0.3).
+#
+# Onboards the existing GitOps cluster repo into the framework so its repo
+# settings + branch/tag rulesets are managed in-band instead of configured
+# out-of-band in the GitHub UI. The three rulesets below are the framework
+# defaults, which were verified 2026-07-12 to match the repo's current
+# manually-created "Branch Safety" / "Pull Request Gate" / "Release Tag
+# Protection" rulesets EXACTLY (rules + admin bypass + ~DEFAULT_BRANCH), so
+# adoption preserves signing + linear-history + squash-only + code-owner review.
+#
+# The `required_checks` list is the P0.3 addition: it injects a
+# required_status_checks rule into the Pull Request Gate. Only checks that run
+# on EVERY PR are listed (Security Audit + Org ADR Sync run unconditionally);
+# the path-filtered `Validate` workflow checks are intentionally NOT required
+# yet — requiring them would block doc-only PRs until validate.yaml gains an
+# always-reports gate job (Phase 2, tracked separately).
+#
+# Existing-repo adoption note: talos-cluster already exists, so before the
+# first apply the runner must `terraform import` github_repository.repo
+# ["talos-cluster"] (and, if adopting rather than recreating, the three
+# github_repository_ruleset.branch/tag entries). See the P0.3 runbook.
+talos-cluster:
+  description: "Production Talos Linux bare-metal Kubernetes cluster (3 control-plane + 3 workers). GitOps via Flux; Cilium kube-proxy-free CNI with Gateway API, Kyverno policy, Longhorn storage, SOPS/age secrets, and HashiCorp Vault with AWS KMS auto-unseal."
+  homepage_url: "https://nickwarila.com"
+  visibility: public
+
+  has_issues: true
+  has_projects: false
+  has_wiki: false
+  has_discussions: false
+
+  allow_forking: true
+  allow_merge_commit: false
+  allow_squash_merge: true
+  allow_rebase_merge: false
+  allow_auto_merge: true
+  allow_update_branch: true
+  squash_merge_commit_title: PR_TITLE
+  squash_merge_commit_message: PR_BODY
+  merge_commit_title: MERGE_MESSAGE
+  merge_commit_message: PR_TITLE
+  delete_branch_on_merge: true
+
+  vulnerability_alerts: true
+
+  topics:
+    - cilium
+    - flux
+    - gitops
+    - homelab
+    - infrastructure-as-code
+    - kubernetes
+    - platform-engineering
+    - talos
+    - vault
+
+  # Leave the already-correct security posture untouched (secret scanning +
+  # push protection + Dependabot are enabled live); do not let the baseline
+  # toggle them during adoption.
+  unmanaged_security_features:
+    - advanced_security
+    - secret_scanning
+    - secret_scanning_push_protection
+
+  # P0.3: enforce green == mergeable, using only checks that run on every PR.
+  required_checks:
+    - "Config Audit"
+    - "Gitleaks Secret Scan"
+    - "org-adr / verify"