Add internal infrastructure team (SRE)

ansible/inventory/group_vars/all/source-repositories

@@ -40,6 +40,8 @@ community_files:
       * @stackhpc/releasetrain
     sms_lab: |
       * @stackhpc/smslab
+    sre: |
+      * @stackhpc/sre
 source_repositories:
   # Kayobe team
   beokay:
@@ -381,6 +383,21 @@ source_repositories:
       - codeowners:
           content: "{{ community_files.codeowners.admins }}"
           dest: ".github/CODEOWNERS"
+  # SRE team
+  terraform-cloudflare-dns:
+    repository_type: "single-branch"
+    workflows: []
+    community_files:
+      - codeowners:
+          content: "{{ community_files.codeowners.sre }}"
+          dest: ".github/CODEOWNERS"
+  terraform-cloudflare-iam:
+    repository_type: "single-branch"
+    workflows: []
+    community_files:
+      - codeowners:
+          content: "{{ community_files.codeowners.sre }}"
+          dest: ".github/CODEOWNERS"
   # Ansible team
   ansible-role-libvirt-host:
     repository_type: "ansible"

terraform/github/branches.tf

@@ -733,3 +733,34 @@ resource "github_branch_protection" "smslab_branch_protection" {
   }
 }
 
+resource "github_branch_protection" "sre_branch_protection" {
+  for_each      = toset(var.repositories["SRE"])
+  repository_id = data.github_repository.repositories[each.key].node_id
+
+  pattern                         = data.github_repository.repositories[each.key].default_branch
+  require_conversation_resolution = true
+  allows_deletions                = false
+  allows_force_pushes             = false
+
+  required_pull_request_reviews {
+    dismiss_stale_reviews           = true
+    require_code_owner_reviews      = true
+    required_approving_review_count = 1
+  }
+
+  restrict_pushes {
+    blocks_creations = false
+    push_allowances = [
+      resource.github_team.organisation_teams["Developers"].node_id
+    ]
+  }
+
+  required_status_checks {
+    contexts = lookup(var.required_status_checks, each.key, { "default" : [] }).default
+    strict   = false
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}

terraform/github/teams.tf

@@ -74,6 +74,13 @@ resource "github_team_repository" "smslab_repositories" {
   permission = "push"
 }
 
+resource "github_team_repository" "sre_repositories" {
+  for_each   = toset(var.repositories["SRE"])
+  team_id    = resource.github_team.organisation_teams["SRE"].id
+  repository = each.value
+  permission = "push"
+}
+
 resource "github_team_membership" "team_membership" {
   for_each = { for element in flatten([
     for team in resource.github_team.organisation_teams : [

terraform/github/terraform.tfvars.json

@@ -95,6 +95,10 @@
       "smslab-azimuth-config",
       "smslab-config",
       "smslab-kayobe-config"
+    ],
+    "SRE": [
+      "terraform-cloudflare-dns",
+      "terraform-cloudflare-iam"
     ]
   },
   "teams": {
@@ -305,6 +309,20 @@
           "seunghun1ee"
         ]
       }
+    },
+    "SRE": {
+      "description": "Team responsible for internal infrastructure",
+      "privacy": "closed",
+      "users": {
+        "maintainers": [
+          "oneswig"
+        ],
+        "members": [
+          "axelsimon",
+          "priteau",
+          "technowhizz"
+        ]
+      }
     }
   },
   "labels": [

terraform/github/variables.tf

@@ -27,6 +27,7 @@ variable "repositories" {
     "Platform"     = [],
     "ReleaseTrain" = [],
     "SMSLab"       = [],
+    "SRE"          = [],
   }
 }
 
@@ -104,6 +105,14 @@ variable "teams" {
         members     = [],
       }
     },
+    "SRE" = {
+      description = "Team responsible for internal infrastructure"
+      privacy     = "closed"
+      users = {
+        maintainers = [],
+        members     = [],
+      }
+    },
   }
 }