branch_protection: stop whitelist representation churn planning every run

Why:
- The go-gitea/gitea provider stores branch-protection whitelist users/teams as
  plain names, but Gitea resolves them to IDs and, on read, returns them via
  getWhitelistEntities over the repo's readers: users ordered by user ID, teams
  ordered by name, and any entity without read access to the repo silently
  dropped.
- So the read-back representation of push/merge/approval whitelists rarely
  matches the config list (order differs, or a whitelisted user/team that lacks
  repo access disappears), and tofu plans an in-place update for those branch
  protections on every run even with no config change.
- This is the same class of provider representation churn already handled for
  teams in #62 (units/repositories), and it blocks a clean plan on terraform-git.

Change:
- Add a targeted ignore_changes on the six whitelist list attributes
  (push/merge/approval, users and teams) at the branch_protection module so the
  churn no longer triggers a spurious update, keeping every protected repo
  idempotent.
- Leave enable_push, required_approvals, status_check_patterns and the
  block_merge_on_* flags managed; those round-trip cleanly and stay drift-checked.

Makefile

@@ -23,7 +23,7 @@ init:
 
 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
+	terragrunt run --all --parallelism 4 --non-interactive plan
 
 apply-if-changes: init
 	@$(call vault_env) && \

config/git.unkin.net/unkin/repository/agent-tools.yaml

@@ -1,16 +0,0 @@
-description: "CLI tools for orchestrator PR automation as unkin-agent"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/arrproxy.yaml

@@ -1,16 +0,0 @@
-description: "arrstack reverse proxy: oauth2-gated UI + per-user API-key broker"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/autobackup-operator.yaml

@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/clickhouse-tools.yaml

@@ -1,14 +0,0 @@
-description: "CLI tools (chcat, chtail, chgrep) for searching, filtering and tailing logs in the ClickHouse log store"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/ghp.yaml

@@ -1,17 +0,0 @@
-description: "Fork of goodtune/ghp (GitHub proxy) with unkin patches"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/golib.yaml

@@ -1,14 +0,0 @@
-description: "Shared Go library for estate services: postgres, http service kit, vault and gitea clients"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/jellyfin-ha-src.yaml

@@ -5,7 +5,5 @@ default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "main"
     enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/ci"
     approval_whitelist_teams:
       - "Owners"

config/git.unkin.net/unkin/repository/logviewer.yaml

@@ -1,14 +0,0 @@
-description: "Web UI for the ClickHouse log store: fuzzy find, tail and SQL-filter logs (logviewer.unkin.net)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/mediamark.yaml

@@ -1,14 +0,0 @@
-description: "Keyboard-centric web UI to mark media as cheeztv (kids) content via hardlinks; oauth2-proxy fronted, talks to sonarr/radarr APIs"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/mediamover.yaml

@@ -1,10 +0,0 @@
-description: "Media copy/move tool: Go API + UI spawning per-file k8s Jobs from mediafs CephFS to media PVCs; doubles as a Ceph aggregate-bandwidth test"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false

config/git.unkin.net/unkin/repository/plugin-docker-buildx.yaml

@@ -1,14 +0,0 @@
-description: "Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"

config/git.unkin.net/unkin/repository/prowlarr.yaml

@@ -1,16 +0,0 @@
-description: "Private fork of Prowlarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/radarr.yaml

@@ -1,16 +0,0 @@
-description: "Private fork of Radarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/repospawner.yaml

@@ -1,14 +0,0 @@
-description: "API service that opens terraform-git PRs for new repo requests via kube Jobs; oauth2-proxy'd status UI"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/sonarr.yaml

@@ -1,16 +0,0 @@
-description: "Private fork of Sonarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/terraform-nomad.yaml

@@ -2,7 +2,6 @@ description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
-archived: true
 branch_protection:
   - rule_name: "master"
     enable_push: false

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-arrstack.yaml

@@ -1,21 +0,0 @@
-description: "Terraform provider to manage the arrstack Vault secrets engine (config + roles)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-ghp.yaml

@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-arrstack.yaml

@@ -1,21 +0,0 @@
-description: "Vault/OpenBao secrets engine minting dynamic arrproxy per-user API tokens"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml

@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/waitfordb.yaml

@@ -1,16 +0,0 @@
-description: "A small Go tool, shipped as a container image, used as a Kubernetes initContainer to block an app from starting until its database is ready."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/team/repospawner.yaml

@@ -1,16 +0,0 @@
-# Least-privilege access for the repospawner bot: Write on terraform-git only,
-# which is the minimum Gitea permission that allows pushing a branch and opening
-# a pull request. repospawner does its whole job here (repo-creation PRs), so it
-# is kept out of the org-wide "agents" team (include_all_repositories: true).
-#
-# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
-# merge whitelist of the Owners team only. Keep this team out of every merge and
-# approval whitelist.
-description: "repospawner bot -- push branches + open PRs on terraform-git only"
-permission: write
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - terraform-git
-members:
-  - repospawner

config/git.unkin.net/user/repospawner.yaml

@@ -1,22 +0,0 @@
-# Service identity for repospawner, which opens pull requests against this
-# repository (terraform-git) to add new Gitea repositories on request. It is
-# deliberately separate from unkin-agent so its access can stay scoped to the
-# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
-# grants Write on terraform-git and nothing else.
-#
-# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
-# engine -- no usable credential lives in this repo's state beyond the generated
-# placeholder. Merge stays blocked by branch protection (merge whitelist =
-# Owners only), so it can push branches and open PRs but never merge.
-email: repospawner@unkin.net
-full_name: "Repo Spawner"
-description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-# Restricted: account can only see repos/orgs it is explicitly added to -- the
-# repospawner team grant on terraform-git is all it needs.
-restricted: true
-allow_create_organization: false
-max_repo_creation: 0

modules/gitea_instance/modules/branch_protection/main.tf

@@ -24,4 +24,16 @@ resource "gitea_repository_branch_protection" "this" {
   require_signed_commits                  = var.require_signed_commits
   protected_file_patterns                 = var.protected_file_patterns
   unprotected_file_patterns               = var.unprotected_file_patterns
+
+  lifecycle {
+    # Gitea resolves whitelist names to IDs and returns them ordered by repo-reader (user ID for users, name for teams), dropping any entity without repo access, so the read-back representation never matches the config and plans a spurious update every run.
+    ignore_changes = [
+      push_whitelist_users,
+      push_whitelist_teams,
+      merge_whitelist_users,
+      merge_whitelist_teams,
+      approval_whitelist_users,
+      approval_whitelist_teams,
+    ]
+  }
 }

modules/gitea_instance/modules/repository/main.tf

@@ -17,9 +17,4 @@ resource "gitea_repository" "this" {
   website                 = var.website
   autodetect_manual_merge = var.autodetect_manual_merge
   archive_on_destroy      = true
-
-  lifecycle {
-    # migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
-    ignore_changes = [migration_mirror_interval]
-  }
 }