fix: allow email overrides

.github/workflows/ci.yml

@@ -46,7 +46,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.TF_GH_TOKEN }}
           DNSIMPLE_ACCOUNT: ${{ secrets.TF_DNSIMPLE_ACCOUNT }}
           DNSIMPLE_TOKEN: ${{ secrets.TF_DNSIMPLE_TOKEN }}
-        run: tofu plan -no-color -var-file .tfvars -detailed-exitcode
+        run: |
+          tofu plan -no-color -detailed-exitcode \
+                    -var-file .tfvars \
+                    -var='email_overrides=${{ secrets.email_overrides }}'
 
   trivy:
     name: Trivy

.tfvars

@@ -115,6 +115,7 @@ teams = {
       "fxcoudert",
       "nandahkrishna",
       "p-linnane",
+      "SMillerDev"
     ],
     tsc = [
       "Bo98",
@@ -123,6 +124,11 @@ teams = {
       "fxcoudert",
       "iMichka",
     ],
+    analytics = [
+      "SMillerDev",
+      "Bo98",
+      "MikeMcQuaid",
+    ]
   },
   taps = {
     bundle = [

README.md

@@ -14,6 +14,16 @@ User management for the Homebrew organisation using OpenTofu
 - `tofu init`
 - `tofu plan -var-file .tfvars`
 
+### Secrets
+
+CI requires the following secrets:
+
+- `amazon_role`: The ARN of the AWS role to use for OIDC auth.
+- `email_overrides`: Map of GitHub usernames with emails for people who want a different email for tools from their GH email
+- `TF_GH_TOKEN`: GitHub token with permissions to manage org teams, users and repo permissions
+- `TF_DNSIMPLE_ACCOUNT`: Account ID for DNSimple
+- `TF_DNSIMPLE_TOKEN`: Token to authenticate to DNSimple
+
 ## TODO
 
 - Google workspace management for brew.sh

github/membership.tf

@@ -21,7 +21,7 @@ data "github_organization" "homebrew" {
 }
 
 locals {
-  member_emails = tomap({ for key, value in data.github_organization.homebrew.users : key => value.email })
+  member_emails = tomap({ for key, value in data.github_organization.homebrew.users : value.login => sensitive(value.email) })
 }
 
 output "member_emails" {

github/vars.tf

@@ -12,6 +12,7 @@ variable "teams" {
       ops              = list(string)
       formulae_brew_sh = list(string)
       ci-orchestrator  = list(string)
+      analytics        = list(string)
     })
     taps = object({
       bundle               = list(string)

main.tf

@@ -16,7 +16,7 @@ terraform {
 }
 
 locals {
-  # these people can't have their membership managed by OpenTofu becuase they are Billing Managers in GitHub
+  # these people can't have their membership managed by OpenTofu because they are Billing Managers in GitHub
   unmanagable_members = ["p-linnane", "issyl0", "colindean", "MikeMcQuaid", "BrewSponsorsBot"]
 }
 

vars.tf

@@ -12,6 +12,7 @@ variable "teams" {
       ops              = list(string)
       formulae_brew_sh = list(string)
       ci-orchestrator  = list(string)
+      analytics        = list(string)
     })
     taps = object({
       bundle               = list(string)
@@ -27,6 +28,7 @@ variable "github_admins" {
 }
 
 variable "email_overrides" {
-  type    = map(string)
-  default = {}
+  type      = map(string)
+  sensitive = true
+  default   = {}
 }