provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/github/backend-js-repo/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "github_repositories" {
  source             = "git@github.com:theorchard/terraform-github.git//?ref=3.0.1"
  application_family = var.application_family

  github_repository_names = {
    "${var.service_name}" = {
      branch_protection_enabled        = true
      branch_protection_enforce_admins = true
      repo_auto_init                   = true
      archived_repository              = false
      github_code_owner_reviews        = true
      visibility                       = "private"
      description                      = "Monorepo for our shared javascript npm packages for backend"
      has_downloads                    = false
      homepage_url                     = "https://github.com/theorchard/${var.service_name}"
    }
  }
}

resource "github_branch_protection" "branch_next_protection" {
  # checkov:skip=CKV_GIT_5:We required only one reviewer in the established workflow.
  # checkov:skip=CKV_GIT_6:We don't require Git commits to be GPG signed.

  repository_id  = module.github_repositories.github_repository_node_id["${var.service_name}"]
  pattern        = "next"
  enforce_admins = true

  required_status_checks {
    strict = true
  }

  required_pull_request_reviews {
    dismiss_stale_reviews      = true
    require_code_owner_reviews = true
  }

  lifecycle {
    ignore_changes = [
      required_status_checks,
    ]
  }
}

resource "github_branch_protection" "branch_patch_protection" {
  # checkov:skip=CKV_GIT_5:We required only one reviewer in the established workflow.
  # checkov:skip=CKV_GIT_6:We don't require Git commits to be GPG signed.

  repository_id  = module.github_repositories.github_repository_node_id["${var.service_name}"]
  pattern        = "PATCH-*"
  enforce_admins = true

  required_status_checks {
    strict = true
  }

  required_pull_request_reviews {
    dismiss_stale_reviews      = true
    require_code_owner_reviews = true
  }

  lifecycle {
    ignore_changes = [
      required_status_checks,
    ]
  }
}