# GitHub repository for revenue-file-ingestion application code. Pairs with the QA
# S3 stack at accounting/qa/revenue-file-ingestion/. Intended successor to bacon
# (prod/github/bacon/) and slaughterhouse (accounting/qa/slaughterhouse/) once
# producers migrate; slaughterhouse and bacon stay canonical until then.
#
# AWS S3 (qa-revenue-file-ingestion) uses application_family "accounting".
#
# Human bucket access:
#   prod/iam/users/orchard + prod/iam/groups/accounting
#   -> assume accounting-role in Accounting QA (989790945997)
#   -> RBAC *-revenue-file-ingestion* on
#      accounting/qa/iam/application-family/accounting

provider "aws" {
  region = var.aws_region
}

provider "github" {
  owner = var.github_organization
  app_auth {}
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/github/revenue-file-ingestion/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "github_repositories" {
  source = "git@github.com:theorchard/terraform-github.git//?ref=6.1.4"

  application_family               = var.application_family
  delete_branch_on_merge           = false
  allow_rebase_merge               = true
  restrict_dismissals              = true
  repository_name                  = var.service_name
  branch_protection_enabled        = true
  branch_protection_enforce_admins = true
  has_downloads                    = true
  archived_repository              = false
  github_code_owner_reviews        = false
  github_push_teams                = [var.default_code_owner]
  description                      = var.service_name
  homepage_url                     = "https://github.com/${var.github_organization}/${var.service_name}"
  default_code_owner               = var.default_code_owner
  required_status_checks           = []
}