[eliorerz]

Summary

The MOC-hosted osac-terraform-state bucket was removed, so Apply configuration failed at tofu init with NoSuchBucket. #245 then disabled the scheduled and push triggers. This PR turns them back on now that the state has a new home.

Already done outside this PR

• New bucket: osac-terraform-state in us-east-1, in an OSAC-controlled AWS account. It's versioned, blocks all public access, uses SSE-S3 encryption, and has ACLs disabled.
• State restored from the export provided by @larsks (serial 1790, lineage cb7cdde1-…). The uploaded object's checksum matches the export.
• New credentials: the IAM user github-config-tofu-state, whose inline policy allows only s3:ListBucket on the bucket and Get/Put/DeleteObject on osac.tfstate and osac.tfstate.tflock. Its key is now in the repo's AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY secrets.

Changes

• Restore the schedule and push triggers removed by Disable terraform plan/apply workflows #245.
• backend.tf: enable native S3 state locking (use_lockfile = true). The old backend had no locking.
• versions.tf: require OpenTofu >= 1.10.0, the first version with use_lockfile. CI installs the latest.
• README: describe the new state location in place of the NERC bucket.

Validation

• tofu fmt -check -recursive, tofu validate, pre-commit run --all-files: all pass.
• A local tofu plan against the new bucket (personal token, which lacks admin:org) showed 0 to destroy. Its updates match the last successful CI apply (Oct 15, 08:33 UTC) exactly: the same 7 recurring in-place updates, plus OSAC-6150: Allow stale enhancement proposal branches #265's enhancement-proposals strict-checks change, which hasn't been applied yet. The only "create" was github_organization_role.runner_manager, an artifact of the personal token getting 404s on the org-roles API. The GitHub App token used in CI has that scope.

After merge

The push trigger only fires on *.tf/*.csv changes. This PR changes backend.tf and versions.tf, so merging it starts an apply automatically. Expected result: 0 to add, 8 to change, 0 to destroy. If the apply instead tries to create repos, teams or memberships, the state didn't load, and we should investigate before letting it continue.

🤖 Generated with Claude Code

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: dba32a51-24e1-40bd-b973-bcff3750fc82

📥 Commits

Reviewing files that changed from the base of the PR and between 686eed6 and aad98ac.

📒 Files selected for processing: 4

• .github/workflows/apply.yaml
• README.md
• backend.tf
• versions.tf

+------------------------------------------------------------------------+
| Making the Death Star fully operational, with zero exhaust port flaws. |
+------------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}