Converge the 56 managed repositories with terraform apply

[matt-edmondson]

Context

The Terraform workspace can import and converge the 56 managed repositories, but terraform apply has never been run. github/repositories.tf does not exist yet.

What it would change

The apply was simulated against live API data for all 56 repos before anything was written:

• Descriptions: 0 changes. No repo's derived description differs from what GitHub holds.
• Topics: 2 changes. GitBranchStateCache gains 20 topics from an empty set. ProjectDirector swaps 4, and its TAGS.md has already been trimmed so dotnet and csharp survive the 20-topic cap.
• Settings: merge methods on 56, wiki off on 54, projects off on 56, homepage filled on 22.

No repository is created or destroyed. Every resource carries prevent_destroy and archive_on_destroy, so Terraform cannot delete a repo. Removing one from the configuration is an error, not a deletion.

Prerequisites

• A GitHub PAT with admin:org. The current token carries only gist, read:org, repo, and workflow, and org-scoped calls return 403 without it.
• The deprecated-attribute issue should be resolved first, since default_branch is computed and setting it on github_repository is a no-op.

Acceptance criteria

• github/repositories.tf written, with prevent_destroy and archive_on_destroy on every resource
• github/imports.tf written using import blocks with for_each
• The plan contains zero creates and zero destroys. A proposed create means a name does not match a real repo, and applying would make a new empty repository. Treat it as a stop condition.
• Applied, then terraform plan returns a clean exit code 0
• github/imports.tf deleted after the first successful apply

Note for the implementer

github_repository.topics is computed. Omitting it preserves live topics, setting [] wipes them. local.defaults carries three keys that are not github_repository arguments (default_branch, description_override, topics_override), so the resource must name its fields explicitly rather than splatting the map.

[matt-edmondson]

Do #7 first. default_branch is deprecated and computed on github_repository, so setting it there is a no-op. Resolving it before the convergence apply avoids a second pass over 56 repositories.

[matt-edmondson]

Triage

Priority: Medium Effort: Medium

What needs to be done: Run the first terraform apply to converge 56 managed repositories' settings/topics/descriptions, writing github/repositories.tf and github/imports.tf.

Suggested next steps / acceptance criteria:

• Resolve .github#7 first (deprecated github_repository attributes) to avoid a second pass over all 56 repos
• Obtain an admin:org-scoped PAT (current token lacks it)
• Confirm the plan shows zero creates/destroys before applying — treat any proposed create as a stop condition
• Delete github/imports.tf after the first successful apply

Blockers / dependencies: Should follow .github#7 (explicit ordering, author's own comment). Needs an admin:org PAT as an external prerequisite. .github#4 (Terraform CI/drift detection) depends on this landing first

---

Generated by Claude Code