feat(terraform): add GitHub repository configuration

Manage repo settings, team permissions, and branch protection via Terraform.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: wiktoriavh

.gitignore

@@ -22,3 +22,8 @@ pnpm-debug.log*
 
 # jetbrains setting folder
 .idea/
+
+# terraform
+**/.terraform/
+*.tfstate
+*.tfstate.*

terraform/repository/.terraform.lock.hcl

@@ -0,0 +1,99 @@
+module "repository" {
+  source = "git::https://github.com/r-webdev/terraform-module-github-repository.git//modules/service?ref=v1.0.0"
+
+  # Repository name on GitHub (must match the remote, e.g. r-webdev/website).
+  name = "website"
+
+  # Short summary shown on the repo homepage and in search results.
+  description = "Community website for the Web Dev & Design Discord server."
+
+  # Link shown in the GitHub sidebar; should match PUBLIC_SITE_URL in Cloudflare Pages.
+  homepage_url = "https://webdevdesign.pages.dev"
+
+  # Who can see the repo: public, private, or internal (org members only).
+  # Public is required on GitHub Free for branch protection rules to apply.
+  visibility = "public"
+
+  # Tags used for discovery and filtering on GitHub.
+  topics = ["website"]
+
+  # Default branch for new PRs and clones; must already exist on GitHub before protection rules apply.
+  default_branch = "main"
+
+  # --- Merge settings ---
+
+  # Disallow standard merge commits (only squash merges allowed).
+  allow_merge_commit = false
+
+  # Allow squash merges — combines all commits into one on merge.
+  allow_squash_merge = true
+
+  # Disallow rebase merges onto the base branch.
+  allow_rebase_merge = false
+
+  # Use the PR title as the squash commit subject line.
+  squash_merge_commit_title = "PR_TITLE"
+
+  # Include individual commit messages in the squash commit body.
+  squash_merge_commit_message = "COMMIT_MESSAGES"
+
+  # Remove the feature branch from GitHub after the PR is merged.
+  delete_branch_on_merge = true
+
+  # Do not allow merging automatically once checks and reviews pass (manual merge required).
+  allow_auto_merge = false
+
+  # --- Repository features ---
+
+  # Enable GitHub Issues for bugs and feature requests.
+  has_issues = true
+
+  # Disable GitHub Projects (Kanban-style boards tied to the repo).
+  has_projects = false
+
+  # Disable the repo wiki.
+  has_wiki = false
+
+  # Disable GitHub Discussions.
+  has_discussions = false
+
+  # Send Dependabot security alerts for vulnerable dependencies (relevant for private repos).
+  vulnerability_alerts = true
+
+  # If Terraform destroys this resource, archive the repo instead of deleting it permanently.
+  archive_on_destroy = true
+
+  # --- Access control ---
+
+  # Map of org team slug → permission level (pull, triage, push, maintain, admin).
+  team_permissions = {
+    # Full admin access: settings, branch protection, team management.
+    admins = "admin"
+    # Write access: push to branches and open/merge PRs (subject to branch protection).
+    moderators = "push"
+  }
+
+  # --- Branch protection (main) ---
+
+  branch_protection = {
+    main = {
+      # Require all conversations on a PR to be resolved before merge.
+      required_conversation_resolution = true
+
+      # Pull request review requirements before merge.
+      required_pull_request_reviews = {
+        # New commits dismiss previous approvals so reviewers re-check changes.
+        dismiss_stale_reviews = true
+        # At least one approving review from someone other than the author.
+        required_approving_review_count = 1
+      }
+
+      # CI must pass before merge; contexts must match the GitHub Actions job name.
+      required_status_checks = {
+        # Branch must be up to date with main before merging.
+        strict   = true
+        contexts = ["ci"]
+      }
+    }
+  }
+}

terraform/repository/main.tf

@@ -0,0 +1,16 @@
+terraform {
+  # Minimum Terraform version required by the GitHub repository module.
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    github = {
+      source  = "integrations/github"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "github" {
+  # GitHub organization that owns this repository.
+  owner = "r-webdev"
+}