The org/github/ Terraform root manages organization settings, owners,
repositories, Actions policy, environments, and rulesets. Its state uses the
stormtrust/github.tfstate key in Cloudflare R2.
GitHub jobs receive either the plan token or the apply token, plus scoped R2 backend credentials. The Cloudflare API provider token is not available to this root.
Pull requests run local validation and a remote plan. The terraform-apply
label authorizes a fresh plan for the exact commit. After merge, the trusted
main workflow applies a new saved plan and verifies remote state.
| Intent | Start here |
|---|---|
| How-to | Pull request workflow |
| How-to | Manage repositories |
| How-to | Review an access change |
| Reference | Credentials |
| Explanation | Organization governance |