# GitHub

The `org/github/` Terraform root manages organization settings, owners, repositories, Actions policy, environments, and rulesets. Its state uses the ` stormtrust/github.tfstate` key in Cloudflare R2.

GitHub jobs receive either the plan token or the apply token, plus scoped R2 backend credentials. The Cloudflare API provider token is not available to this root.

## Workflow

Pull requests run local validation and a remote plan. The `terraform-apply` label authorizes a fresh plan for the exact commit. After merge, the trusted `main` workflow applies a new saved plan and verifies remote state.

## GitHub topics

| Intent      | Start here                                                                     |
| ----------- | ------------------------------------------------------------------------------ |
| How-to      | [Pull request workflow](/stormtrust/engineering/github/pull-request-workflow/) |
| How-to      | [Manage repositories](/stormtrust/engineering/github/repositories/)            |
| How-to      | [Review an access change](/stormtrust/org/review-access/)                      |
| Reference   | [Credentials](/stormtrust/engineering/github/credentials/)                     |
| Explanation | [Organization governance](/stormtrust/org/governance/)                         |

## All pages

- [Pull request workflow](/stormtrust/engineering/github/pull-request-workflow/)
- [Manage repositories](/stormtrust/engineering/github/repositories/)
- [Credentials](/stormtrust/engineering/github/credentials/)