Migration notice: This repository was developed under the nathlan organisation. Replace all references to nathlan with <YOUR_GITHUB_ORG> before use — see the migration checklist for the full list.

This repository manages a GitHub organisation's configuration — repositories, teams, branch protection rulesets, CODEOWNERS files, Actions secrets and variables, Copilot agent environments, and Agentic Workflows — as Terraform infrastructure-as-code. A single root module in terraform/ declares all resources. Changes go through pull request review and a four-stage CI/CD pipeline (validate → security scan → plan → apply) backed by OIDC-authenticated Azure state storage.

• Azure Storage Account and blob container for Terraform state
• Azure Managed Identity with a Federated Identity Credential (OIDC)
• GitHub App installed on your organisation (admin, contents, PRs, secrets, variables, workflows permissions)
• Service account with fine-grained PATs for Copilot and Agentic Workflow secrets
• GitHub prod environment on the github-config repository

See docs/prerequisites.md for the complete prerequisites inventory and per-step checklists.

Follow the step-by-step deployment guide: docs/SETUP.md

Migrate org references → provision Azure state storage → create GitHub App → generate PATs → configure secrets and variables → first apply.

The repository uses a two-tier agent architecture for automated provisioning.

Event-driven workflow triggered by issues: [opened, closed] with the github-config label. Assigns a coding agent to the issue and posts a completion comment.

• Definition: .github/workflows/github-config-dispatcher.md
• Compiled: .github/workflows/github-config-dispatcher.lock.yml

Headless agent (.github/agents/github-config.agent.md) assigned by the dispatcher. Parses issue configuration, edits terraform/terraform.tfvars, commits to a branch, and creates a PR for human review. Uses Copilot built-in tools, Terraform MCP Server, and GitHub MCP Server.

• MCP integration — .vscode/mcp.json configures Terraform and GitHub MCP servers for agent tool access

.
├── .github/
│   ├── agents/
│   │   └── github-config.agent.md
│   ├── aw/
│   │   └── actions-lock.json
│   └── workflows/
│       ├── copilot-setup-steps.yml
│       ├── github-config-dispatcher.lock.yml   ← compiled
│       ├── github-config-dispatcher.md         ← Agentic Workflow definition
│       └── github-terraform-cicd.yml
├── .vscode/
│   └── mcp.json
├── docs/
│   ├── ARCHITECTURE.md
│   ├── SETUP.md
│   ├── analysis.md
│   └── prerequisites.md
└── terraform/
    ├── data.tf
    ├── imports.tf
    ├── main.tf
    ├── outputs.tf
    ├── provider.tf
    ├── README.md
    ├── terraform.tf
    ├── terraform.tfvars
    └── variables.tf