GCSS-1135: Add support for GitHub repository environments

.github/actions/graformer/action.yaml

@@ -112,6 +112,9 @@ runs:
               return `${resourceChange.type} :: ${match[1]}/${actualChange.pattern}`;
             }else if(resourceChange.type === 'github_repository_environment'){
               return `${resourceChange.type} :: ${actualChange.repository}/${actualChange.environment}`;
+            }else if(resourceChange.type === 'github_repository_environment_deployment_policy'){
+              const pattern = actualChange.branch_pattern || actualChange.tag_pattern;
+              return `${resourceChange.type} :: ${actualChange.repository}/${actualChange.environment} (${pattern})`;
             }else if(resourceChange.type === 'github_repository_custom_property'){
               return `${resourceChange.type} :: ${actualChange.repository}/${actualChange.property_name}`;
             } else {

.github/workflows/promote-imported-configs.yaml

@@ -96,7 +96,7 @@ jobs:
             mkdir -p "$dst"
 
             find "$src" -type f -name '*.yaml' | while read file; do
-              yq '. |= ( with(select(.rulesets[] != null); .rulesets[] |= del(.id)) | with(select(.rulesets[] == null); .) )' -i $file
+              yq '. |= ( with(select(.rulesets[] != null); .rulesets[] |= del(.id)) | with(select(.rulesets[] == null); .) ) | del(.environments[].deployment_policy.branch_policy_ids) | del(.environments[].deployment_policy.tag_policy_ids)' -i $file
             done
 
             find "$src" -maxdepth 1 -type f \( -name "*.yaml" -o -name ".*.yaml" \) -print -exec mv {} "$dst" \;

.schemas/repository-config.schema.json

@@ -91,6 +91,81 @@
         "ref_name"
       ]
     },
+    "DeploymentPolicy": {
+      "properties": {
+        "policy_type": {
+          "type": "string",
+          "enum": [
+            "protected_branches",
+            "selected_branches_and_tags"
+          ]
+        },
+        "branch_patterns": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "tag_patterns": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "policy_type"
+      ]
+    },
+    "Environment": {
+      "properties": {
+        "environment": {
+          "type": "string"
+        },
+        "wait_timer": {
+          "type": "integer",
+          "maximum": 43200,
+          "minimum": 0
+        },
+        "can_admins_bypass": {
+          "type": "boolean"
+        },
+        "prevent_self_review": {
+          "type": "boolean"
+        },
+        "reviewers": {
+          "$ref": "#/$defs/EnvironmentReviewers"
+        },
+        "deployment_policy": {
+          "$ref": "#/$defs/DeploymentPolicy"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "environment"
+      ]
+    },
+    "EnvironmentReviewers": {
+      "properties": {
+        "teams": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "users": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
     "HighIntegrityConfig": {
       "properties": {
         "enabled": {
@@ -421,6 +496,12 @@
           },
           "type": "array"
         },
+        "environments": {
+          "items": {
+            "$ref": "#/$defs/Environment"
+          },
+          "type": "array"
+        },
         "custom_properties": {
           "additionalProperties": {
             "type": "string"

DEVELOPERS_GUIDE.md

@@ -100,6 +100,8 @@ These are the primary configuration options for each repository.
 
 - **`vulnerability_alerts_enabled`**: *(optional, boolean)* If `true`, vulnerability alerts are enabled.
 
+- **`environments`**: *(optional, object[] [Environment](#environment-configuration))* Configuration for repository environments. Requires `feature_github_environments: true` in the import config. When imported, environments are managed by Terraform.
+
 - **`branch_protections_v4`**: *(optional, object[] [BranchProtectionV4](#branch-protection-configuration-v4))* Configuration for branch protection rules.
 
 - **`custom_properties`**: *(optional, map[string]string)* A map of GitHub organization custom property names to their string values. See [Custom Properties](#custom-properties).
@@ -126,6 +128,27 @@ high_integrity:
   enabled: true
 ```
 
+## Environment Configuration
+
+### Environment Fields
+
+- **`environment`**: *(required, string)* Environment name
+- **`wait_timer`**: *(optional, int)* Delay in minutes (max 43200, i.e. 30 days)
+- **`can_admins_bypass`**: *(optional, bool)* Admin bypass allowed (default: true)
+- **`prevent_self_review`**: *(optional, bool)* Prevent self-approval (default: false)
+- **`reviewers`**: *(optional, object)* At most 6 reviewers total across `users` and `teams`.
+  - **`users`**: *(string[])* GitHub usernames
+  - **`teams`**: *(string[])* Team slugs
+
+  > ⚠️ **Team access requirement**
+  >
+  > Teams specified as reviewers must have repository access first, otherwise Terraform applies successfully but the teams are not added as reviewers and the next plan/apply keeps showing them as proposed changes.
+
+- **`deployment_policy`**: *(optional, object)* Controls which branches/tags can deploy to this environment.
+  - **`policy_type`**: *(required, string)* One of `protected_branches` (only protected branches can deploy) or `selected_branches_and_tags` (specific branch/tag patterns can deploy).
+  - **`branch_patterns`**: *(optional, string[])* Branch patterns (e.g. `["main", "release/*"]`). Only used when `policy_type` is `selected_branches_and_tags`; omit otherwise.
+  - **`tag_patterns`**: *(optional, string[])* Tag patterns (e.g. `["v*"]`). Only used when `policy_type` is `selected_branches_and_tags`; omit otherwise.
+
 ## Custom Properties
 
 [GitHub organization custom properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) allow organizations to attach structured metadata to repositories — such as lifecycle stage, team ownership, compliance classification, or any other organization-defined attribute. They are defined once at the organization level and can then be set per repository.
@@ -382,4 +405,4 @@ Options for configuring required status checks in V4.
 
 - **`strict`**: *(optional, boolean)* If `true`, strict status checks are enforced.
 
-- **`contexts`**: *(optional, string[])* A list of required status check contexts.
+- **`contexts`**: *(optional, string[])* A list of required status check contexts.

feature/github-repo-importer/cmd/import.go

@@ -8,6 +8,8 @@ import (
 	"github.com/gr-oss-devops/github-repo-importer/pkg/github"
 )
 
+var importConfigPath string
+
 var importCmd = &cobra.Command{
 	Use:   "import [owner/repo]",
 	Short: "Import command reads all repository details and creates a configuration yaml file",
@@ -18,7 +20,12 @@ var importCmd = &cobra.Command{
 	RunE: func(cmd *cobra.Command, args []string) error {
 		repository := args[0]
 
-		repo, err := github.ImportRepo(repository)
+		cfg, err := DecodeConfiguration(importConfigPath)
+		if err != nil {
+			return fmt.Errorf("failed to load config: %w", err)
+		}
+
+		repo, err := github.ImportRepo(repository, cfg)
 		if err != nil {
 			return err
 		}
@@ -33,4 +40,5 @@ var importCmd = &cobra.Command{
 
 func init() {
 	rootCmd.AddCommand(importCmd)
+	importCmd.Flags().StringVarP(&importConfigPath, "config", "c", "./import-config.yaml", "Path to the import config file (default: ./import-config.yaml)")
 }

feature/github-repo-importer/pkg/compare/compare.go

@@ -100,6 +100,8 @@ func hashNormalizedYamlFile(path string) (string, error) {
 	if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
 		root := node.Content[0]
 		removeKey(root, "id")
+		removeKey(root, "branch_policy_ids")
+		removeKey(root, "tag_policy_ids")
 		sortMappingNode(root)
 	}
 

feature/github-repo-importer/pkg/github/config.go

@@ -5,10 +5,11 @@ import (
 )
 
 type Config struct {
-	IsPublic      *bool    `yaml:"is_public,omitempty"`
-	IgnoredRepos  []string `yaml:"ignored_repos,omitempty"`
-	SelectedRepos []string `yaml:"selected_repos,omitempty"`
-	PageSize      *int     `yaml:"page_size,omitempty"`
+	IsPublic                  *bool    `yaml:"is_public,omitempty"`
+	IgnoredRepos              []string `yaml:"ignored_repos,omitempty"`
+	SelectedRepos             []string `yaml:"selected_repos,omitempty"`
+	PageSize                  *int     `yaml:"page_size,omitempty"`
+	FeatureGithubEnvironments *bool    `yaml:"feature_github_environments,omitempty"`
 }
 
 func (c *Config) Validate() error {

feature/github-repo-importer/pkg/github/environments.go

@@ -0,0 +1,23 @@
+package github
+
+type Environment struct {
+	Environment       string                `yaml:"environment" jsonschema:"required"`
+	WaitTimer         *int                  `yaml:"wait_timer,omitempty" jsonschema:"minimum=0,maximum=43200"`
+	CanAdminsBypass   *bool                 `yaml:"can_admins_bypass,omitempty"`
+	PreventSelfReview *bool                 `yaml:"prevent_self_review,omitempty"`
+	Reviewers         *EnvironmentReviewers `yaml:"reviewers,omitempty"`
+	DeploymentPolicy  *DeploymentPolicy     `yaml:"deployment_policy,omitempty"`
+}
+
+type EnvironmentReviewers struct {
+	Teams []string `yaml:"teams,omitempty"`
+	Users []string `yaml:"users,omitempty"`
+}
+
+type DeploymentPolicy struct {
+	PolicyType      string           `yaml:"policy_type" jsonschema:"required,enum=protected_branches,enum=selected_branches_and_tags"`
+	BranchPatterns  []string         `yaml:"branch_patterns,omitempty"`
+	TagPatterns     []string         `yaml:"tag_patterns,omitempty"`
+	BranchPolicyIDs map[string]int64 `yaml:"branch_policy_ids,omitempty" jsonschema:"-"`
+	TagPolicyIDs    map[string]int64 `yaml:"tag_policy_ids,omitempty" jsonschema:"-"`
+}