From 89ed77f30ffa1c7ca92b74fab25abec0f94a2013 Mon Sep 17 00:00:00 2001
From: NWarila <33955773+NWarila@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:00:19 -0400
Subject: [PATCH] fix: omit repo-level web_commit_signoff_required when
 org-enforced
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub returns 422 "Commit signoff is enforced by the organization and cannot be
disabled" on ANY repo-level write of web_commit_signoff_required once the org
enforces it — aborting the repo apply before its rulesets/branch config are
created, so every new repo failed to get governed. Resolve the repo-level value
to null (omit) when the org enforces it, else respect the repo level (explicit
YAML value, or the null default). Org enforcement is the single source of truth.

Fixes the 422 that left nwarila-platform/secure-wazuh without rulesets/CODEOWNERS.
---
 terraform/30-locals.tf                   | 21 +++++++++++++++++----
 terraform/tests/normalization.tftest.hcl |  4 ++--
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/terraform/30-locals.tf b/terraform/30-locals.tf
index 8283815..7f424d3 100644
--- a/terraform/30-locals.tf
+++ b/terraform/30-locals.tf
@@ -104,7 +104,11 @@ locals {
     delete_branch_on_merge      = true
     squash_merge_commit_title   = "PR_TITLE"
     squash_merge_commit_message = "PR_BODY"
-    web_commit_signoff_required = true
+    # Omit at the repo level: web_commit_signoff is ORG-ENFORCED (org_settings), and
+    # GitHub 422s any repo-level write of it once enforced ("cannot be disabled").
+    # null => the attribute is omitted, so the org setting is the single source of
+    # truth. A repo's YAML may still explicitly set it to override.
+    web_commit_signoff_required = null
     auto_init                   = true
     license_template            = null
     archived                    = false
@@ -551,9 +555,18 @@ locals {
         local.repo_setting_defaults.squash_merge_commit_title
       )
 
-      web_commit_signoff_required = coalesce(
-        try(repository.web_commit_signoff_required, null),
-        local.repo_setting_defaults.web_commit_signoff_required
+      # web_commit_signoff is ORG-ENFORCED when org_settings sets it true: GitHub
+      # then 422s ANY repo-level write of the attribute ("cannot be disabled"), so
+      # when the org enforces it the repo value MUST be null (omit) regardless of
+      # YAML. When the org does NOT enforce it, respect the repo level: the repo's
+      # YAML value if set, else the null default (still omit). try (not coalesce)
+      # because the default is null and coalesce rejects an all-null argument list.
+      # try(...) on the org read: local.organization_settings is null in personal
+      # mode (no org enforcement), in which case we respect the repo level.
+      web_commit_signoff_required = (
+        try(local.organization_settings.web_commit_signoff_required, false)
+        ? null
+        : try(repository.web_commit_signoff_required, local.repo_setting_defaults.web_commit_signoff_required)
       )
 
       #endregion --- [ Merge Behavior ] ------------------------------------------------------ #
diff --git a/terraform/tests/normalization.tftest.hcl b/terraform/tests/normalization.tftest.hcl
index c1df70a..9821aa7 100644
--- a/terraform/tests/normalization.tftest.hcl
+++ b/terraform/tests/normalization.tftest.hcl
@@ -440,8 +440,8 @@ run "good_minimal_carries_expected_defaults" {
 
   # Commit signoff
   assert {
-    condition     = output.all_repositories["example-public-repo"].web_commit_signoff_required == true
-    error_message = "web_commit_signoff_required default must be true"
+    condition     = output.all_repositories["example-public-repo"].web_commit_signoff_required == null
+    error_message = "web_commit_signoff_required must default to null (omit) at the repo level — org enforcement is the source of truth"
   }
 
   # Init / licensing