From 12764abd715be277e08b202532260fcd7c330873 Mon Sep 17 00:00:00 2001
From: panicboat <panicboat@gmail.com>
Date: Sat, 24 Oct 2026 22:00:57 +0900
Subject: [PATCH] chore(github/repository): close the monorepo production
 environment to every ref

Signed-off-by: panicboat <panicboat@gmail.com>
---
 README-ja.md                                  |  2 +-
 README.md                                     |  2 +-
 github/repository/master/monorepo.hcl         |  1 +
 .../modules/tests/environment.tftest.hcl      | 47 +++++++++++++++++++
 4 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/README-ja.md b/README-ja.md
index 5c5dc21d..1942dcd9 100644
--- a/README-ja.md
+++ b/README-ja.md
@@ -48,7 +48,7 @@
 
 - Environment、AWS region、IAM role は `workflow-config.yaml` で定義する。環境の追加・削除は同ファイルの編集で行う。
 - 認証は GitHub OIDC。`aws/github-oidc-auth/` が environment ごとの plan / apply role を発行し、executor がそれを引き受ける。
-- GitHub environment `production` は tag pattern `*-v*` に一致する ref からの deployment だけを受け付ける。この設定は `github/repository/` で管理する。
+- `platform` の GitHub environment `production` は tag pattern `*-v*` に一致する ref からの deployment だけを受け付け、`monorepo` の `production` はどの ref からの deployment も受け付けない。これらの設定は `github/repository/` で管理する。
 - Terragrunt の remote state は S3 + DynamoDB に保存される。bucket / lock table 名は各 `aws/{service}/root.hcl`（および `github/` 配下の同等ファイル）で定義される。
 
 ### Pipeline Flow
diff --git a/README.md b/README.md
index 0a389666..2243bf62 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ A PR labeled by `panicboat/deploy-actions` is resolved against `workflow-config.
 
 - Environments, AWS regions, and IAM roles are defined in `workflow-config.yaml`. Adding or removing an environment means editing that file.
 - Authentication uses GitHub OIDC. `aws/github-oidc-auth/` issues per-environment plan / apply roles that the executors assume.
-- The GitHub environment `production` accepts deployments only from refs that match the tag pattern `*-v*`. The setting is managed in `github/repository/`.
+- The GitHub environment `production` of `platform` accepts deployments only from refs that match the tag pattern `*-v*`, and that of `monorepo` accepts deployments from no ref. The settings are managed in `github/repository/`.
 - Terragrunt remote state lives in S3 + DynamoDB; bucket and lock-table names are defined in each `aws/{service}/root.hcl` (and the equivalent under `github/`).
 
 ### Pipeline Flow
diff --git a/github/repository/master/monorepo.hcl b/github/repository/master/monorepo.hcl
index 18c2e1a6..2eec5343 100644
--- a/github/repository/master/monorepo.hcl
+++ b/github/repository/master/monorepo.hcl
@@ -9,5 +9,6 @@ locals {
       wiki     = false
       projects = true
     }
+    environments = { production = { deployment_tag_patterns = [] } }
   }
 }
diff --git a/github/repository/modules/tests/environment.tftest.hcl b/github/repository/modules/tests/environment.tftest.hcl
index a0ddccc4..2d6bc5f3 100644
--- a/github/repository/modules/tests/environment.tftest.hcl
+++ b/github/repository/modules/tests/environment.tftest.hcl
@@ -76,6 +76,53 @@ run "creates_tag_policy_for_declared_environment" {
   }
 }
 
+run "creates_environment_without_policy_for_empty_patterns" {
+  command = plan
+
+  variables {
+    repositories = {
+      monorepo = {
+        name        = "monorepo"
+        description = "Monorepo"
+        visibility  = "public"
+        features = {
+          issues   = true
+          wiki     = false
+          projects = true
+        }
+        environments = {
+          production = { deployment_tag_patterns = [] }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition     = keys(github_repository_environment.repository) == ["monorepo/production"]
+    error_message = "One environment must exist per declared repository and environment."
+  }
+
+  assert {
+    condition     = github_repository_environment.repository["monorepo/production"].can_admins_bypass == false
+    error_message = "Admins must not bypass the deployment policy."
+  }
+
+  assert {
+    condition     = github_repository_environment.repository["monorepo/production"].deployment_branch_policy[0].custom_branch_policies == true
+    error_message = "The environment must restrict deployments with custom policies."
+  }
+
+  assert {
+    condition     = github_repository_environment.repository["monorepo/production"].deployment_branch_policy[0].protected_branches == false
+    error_message = "The environment must not rely on protected branches."
+  }
+
+  assert {
+    condition     = length(github_repository_environment_deployment_policy.repository) == 0
+    error_message = "An environment without tag patterns must have no deployment policy, so no ref can deploy."
+  }
+}
+
 run "creates_no_environment_by_default" {
   command = plan