Sync github (cloudposse#140)

* Sync github

* sync

.github/CODEOWNERS

@@ -3,6 +3,23 @@
 #
 # Order is important: the last matching pattern has the highest precedence
 
-# This module is used everywhere and changes must be carefully vetted,
-# so only allow cloudposse Admins to approve PRs.
-*             @cloudposse/admins
+# These owners will be the default owners for everything
+*             @cloudposse/engineering @cloudposse/contributors
+
+# Cloud Posse must review any changes to Makefiles
+**/Makefile   @cloudposse/engineering
+**/Makefile.* @cloudposse/engineering
+
+# Cloud Posse must review any changes to GitHub actions
+.github/*     @cloudposse/engineering
+
+# Cloud Posse must review any changes to standard context definition,
+# but some changes can be rubber-stamped.
+**/*.tf       @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
+README.yaml   @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
+README.md     @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
+docs/*.md     @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
+
+# Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration
+.github/mergify.yml @cloudposse/admins
+.github/CODEOWNERS  @cloudposse/admins

.github/auto-release.yml

@@ -17,8 +17,8 @@ version-resolver:
     - 'bugfix'
     - 'bug'
     - 'hotfix'
-    - 'no-release'
   default: 'minor'
+filter-by-commitish: true
 
 categories:
 - title: '🚀 Enhancements'

.github/mergify.yml

@@ -0,0 +1,61 @@
+# https://docs.mergify.io/conditions.html
+# https://docs.mergify.io/actions.html
+pull_request_rules:
+- name: "approve automated PRs that have passed checks"
+  conditions:
+  - "base=main"
+  - "-closed"
+  - "head~=^(auto-update|renovate)/.*"
+  - "check-success=terraform-module / ci"
+  - "and: *common_checks"
+  - "sender-permission>=write"
+  actions:
+    review:
+      type: "APPROVE"
+      bot_account: "cloudposse-mergebot"
+      message: "We've automatically approved this PR because the checks from the automated Pull Request have passed."
+
+- name: "merge automated PRs when approved and tests pass"
+  conditions:
+  - "base=main"
+  - "-closed"
+  - "head~=^(auto-update|renovate)/.*"
+  - "check-success=terraform-module / ci"
+  - "and: *common_checks"
+  - "#approved-reviews-by>=1"
+  - "#changes-requested-reviews-by=0"
+  - "#commented-reviews-by=0"
+  - "sender-permission>=write"
+  actions:
+    merge:
+      method: "squash"
+
+- name: "delete the head branch after merge"
+  conditions:
+  - "merged"
+  actions:
+    delete_head_branch: {}
+
+- name: "ask to resolve conflict"
+  conditions:
+  - "conflict"
+  - "-closed"
+  actions:
+    comment:
+      message: "This pull request has conflicts, please resolve."
+
+- name: "remove outdated reviews"
+  conditions:
+  - "base=main"
+  actions:
+    dismiss_reviews:
+      changes_requested: true
+      approved: true
+      message: "This Pull Request has been updated, so we're dismissing all reviews."
+
+- name: "close PRs with no files changed"
+  conditions:
+    - "#files=0"
+  actions:
+    close:
+      message: "This pull request has been automatically closed by Mergify because there are no longer any changes."

.github/renovate.json

@@ -1,3 +1,17 @@
 {
-  "enabled": false
+  "extends": [
+    "config:base",
+    ":preserveSemverRanges"
+  ],
+  "labels": ["auto-update"],
+  "dependencyDashboardAutoclose": true,
+  "enabledManagers": ["terraform"],
+  "terraform": {
+    "ignorePaths": ["**/context.tf", "examples/**"]
+  },
+  "postUpgradeTasks": {
+    "commands": ["make readme"],
+    "fileFilters": ["README.md"],
+    "executionMode": "update"
+  }
 }

.github/workflows/feature-branch-chatops.yml

@@ -0,0 +1,16 @@
+---
+name: feature-branch-chatops
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  pull-requests: write
+  id-token: write
+  contents: write
+
+jobs:
+  terraform-module:
+    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/feature-branch-chatops.yml@main
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}

.github/workflows/feature-branch.yml

@@ -0,0 +1,19 @@
+---
+name: feature-branch
+on:
+  pull_request:
+    branches:
+      - main
+      - release/**
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  pull-requests: write
+  id-token: write
+  contents: write
+
+jobs:
+  terraform-module:
+    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/feature-branch.yml@pass_repo
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}

.github/workflows/release-branch.yml

@@ -0,0 +1,22 @@
+---
+name: release-branch
+on:
+  push:
+    branches:
+      - main
+      - release/**
+    paths-ignore:
+      - '.github/**'
+      - 'docs/**'
+      - 'examples/**'
+      - 'test/**'
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  terraform-module:
+    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-branch.yml@pass_repo
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}