Protect github branches, mandate status checks with Terraform

git-protect.tf

# Protect the master branch. Enforce that ci/tests and shiftleft should pass to allow merges
# Allow PR to be dismissed by sem-user and managers team
resource "github_branch_protection" "protect_master" {
  repository     = "${github_repository_name}"
  branch         = "master"
  enforce_admins = true
  require_signed_commits = false
  
  required_status_checks {
    strict   = false
    contexts = ["ci/tests", "shiftleft"]
  }

  required_pull_request_reviews {
    dismiss_stale_reviews = true
    dismissal_users       = ["sem-user"]
    dismissal_teams       = ["${github_team.managers.slug}"]
  }

  restrictions {
    users = ["sem-user"]
    teams = ["${github_team.managers.slug}"]
  }
}

resource "github_team" "managers" {
  name = "SEM team"
}

resource "github_team_repository" "example" {
  team_id    = "${github_team.managers.id}"
  repository = "${github_repository_name}"
  permission = "pull"
}