Exclude "revoke-" branches from needing signed commits

repository.tf

@@ -45,12 +45,6 @@ resource "github_repository_ruleset" "default" {
     }
   }
 
-  bypass_actors {
-    actor_id    = 15368 # Github Actions bot app ID was found here: https://api.github.com/apps/github-actions
-    actor_type  = "Integration"
-    bypass_mode = "pull_request"
-  }
-
   rules {
     creation            = true  # restrict creation of default branch
     update              = false # allows PR merges on default branch
@@ -78,16 +72,10 @@ resource "github_repository_ruleset" "all" {
   conditions {
     ref_name {
       include = ["~ALL"]
-      exclude = []
+      exclude = each.value.exclude_all_rules.branches
     }
   }
 
-  bypass_actors {
-    actor_id    = 15368 # Github Actions bot app ID was found here: https://api.github.com/apps/github-actions
-    actor_type  = "Integration"
-    bypass_mode = "pull_request"
-  }
-
   rules {
     creation            = false # do not restrict creation 
     update              = false

variables.tf

@@ -75,6 +75,9 @@ variable "repositories" {
       value       = string
       sensitive   = bool
     }))), {})
+    exclude_all_rules          = optional(object({
+      branches = optional(list(string), [])
+    }), {})
   }))
   description = <<-EOL
     A map of GitHub repositories in the organization.