add option to restrict deployments, require protected branch source

.github/workflows/publish-terraform-module.yml

@@ -42,7 +42,7 @@ jobs:
         id: tag
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEFAULT_BUMP: patch
+          DEFAULT_BUMP: minor
           WITH_V: false
           DRY_RUN: true
       - name: List Release

main.tf

@@ -17,6 +17,11 @@ resource "github_repository_environment" "repo_apply_environment" {
     teams = var.terraform_apply_reviewers
     users = []
   }
+  deployment_branch_policy {
+    protected_branches = var.require_protected_branches
+    #https://github.com/integrations/terraform-provider-github/issues/922#issuecomment-998957627
+    custom_branch_policies = false
+  }
 }
 
 # Store the domain's project id for easier access during github actions workflows

variables.tf

@@ -55,3 +55,9 @@ variable "workload_identity_provider" {
   description = "GCP Workload Identity provider id for setting repo environment secrets for gcloud setup step"
   type        = string
 }
+
+variable "require_protected_branches" {
+  description = "Whether to restrict the apply environment to deploying from protected branches. Recommended to set to true for PRD"
+  type        = bool
+  default     = false
+}