The organisation's deploy-key setting is declared in the GitHub settings root #86

The organisation setting that allows deploy keys is declared in src/opentofu/github, so it cannot drift away from what Flux on the PC needs.

Caller

• The PC creates its age key once and reaches platform-secrets with its own read-only deploy key #61 (the PC's deploy key on platform-secrets): Flux on the PC fetches the private repository platform-secrets with a read-only deploy key. GitHub refuses the key while the organisation's deploy_keys_enabled_for_repositories is false. On 07.11.2026 that flag was false, and the operator set it to true by hand at The PC creates its age key once and reaches platform-secrets with its own read-only deploy key #61's host step B6, with gh api -X PATCH orgs/overnightworks. The deploy key, not a GitHub App or a PAT, was weighed in chat that day: an App's private key sits on the PC just as unprotected, and the PC holds the age key anyway.
• Every fleet repository's GitHub settings and the organisation rulesets live as code in platform #10, which puts the fleet's GitHub settings into code. Today this one is set by hand and owned by no root.

Done when

• src/opentofu/github declares deploy_keys_enabled_for_repositories = true for the organisation overnightworks. A plan with scripts/apply_github_settings.sh shows no other organisation setting changing. If the only resource that carries the flag (github_organization_settings in integrations/github 6.13.0) would take over and reset other organisation settings, the plan names each one, and the slice either declares them at their live values or stops and names the alternative.
• mise run github:test is green. The mocked test pins the flag's relationship to the PC's deploy key, not a copied literal.
• The operator's --apply changes nothing on the live organisation, because the flag is already true.

Unknown, for its plan

• Whether github_organization_settings requires billing_email and other attributes, and resets unset ones to provider defaults. Read the provider's schema at 6.13.0 and plan against the live organisation before building.

version = 1
now = "Opened 07.11.2026 after the operator enabled deploy keys for the organisation by hand at #61's B6."
next = "Plan: read github_organization_settings at 6.13.0 and plan against the live organisation, then declare the flag without changing any other setting."
done_when = "src/opentofu/github declares deploy_keys_enabled_for_repositories = true for overnightworks; its plan changes no other organisation setting; mise run github:test is green; the operator's apply changes nothing live."
scope = [
  "src/opentofu/github",
]
size = "S"
whole = "The organisation resource, its test and the root's lock change together in one root."