Create and Manage GitHub Repositories with Terraform for CI/CD Best Practices

Provision GitHub repositories as code without leaving your orchestration layer. This Infrastructure as Code blueprint runs the official Terraform GitHub provider inside a Kestra flow, so a new repository (with name, description, visibility, and auto-initialization) is created declaratively and reproducibly from a couple of inputs. It solves the problem of manual, click-driven repo creation by turning repository scaffolding into a parameterized, auditable, self-service workflow that platform and DevOps teams can trigger on demand.

How it works

1. The flow exposes two inputs, repository_name and description, that feed directly into the Terraform configuration.
2. A single io.kestra.plugin.terraform.cli.TerraformCLI task writes an inline main.tf via inputFiles, declaring the integrations/github provider (pinned to ~> 6.0) and a github_repository resource built from the inputs.
3. The provider authenticates to GitHub using {{ secret('GITHUB_TOKEN') }}, keeping the token out of the flow code.
4. beforeCommands runs terraform init to download the provider, then commands runs terraform plan and terraform apply -auto-approve, piping both through tee into plan_output.txt and apply_output.txt.
5. outputFiles captures *.txt so the plan and apply logs are stored as flow outputs for review and downstream use.

What you get

• A new GitHub repository created on demand from declarative configuration.
• Captured Terraform plan and apply logs as flow outputs for auditing and debugging.
• Token-free flow code, with credentials injected through Kestra secrets.
• A reusable, parameterized pattern for repository scaffolding.

Who it's for

• Platform engineering teams building developer self-service.
• DevOps and SRE teams standardizing GitOps repository provisioning.
• Engineering leads who want consistent, reviewable repo creation.

Why orchestrate this with Kestra

Terraform on its own has no scheduler, no event triggers, and no built-in run history across executions. Kestra wraps the Terraform CLI in declarative YAML, adds event and schedule triggers, retries, and full execution lineage with stored logs and outputs. You get a parameterized self-service entry point, secret management, and an audit trail that the Terraform CLI alone cannot provide. This flow intentionally runs without a remote backend, which suits one-off bootstrap and scaffolding runs; for long-lived infrastructure, configure a Terraform backend to persist state.

Prerequisites

• A Kestra instance with the Terraform plugin available.
• A GitHub account or organization where the repository will be created.

Secrets

• GITHUB_TOKEN: a GitHub Personal Access Token with permission to create repositories. See the GitHub docs on managing personal access tokens.

Quick start

1. Add GITHUB_TOKEN as a secret in your Kestra instance.
2. Import this blueprint into your Kestra instance.
3. Execute the flow, providing repository_name and description.
4. Inspect plan_output.txt and apply_output.txt in the execution outputs to confirm the repository was created.

How to extend

• Add inputs for visibility, topics, branch protection, or default branch to control more repository settings.
• Configure a Terraform backend (for example S3 or GCS) to persist state for long-lived management.
• Chain follow-up tasks to seed the new repo with files, webhooks, or CI workflows.
• Add a trigger so repositories are provisioned automatically from an upstream event.

Links

• Terraform plugin documentation
• Terraform orchestration with Kestra