Set custom property on template repo creation

gistfile1.txt

name: Initial Repository Configuration

on:
  # Template instantiation does not fire `create`; the first push to main
  # (or a manual run) sets the property. The PATCH below is idempotent.
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  actions: write

jobs:
  set-repo-type:
    runs-on: ubuntu-latest

    steps:
      - name: Generate GitHub App token
        id: app-token
        # App needs organization "Custom properties" read and write permission.
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.CUSTOM_PROP_RW_APP_ID }}
          private-key: ${{ secrets.CUSTOM_PROP_RW_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      # Doing this allows all our Rulesets tied to this template repo type to 
      # be applied
      - name: Set repo_type custom property to terraform
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh api \
            --method PATCH \
            -H "Accept: application/vnd.github+json" \
            "/repos/${{ github.repository }}/properties/values" \
            --input - <<'EOF'
          {
            "properties": [
              { "property_name": "repo_type", "value": ["terraform"] }
            ]
          }
          EOF

      # Ideally we would delete this workflow instead, but then we run into the issue where either 
      # the GH App token would need additional permissions to write to all repositories and then
      # also have it excluded from all the rulesets that would enforce direct pushes to main OR
      # we use the default GITHUB_TOKEN which would then need to be excluded from the rulesets.
      - name: Disable this workflow so it only runs once
        # Don't disable this workflow on the template repo itself
        if: github.repository != 'THIS_ONE'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh api \
            --method PUT \
            -H "Accept: application/vnd.github+json" \
            "/repos/${{ github.repository }}/actions/workflows/initial-repo-configuration.yml/disable"