Lock osac-installer ahead of its mono-repo merge

[eliorerz]

Adds lock_branch = true to repo_osac_installer, matching the same pattern already applied to fulfillment-service/osac-operator/osac-aap/bare-metal-fulfillment-operator ahead of their own OSAC-1732 merges. The branch has already been locked directly via the GitHub API as an immediate stopgap; this PR makes it durable against Terraform's own ~4h auto-apply cycle.

Summary by CodeRabbit

• Chores
  • Locked the installer repository to its current branch before migration.
  • Added documentation clarifying the repository’s frozen status.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 80a73165-0349-41b9-82a9-2e2b143ddd2b

📥 Commits

Reviewing files that changed from the base of the PR and between 3846a55 and bc3280b.

📒 Files selected for processing (1)

• repositories.tf

---

Walkthrough

The Terraform configuration locks the repo_osac_installer branch and documents that the repository is frozen before migration to the osac monorepo.

Changes

Repository branch lock

Layer / File(s)	Summary
Configure installer branch lock repositories.tf	Sets lock_branch = true for repo_osac_installer and adds migration-related comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• osac-project/github-config#148: Registers the related osac repository configuration in repositories.tf.
• osac-project/github-config#150: Applies similar lock_branch configuration to archived repositories.
• osac-project/github-config#154: Locks another repository branch before migration to the OSAC monorepo.

Suggested reviewers: larsks, masayag

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes locking osac-installer before its monorepo merge.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The only added configuration is lock_branch = true and explanatory comments; no API keys, tokens, passwords, private keys, credentials, or credential-bearing URLs were added.
No-Weak-Crypto	✅ Passed	The commit adds only Terraform comments and lock_branch = true; no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons are present.
No-Injection-Vectors	✅ Passed	The commit changes only repositories.tf, adding comments and typed lock_branch = true; scans found no listed injection patterns or executable constructs.
Container-Privileges	✅ Passed	The PR changes only repositories.tf by adding comments and lock_branch = true; it adds no container or Kubernetes privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The five added lines only document the repository lock and set lock_branch = true; they add no logging statements or sensitive values.
Ai-Attribution	✅ Passed	The PR description and its sole commit contain no AI-tool mention or attribution trailer; therefore the Red Hat trailer requirement is not triggered.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lock-osac-installer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}