Move metadata bucket to shared secrets (#42)

* Move metadata bucket to shared secrets

* ci: bump setup-opentofu to v2 and add Dependabot

The action's v1 still runs on the Node 16 runtime, which GitHub keeps
warning about. v2 moved to Node 20 with no behavioral changes for how
we use it (init/fmt/validate).

Dependabot is configured with grouped weekly updates so we get one PR
per ecosystem rather than a flood of individual bumps.

Author: peterdeme

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+        patterns:
+          - "*"
+
+  - package-ecosystem: terraform
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+        patterns:
+          - "*"
+
+  - package-ecosystem: terraform
+    directory: /examples/simple
+    schedule:
+      interval: weekly
+    groups:
+      all:
+        patterns:
+          - "*"
+
+  - package-ecosystem: terraform
+    directory: /examples/with-vcs-gateway
+    schedule:
+      interval: weekly
+    groups:
+      all:
+        patterns:
+          - "*"

.github/workflows/ci.yaml

@@ -12,7 +12,7 @@ jobs:
         uses: actions/checkout@main
 
       - name: Setup OpenTofu
-        uses: opentofu/setup-opentofu@v1
+        uses: opentofu/setup-opentofu@v2
 
       - name: OpenTofu fmt
         run: tofu fmt -recursive -diff -check

templates/kubernetes-secrets.tftpl

@@ -15,6 +15,7 @@ stringData:
   OBJECT_STORAGE_TYPE: "gcp"
   OBJECT_STORAGE_BUCKET_DELIVERIES: "${OBJECT_STORAGE_BUCKET_DELIVERIES}"
   OBJECT_STORAGE_BUCKET_LARGE_QUEUE_MESSAGES: "${OBJECT_STORAGE_BUCKET_LARGE_QUEUE_MESSAGES}"
+  OBJECT_STORAGE_BUCKET_METADATA: "${OBJECT_STORAGE_BUCKET_METADATA}"
   OBJECT_STORAGE_BUCKET_MODULES: "${OBJECT_STORAGE_BUCKET_MODULES}"
   OBJECT_STORAGE_BUCKET_POLICY_INPUTS: "${OBJECT_STORAGE_BUCKET_POLICY_INPUTS}"
   OBJECT_STORAGE_BUCKET_RUN_LOGS: "${OBJECT_STORAGE_BUCKET_RUN_LOGS}"
@@ -52,4 +53,3 @@ type: Opaque
 stringData:
   LAUNCHER_IMAGE: "${LAUNCHER_IMAGE}"
   LAUNCHER_IMAGE_TAG: "${LAUNCHER_IMAGE_TAG}"
-  OBJECT_STORAGE_BUCKET_METADATA: "${OBJECT_STORAGE_BUCKET_METADATA}"