Importing existing GitHub repos into Terraform via a Claude skill

## Spark

While threading the digest, I'd queued a tutorial titled something like "Importing existing GitHub branch protections into Terraform" — the kind of long-form walkthrough that captures the import dance and the gotchas. On reflection: in 2026 the more useful artifact is a **Claude skill** that performs the import, not a tutorial that walks a human through it. Same knowledge, lower friction, replays.

## Why it could be interesting

The "modern how-to" claim is the actual post: where a 2020 tutorial would walk you through `terraform import`, current state management, drift detection, and the protection-by-protection import sequence, the 2026 equivalent is "point Claude at the repo, run the skill, get a Terraform module." The skill encodes the gotchas (existing API state vs Terraform desired state, the rules-vs-ruleset split, branch-protection deprecation in favour of rulesets, secret/variable scoping) once, and replays them across every repo in the estate.

The post is then both: (a) the skill itself, with its README explaining what it does and why it's safe to run; (b) a meta-reflection on the genre shift — when the deliverable for a how-to is a skill, what does that change about how you write the surrounding prose?

Concrete shape:
- Skill lives in `alunduil/alunduil-chezmoi` under `.claude/skills/tf-github-import/` (host-wide).
- Reads a target repo via `gh`, generates Terraform config + an `import {}` block per resource (1.5+ syntax, not the `terraform import` CLI).
- Idempotent: re-running on an already-imported repo produces no diff.
- Companion to alunduil/alunduil-infrastructure, which is the consumer of these imports.

## Open questions

- [ ] Scope: which GitHub resources are in v1? (branch protection, rulesets, repo settings, secrets, environments, Pages — pick the minimum that retires the highest-friction manual work.)
- [ ] Is `terraform import {}` blocks the right output, or should the skill drive `terraform import` CLI? (Blocks are declarative and reviewable; CLI is faster but opaque.)
- [ ] How does the skill detect "already imported"? Read state, parse for resource addresses, skip?
- [ ] Should this be one skill ("import everything for one repo") or a family ("import-protection", "import-rulesets", "import-secrets")?
- [ ] Genre question: if the skill IS the artifact, does the post still warrant prose, or just a README + an animated demo?

## Source material

- alunduil/alunduil-infrastructure#14 — Manage default branch and protection in Terraform (closes #8)
- alunduil/alunduil-infrastructure#13 — Manage blog.alunduil.com Pages and default branch
- alunduil/alunduil-infrastructure issues #15–#26 — settings-audit baseline across managed repos
- Reframe came from blog.alunduil.com idea-triage conversation, 2026-05-04