docs: apply roles default value

README.md

@@ -141,7 +141,7 @@ The module reads the following variables as input:
 | `gcp_project` | ✓ | N/A | The GCP project name |
 | `gcp_region` | ✓ | N/A | The GCP region for all resources managed within the project |
 | `github_repo` | ✓ | N/A | The fully-qualified name of the GitHub repo to which the state access will be granted |
-| `apply_action_project_roles` | ✗ | `[ "roles/iam.serviceAccountAdmin", "roles/storage.admin", "roles/iam.workloadIdentityPoolAdmin" ]` | The list of project-wide roles to grant apply actions |
+| `apply_action_project_roles` | ✗ | `[ "roles/iam.serviceAccountAdmin", "roles/iam.roleAdmin", "roles/iam.workloadIdentityPoolAdmin", "roles/resourcemanager.projectIamAdmin", "roles/serviceusage.serviceUsageAdmin", "roles/storage.admin" ]` | The list of project-wide roles to grant apply actions |
 | `github_default_branch_name` | ✗ | `"main"` | The default/mainline branch name for the GitHub repo, workflows for which have OpenTofu apply (vs. plan) access |
 | `state_bucket_name` | ✗ | `"${var.gcp_project}-opentofu-state"` | The name of the bucket used for OpenTofu state |