Add further Trace, Debug and Info logs

Signed-off-by: Timo Sand <timo.sand@f-secure.com>

Author: deiga

github/resource_github_actions_organization_workflow_permissions.go

@@ -57,30 +57,63 @@ func resourceGithubActionsOrganizationWorkflowPermissions() *schema.Resource {
 	}
 }
 
-func handleEditWorkflowPermissionsError(err error, resp *github.Response) diag.Diagnostics {
+func handleEditWorkflowPermissionsError(ctx context.Context, err error, resp *github.Response) diag.Diagnostics {
 	var ghErr *github.ErrorResponse
 	if errors.As(err, &ghErr) {
 		if ghErr.Response.StatusCode == http.StatusConflict {
+			tflog.Info(ctx, "Detected conflict with workflow permissions", map[string]any{
+				"status_code": ghErr.Response.StatusCode,
+			})
+
 			errorResponse := &GithubActionsOrganizationWorkflowPermissionsErrorResponse{}
 			data, readError := io.ReadAll(resp.Body)
 			if readError == nil && data != nil {
 				unmarshalError := json.Unmarshal(data, errorResponse)
 				if unmarshalError != nil {
+					tflog.Error(ctx, "Failed to unmarshal error response", map[string]any{
+						"error": unmarshalError.Error(),
+					})
 					return diag.FromErr(unmarshalError)
 				}
+
+				tflog.Debug(ctx, "Parsed workflow permissions conflict error", map[string]any{
+					"message":           errorResponse.Message,
+					"errors":            errorResponse.Errors,
+					"documentation_url": errorResponse.DocumentationURL,
+					"status":            errorResponse.Status,
+				})
 			}
 			return diag.FromErr(fmt.Errorf("you are trying to modify a value restricted by the Enterprise's settings.\n Message: %s\n Errors: %s\n Documentation URL: %s\n Status: %s\nerr: %w", errorResponse.Message, errorResponse.Errors, errorResponse.DocumentationURL, errorResponse.Status, err))
 		}
 	}
+
+	tflog.Trace(ctx, "Returning generic error", map[string]any{
+		"error": err.Error(),
+	})
+
 	return diag.FromErr(err)
 }
 
 func resourceGithubActionsOrganizationWorkflowPermissionsCreateOrUpdate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
+	tflog.Trace(ctx, "Entering Create/Update workflow permissions", map[string]any{
+		"organization_slug": d.Get("organization_slug").(string),
+	})
+
 	client := meta.(*Owner).v3client
 
 	organizationSlug := d.Get("organization_slug").(string)
 	d.SetId(organizationSlug)
 
+	if d.IsNewResource() {
+		tflog.Info(ctx, "Creating organization workflow permissions", map[string]any{
+			"organization_slug": organizationSlug,
+		})
+	} else {
+		tflog.Info(ctx, "Updating organization workflow permissions", map[string]any{
+			"organization_slug": organizationSlug,
+		})
+	}
+
 	workflowPerms := github.DefaultWorkflowPermissionOrganization{}
 
 	if v, ok := d.GetOk("default_workflow_permissions"); ok {
@@ -91,25 +124,36 @@ func resourceGithubActionsOrganizationWorkflowPermissionsCreateOrUpdate(ctx cont
 		workflowPerms.CanApprovePullRequestReviews = github.Ptr(v.(bool))
 	}
 
-	tflog.Debug(ctx, "Updating workflow permissions for Organization", map[string]any{
+	tflog.Debug(ctx, "Calling GitHub API to update workflow permissions", map[string]any{
 		"organization_slug":                organizationSlug,
 		"default_workflow_permissions":     workflowPerms.DefaultWorkflowPermissions,
 		"can_approve_pull_request_reviews": workflowPerms.CanApprovePullRequestReviews,
 	})
 	_, resp, err := client.Actions.UpdateDefaultWorkflowPermissionsInOrganization(ctx, organizationSlug, workflowPerms)
 	if err != nil {
-		return handleEditWorkflowPermissionsError(err, resp)
+		return handleEditWorkflowPermissionsError(ctx, err, resp)
 	}
 
+	tflog.Trace(ctx, "GitHub API call completed successfully", map[string]any{
+		"organization_slug": organizationSlug,
+	})
+
 	// Calling read is necessary as the Update API returns 204 with Empty Body on success
+	tflog.Trace(ctx, "Exiting Create/Update workflow permissions successfully", map[string]any{
+		"organization_slug": organizationSlug,
+	})
 	return resourceGithubActionsOrganizationWorkflowPermissionsRead(ctx, d, meta)
 }
 
 func resourceGithubActionsOrganizationWorkflowPermissionsRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
+	tflog.Trace(ctx, "Entering Read workflow permissions", map[string]any{
+		"organization_slug": d.Id(),
+	})
+
 	client := meta.(*Owner).v3client
 
 	organizationSlug := d.Id()
-	tflog.Debug(ctx, "Reading workflow permissions for Organization", map[string]any{
+	tflog.Debug(ctx, "Calling GitHub API to read workflow permissions", map[string]any{
 		"organization_slug": organizationSlug,
 	})
 
@@ -118,6 +162,18 @@ func resourceGithubActionsOrganizationWorkflowPermissionsRead(ctx context.Contex
 		return diag.FromErr(err)
 	}
 
+	tflog.Debug(ctx, "Retrieved workflow permissions from API", map[string]any{
+		"organization_slug":                organizationSlug,
+		"default_workflow_permissions":     workflowPerms.DefaultWorkflowPermissions,
+		"can_approve_pull_request_reviews": workflowPerms.CanApprovePullRequestReviews,
+	})
+
+	tflog.Trace(ctx, "Setting state values", map[string]any{
+		"organization_slug":                organizationSlug,
+		"default_workflow_permissions":     workflowPerms.DefaultWorkflowPermissions,
+		"can_approve_pull_request_reviews": workflowPerms.CanApprovePullRequestReviews,
+	})
+
 	if err := d.Set("organization_slug", organizationSlug); err != nil {
 		return diag.FromErr(err)
 	}
@@ -128,14 +184,22 @@ func resourceGithubActionsOrganizationWorkflowPermissionsRead(ctx context.Contex
 		return diag.FromErr(err)
 	}
 
+	tflog.Trace(ctx, "Exiting Read workflow permissions successfully", map[string]any{
+		"organization_slug": organizationSlug,
+	})
+
 	return nil
 }
 
 func resourceGithubActionsOrganizationWorkflowPermissionsDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
+	tflog.Trace(ctx, "Entering Delete workflow permissions", map[string]any{
+		"organization_slug": d.Id(),
+	})
+
 	client := meta.(*Owner).v3client
 
 	organizationSlug := d.Id()
-	tflog.Debug(ctx, "Resetting workflow permissions to defaults for Organization", map[string]any{
+	tflog.Info(ctx, "Deleting organization workflow permissions (resetting to defaults)", map[string]any{
 		"organization_slug": organizationSlug,
 	})
 
@@ -145,10 +209,27 @@ func resourceGithubActionsOrganizationWorkflowPermissionsDelete(ctx context.Cont
 		CanApprovePullRequestReviews: github.Ptr(false),
 	}
 
+	tflog.Debug(ctx, "Using safe default values", map[string]any{
+		"default_workflow_permissions":     "read",
+		"can_approve_pull_request_reviews": false,
+	})
+
+	tflog.Debug(ctx, "Calling GitHub API to reset workflow permissions", map[string]any{
+		"organization_slug": organizationSlug,
+	})
+
 	_, resp, err := client.Actions.UpdateDefaultWorkflowPermissionsInOrganization(ctx, organizationSlug, workflowPerms)
 	if err != nil {
-		return handleEditWorkflowPermissionsError(err, resp)
+		return handleEditWorkflowPermissionsError(ctx, err, resp)
 	}
 
+	tflog.Trace(ctx, "GitHub API call completed successfully", map[string]any{
+		"organization_slug": organizationSlug,
+	})
+
+	tflog.Trace(ctx, "Exiting Delete workflow permissions successfully", map[string]any{
+		"organization_slug": organizationSlug,
+	})
+
 	return nil
 }