Skip to content

Commit fd7ac91

Browse files
sheeengsheeeng
committed
fix: handle sha_pinning_required=false
Replace `Computed: true` with `Default: false` on the `sha_pinning_required` schema field and send it unconditionally via `d.Get()` on every API call. The previous `d.GetOk()` approach returned `ok=false` for zero-value booleans, causing `sha_pinning_required=false` to be silently ignored. This ensures both true and false values are correctly applied, eliminating perpetual drift when disabling SHA pinning enforcement. Affects `github_actions_organization_permissions` and `github_actions_repository_permissions` resources. Update tests to use `ConfigStateChecks` with `statecheck` package instead of deprecated `Check` field, and consolidate duplicate config templates into single reusable template strings. Fix #3223.
1 parent 1af72d4 commit fd7ac91

4 files changed

Lines changed: 136 additions & 8 deletions

‎github/resource_github_actions_organization_permissions.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ func resourceGithubActionsOrganizationPermissions() *schema.Resource {
7979
"sha_pinning_required": {
8080
Type: schema.TypeBool,
8181
Optional: true,
82-
Computed: true,
82+
Default: false,
8383
Description: "Whether pinning to a specific SHA is required for all actions and reusable workflows in an organization.",
8484
},
8585
},
@@ -158,9 +158,7 @@ func resourceGithubActionsOrganizationPermissionsCreateOrUpdate(d *schema.Resour
158158
EnabledRepositories: &enabledRepositories,
159159
}
160160

161-
if v, ok := d.GetOk("sha_pinning_required"); ok {
162-
actionsPermissions.SHAPinningRequired = github.Ptr(v.(bool))
163-
}
161+
actionsPermissions.SHAPinningRequired = github.Ptr(d.Get("sha_pinning_required").(bool))
164162

165163
_, _, err = client.Actions.UpdateActionsPermissions(ctx,
166164
orgName,

‎github/resource_github_actions_organization_permissions_test.go‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ import (
66

77
"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
88
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
9+
"github.com/hashicorp/terraform-plugin-testing/knownvalue"
10+
"github.com/hashicorp/terraform-plugin-testing/statecheck"
11+
"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
912
)
1013

1114
func TestAccGithubActionsOrganizationPermissions(t *testing.T) {
@@ -104,6 +107,62 @@ func TestAccGithubActionsOrganizationPermissions(t *testing.T) {
104107
})
105108
})
106109

110+
t.Run("test setting sha_pinning_required to true", func(t *testing.T) {
111+
enabledRepositories := "all"
112+
113+
config := fmt.Sprintf(`
114+
resource "github_actions_organization_permissions" "test" {
115+
allowed_actions = "all"
116+
enabled_repositories = "%s"
117+
sha_pinning_required = true
118+
}
119+
`, enabledRepositories)
120+
121+
resource.Test(t, resource.TestCase{
122+
PreCheck: func() { skipUnlessHasOrgs(t) },
123+
ProviderFactories: providerFactories,
124+
Steps: []resource.TestStep{
125+
{
126+
Config: config,
127+
ConfigStateChecks: []statecheck.StateCheck{
128+
statecheck.ExpectKnownValue("github_actions_organization_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(true)),
129+
},
130+
},
131+
},
132+
})
133+
})
134+
135+
t.Run("test setting sha_pinning_required to false", func(t *testing.T) {
136+
enabledRepositories := "all"
137+
138+
configTmpl := `
139+
resource "github_actions_organization_permissions" "test" {
140+
allowed_actions = "all"
141+
enabled_repositories = "%s"
142+
sha_pinning_required = %t
143+
}
144+
`
145+
146+
resource.Test(t, resource.TestCase{
147+
PreCheck: func() { skipUnlessHasOrgs(t) },
148+
ProviderFactories: providerFactories,
149+
Steps: []resource.TestStep{
150+
{
151+
Config: fmt.Sprintf(configTmpl, enabledRepositories, true),
152+
ConfigStateChecks: []statecheck.StateCheck{
153+
statecheck.ExpectKnownValue("github_actions_organization_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(true)),
154+
},
155+
},
156+
{
157+
Config: fmt.Sprintf(configTmpl, enabledRepositories, false),
158+
ConfigStateChecks: []statecheck.StateCheck{
159+
statecheck.ExpectKnownValue("github_actions_organization_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(false)),
160+
},
161+
},
162+
},
163+
})
164+
})
165+
107166
t.Run("test setting of organization allowed actions", func(t *testing.T) {
108167
allowedActions := "selected"
109168
enabledRepositories := "all"

‎github/resource_github_actions_repository_permissions.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ func resourceGithubActionsRepositoryPermissions() *schema.Resource {
6868
"sha_pinning_required": {
6969
Type: schema.TypeBool,
7070
Optional: true,
71-
Computed: true,
71+
Default: false,
7272
Description: "Whether pinning to a specific SHA is required for all actions and reusable workflows in a repository.",
7373
},
7474
},
@@ -131,9 +131,7 @@ func resourceGithubActionsRepositoryPermissionsCreateOrUpdate(d *schema.Resource
131131
repoActionPermissions.AllowedActions = &allowedActions
132132
}
133133

134-
if v, ok := d.GetOk("sha_pinning_required"); ok {
135-
repoActionPermissions.SHAPinningRequired = github.Ptr(v.(bool))
136-
}
134+
repoActionPermissions.SHAPinningRequired = github.Ptr(d.Get("sha_pinning_required").(bool))
137135

138136
_, _, err := client.Repositories.UpdateActionsPermissions(ctx,
139137
owner,

‎github/resource_github_actions_repository_permissions_test.go‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ import (
66

77
"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
88
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
9+
"github.com/hashicorp/terraform-plugin-testing/knownvalue"
10+
"github.com/hashicorp/terraform-plugin-testing/statecheck"
11+
"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
912
)
1013

1114
func TestAccGithubActionsRepositoryPermissions(t *testing.T) {
@@ -98,6 +101,76 @@ func TestAccGithubActionsRepositoryPermissions(t *testing.T) {
98101
})
99102
})
100103

104+
t.Run("test setting sha_pinning_required to true", func(t *testing.T) {
105+
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
106+
repoName := fmt.Sprintf("%srepo-act-perms-%s", testResourcePrefix, randomID)
107+
108+
config := fmt.Sprintf(`
109+
resource "github_repository" "test" {
110+
name = "%[1]s"
111+
description = "Terraform acceptance tests %[1]s"
112+
topics = ["terraform", "testing"]
113+
}
114+
115+
resource "github_actions_repository_permissions" "test" {
116+
allowed_actions = "all"
117+
repository = github_repository.test.name
118+
sha_pinning_required = true
119+
}
120+
`, repoName)
121+
122+
resource.Test(t, resource.TestCase{
123+
PreCheck: func() { skipUnauthenticated(t) },
124+
ProviderFactories: providerFactories,
125+
Steps: []resource.TestStep{
126+
{
127+
Config: config,
128+
ConfigStateChecks: []statecheck.StateCheck{
129+
statecheck.ExpectKnownValue("github_actions_repository_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(true)),
130+
},
131+
},
132+
},
133+
})
134+
})
135+
136+
t.Run("test setting sha_pinning_required to false", func(t *testing.T) {
137+
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
138+
repoName := fmt.Sprintf("%srepo-act-perms-%s", testResourcePrefix, randomID)
139+
140+
configTmpl := `
141+
resource "github_repository" "test" {
142+
name = "%[1]s"
143+
description = "Terraform acceptance tests %[1]s"
144+
topics = ["terraform", "testing"]
145+
}
146+
147+
resource "github_actions_repository_permissions" "test" {
148+
allowed_actions = "all"
149+
repository = github_repository.test.name
150+
sha_pinning_required = %[2]t
151+
}
152+
`
153+
154+
resource.Test(t, resource.TestCase{
155+
PreCheck: func() { skipUnauthenticated(t) },
156+
ProviderFactories: providerFactories,
157+
Steps: []resource.TestStep{
158+
{
159+
Config: fmt.Sprintf(configTmpl, repoName, true),
160+
ConfigStateChecks: []statecheck.StateCheck{
161+
statecheck.ExpectKnownValue("github_actions_repository_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(true)),
162+
},
163+
},
164+
{
165+
Config: fmt.Sprintf(configTmpl, repoName, false),
166+
ConfigStateChecks: []statecheck.StateCheck{
167+
statecheck.ExpectKnownValue("github_actions_repository_permissions.test", tfjsonpath.New("sha_pinning_required"), knownvalue.Bool(false)),
168+
},
169+
},
170+
},
171+
})
172+
})
173+
101174
t.Run("test setting of repository allowed actions", func(t *testing.T) {
102175
allowedActions := "selected"
103176
githubOwnedAllowed := true

0 commit comments

Comments
 (0)