feat: Add support for Private Vulnerability Reporting#2969
Open
eslerm wants to merge 1 commit into
Open
Conversation
Collaborator
|
Hey @eslerm Thank you for your contribution! Could you change your approach here? Instead of adding a new field to |
eslerm
force-pushed
the
feature/private-vulnerability-reporting
branch
from
6e22178 to
69c7e18
Compare
Author
|
Rebased onto main and refactored per @deiga's feedback — private vulnerability reporting is now a standalone resource ( The resource follows the same pattern as
Additional improvements over the reference pattern:
Please let me know if I can make improvements! |
deiga
requested changes
Mar 6, 2026
Comment on lines
+16
to
+21
| Create: resourceGithubRepositoryPrivateVulnerabilityReportingCreateOrUpdate, | ||
| Read: resourceGithubRepositoryPrivateVulnerabilityReportingRead, | ||
| Update: resourceGithubRepositoryPrivateVulnerabilityReportingCreateOrUpdate, | ||
| Delete: resourceGithubRepositoryPrivateVulnerabilityReportingDelete, | ||
| Importer: &schema.ResourceImporter{ | ||
| State: resourceGithubRepositoryPrivateVulnerabilityReportingImport, |
Collaborator
There was a problem hiding this comment.
Please use the Context-aware functions here
Comment on lines
+25
to
+30
| "repository": { | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| Description: "The GitHub repository.", | ||
| }, |
Collaborator
There was a problem hiding this comment.
Please adopt the repo rename pattern which has been introduced:
- Remove
ForceNew - Add new
Computedfieldrepository_id - Add
diffRepositorytoCustomizeDiff
|
|
||
| func resourceGithubRepositoryPrivateVulnerabilityReporting() *schema.Resource { | ||
| return &schema.Resource{ | ||
| Create: resourceGithubRepositoryPrivateVulnerabilityReportingCreateOrUpdate, |
Collaborator
There was a problem hiding this comment.
Please add a top-level Describe
| return fmt.Errorf("error setting private vulnerability reporting for repository %s/%s: %w", owner, repoName, err) | ||
| } | ||
| d.SetId(repoName) | ||
| return resourceGithubRepositoryPrivateVulnerabilityReportingRead(d, meta) |
Collaborator
There was a problem hiding this comment.
Every CRUD function should have no calls to other CRUD functions
| if err != nil { | ||
| var ghErr *github.ErrorResponse | ||
| if errors.As(err, &ghErr) && ghErr.Response.StatusCode == http.StatusNotFound { | ||
| log.Printf("[WARN] private vulnerability reporting not available for %s/%s, removing from state", owner, repoName) |
|
|
||
| _ = d.Set("repository", repoName) | ||
|
|
||
| err := resourceGithubRepositoryPrivateVulnerabilityReportingRead(d, meta) |
Collaborator
There was a problem hiding this comment.
Do not call any CRUD functions directly
| func resourceGithubRepositoryPrivateVulnerabilityReportingImport(d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) { | ||
| repoName := d.Id() | ||
|
|
||
| _ = d.Set("repository", repoName) |
Comment on lines
+34
to
+47
| checks := map[string]resource.TestCheckFunc{ | ||
| "before": resource.ComposeTestCheckFunc( | ||
| resource.TestCheckResourceAttr( | ||
| "github_repository_private_vulnerability_reporting.test", "enabled", | ||
| "false", | ||
| ), | ||
| ), | ||
| "after": resource.ComposeTestCheckFunc( | ||
| resource.TestCheckResourceAttr( | ||
| "github_repository_private_vulnerability_reporting.test", "enabled", | ||
| "true", | ||
| ), | ||
| ), | ||
| } |
Collaborator
There was a problem hiding this comment.
Please don't use a separate variable for these
| Steps: []resource.TestStep{ | ||
| { | ||
| Config: config, | ||
| Check: checks["before"], |
Collaborator
There was a problem hiding this comment.
Please use ConfigStateChecks instead
Comment on lines
+59
to
+61
| Config: strings.Replace(config, | ||
| enabled, | ||
| updatedEnabled, 1), |
Collaborator
There was a problem hiding this comment.
Please don't use strings.Replace on the config, rather use fmt.Sprintf
Author
|
Thank you @deiga 🙏 |
eslerm
force-pushed
the
feature/private-vulnerability-reporting
branch
from
69c7e18 to
eb00224
Compare
Add a standalone resource for managing private vulnerability reporting on GitHub repositories, modeled after github_repository_vulnerability_alerts: - Context-aware CRUD (CreateContext/ReadContext/UpdateContext/DeleteContext) - Computed repository_id with diffRepository CustomizeDiff so renames don't force replacement - tflog logging and propagated d.Set errors - 404 handling in Read (gracefully removes from state when PVR is unavailable or the repository is gone) - Archived repository handling in Delete via handleArchivedRepoDelete - Acceptance tests using ConfigStateChecks, with import and private-repo rejection coverage Closes integrations#2399
eslerm
force-pushed
the
feature/private-vulnerability-reporting
branch
from
eb00224 to
deea2f3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds private_vulnerability_reporting to the github_repository resource's security_and_analysis block.
Implementation uses dedicated GitHub API endpoints rather than the repository Edit API, since PVR status is not included in the SecurityAndAnalysis response:
Changes:
Resolves #2399