Skip to content

Commit 49ad201

Browse files
committed
feat(actions_permissions): sha_pinning_required
Signed-off-by: Leonard Sheng Sheng Lee <leonard.sheng.sheng.lee@gmail.com>
1 parent 38e68ad commit 49ad201

6 files changed

+48
-6
lines changed

github/resource_github_actions_organization_permissions.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ func resourceGithubActionsOrganizationPermissions() *schema.Resource {
5757
Optional: true,
5858
Description: "Whether actions in GitHub Marketplace from verified creators are allowed. Set to 'true' to allow all GitHub Marketplace actions by verified creators.",
5959
},
60+
"sha_pinning_required": {
61+
Type: schema.TypeBool,
62+
Optional: true,
63+
Description: "Whether pinning to a specific SHA is required for all actions and reusable workflows in an organization.",
64+
},
6065
},
6166
},
6267
},
@@ -96,6 +101,10 @@ func resourceGithubActionsOrganizationAllowedObject(d *schema.ResourceData) (*gi
96101
allowed.VerifiedAllowed = &x
97102
}
98103

104+
if v, ok := data["sha_pinning_required"]; ok {
105+
allowed.SHAPinningRequired = github.Bool(v.(bool))
106+
}
107+
99108
patternsAllowed := []string{}
100109

101110
switch t := data["patterns_allowed"].(type) {
@@ -229,6 +238,7 @@ func resourceGithubActionsOrganizationPermissionsRead(d *schema.ResourceData, me
229238
"github_owned_allowed": actionsAllowed.GetGithubOwnedAllowed(),
230239
"patterns_allowed": actionsAllowed.PatternsAllowed,
231240
"verified_allowed": actionsAllowed.GetVerifiedAllowed(),
241+
"sha_pinning_required": actionsAllowed.GetShaPinningRequired(),
232242
},
233243
}); err != nil {
234244
return err
@@ -309,3 +319,19 @@ func resourceGithubActionsOrganizationPermissionsDelete(d *schema.ResourceData,
309319

310320
return nil
311321
}
322+
323+
func flattenActionsAllowed(d *schema.ResourceData, actionsAllowed *github.ActionsAllowed) error {
324+
if actionsAllowed != nil {
325+
config := make(map[string]interface{})
326+
config["github_owned_allowed"] = actionsAllowed.GetGithubOwnedAllowed()
327+
config["verified_allowed"] = actionsAllowed.GetVerifiedAllowed()
328+
config["patterns_allowed"] = schema.NewSet(schema.HashString, interfaceSlice(actionsAllowed.GetPatternsAllowed()))
329+
config["sha_pinning_required"] = actionsAllowed.GetShaPinningRequired()
330+
331+
if err := d.Set("allowed_actions_config", []interface{}{config}); err != nil {
332+
return err
333+
}
334+
}
335+
336+
return nil
337+
}

github/resource_github_actions_organization_permissions_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ func TestAccGithubActionsOrganizationPermissions(t *testing.T) {
5555
enabledRepositories := "selected"
5656
githubOwnedAllowed := true
5757
verifiedAllowed := true
58+
shaPinningRequired := true
5859
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
5960

6061
config := fmt.Sprintf(`
@@ -71,12 +72,13 @@ func TestAccGithubActionsOrganizationPermissions(t *testing.T) {
7172
github_owned_allowed = %t
7273
patterns_allowed = ["actions/cache@*", "actions/checkout@*"]
7374
verified_allowed = %t
75+
sha_pinning_required = %t
7476
}
7577
enabled_repositories_config {
7678
repository_ids = [github_repository.test.repo_id]
7779
}
7880
}
79-
`, randomID, allowedActions, enabledRepositories, githubOwnedAllowed, verifiedAllowed)
81+
`, randomID, allowedActions, enabledRepositories, githubOwnedAllowed, verifiedAllowed, shaPinningRequired)
8082

8183
check := resource.ComposeTestCheckFunc(
8284
resource.TestCheckResourceAttr(

github/resource_github_actions_repository_permissions.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ func resourceGithubActionsRepositoryPermissions() *schema.Resource {
5050
Optional: true,
5151
Description: "Whether actions in GitHub Marketplace from verified creators are allowed. Set to 'true' to allow all GitHub Marketplace actions by verified creators.",
5252
},
53+
"sha_pinning_required": {
54+
Type: schema.TypeBool,
55+
Optional: true,
56+
Description: "Whether pinning to a specific SHA is required for all actions and reusable workflows in a repository.",
57+
},
5358
},
5459
},
5560
},
@@ -85,6 +90,10 @@ func resourceGithubActionsRepositoryAllowedObject(d *schema.ResourceData) (*gith
8590
allowed.VerifiedAllowed = &x
8691
}
8792

93+
if v, ok := data["sha_pinning_required"]; ok {
94+
allowed.SHAPinningRequired = github.Bool(v.(bool))
95+
}
96+
8897
patternsAllowed := []string{}
8998

9099
switch t := data["patterns_allowed"].(type) {
@@ -192,6 +201,7 @@ func resourceGithubActionsRepositoryPermissionsRead(d *schema.ResourceData, meta
192201
"github_owned_allowed": actionsAllowed.GetGithubOwnedAllowed(),
193202
"patterns_allowed": actionsAllowed.PatternsAllowed,
194203
"verified_allowed": actionsAllowed.GetVerifiedAllowed(),
204+
"sha_pinning_required": actionsAllowed.GetShaPinningRequired(),
195205
},
196206
}); err != nil {
197207
return err

github/resource_github_actions_repository_permissions_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ func TestAccGithubActionsRepositoryPermissions(t *testing.T) {
6666
allowedActions := "selected"
6767
githubOwnedAllowed := true
6868
verifiedAllowed := true
69+
shaPinningRequired := true
6970
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
7071

7172
config := fmt.Sprintf(`
@@ -81,10 +82,11 @@ func TestAccGithubActionsRepositoryPermissions(t *testing.T) {
8182
github_owned_allowed = %t
8283
patterns_allowed = ["actions/cache@*", "actions/checkout@*"]
8384
verified_allowed = %t
85+
sha_pinning_required = %t
8486
}
8587
repository = github_repository.test.name
8688
}
87-
`, randomID, allowedActions, githubOwnedAllowed, verifiedAllowed)
89+
`, randomID, allowedActions, githubOwnedAllowed, verifiedAllowed, shaPinningRequired)
8890

8991
check := resource.ComposeTestCheckFunc(
9092
resource.TestCheckResourceAttr(

go.mod

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
module github.com/integrations/terraform-provider-github/v6
22

3-
go 1.21
4-
5-
toolchain go1.22.4
3+
go 1.24.0
64

75
require (
86
github.com/client9/misspell v0.3.4
@@ -87,7 +85,8 @@ require (
8785
github.com/golangci/plugin-module-register v0.1.1 // indirect
8886
github.com/golangci/revgrep v0.5.3 // indirect
8987
github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed // indirect
90-
github.com/google/go-cmp v0.6.0 // indirect
88+
github.com/google/go-cmp v0.7.0 // indirect
89+
github.com/google/go-github/v78 v78.0.0 // indirect
9190
github.com/google/go-querystring v1.1.0 // indirect
9291
github.com/gordonklaus/ineffassign v0.1.0 // indirect
9392
github.com/gostaticanalysis/analysisutil v0.7.1 // indirect

go.sum

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,8 +290,11 @@ github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
290290
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
291291
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
292292
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
293+
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
293294
github.com/google/go-github/v67 v67.0.0 h1:g11NDAmfaBaCO8qYdI9fsmbaRipHNWRIU/2YGvlh4rg=
294295
github.com/google/go-github/v67 v67.0.0/go.mod h1:zH3K7BxjFndr9QSeFibx4lTKkYS3K9nDanoI1NjaOtY=
296+
github.com/google/go-github/v78 v78.0.0 h1:b1tytzFE8i//lRVDx5Qh/EdJbtTPtSVD3nF7hraEs9w=
297+
github.com/google/go-github/v78 v78.0.0/go.mod h1:Uxvdzy82AkNlC6JQ57se9TqvmgBT7RF0ouHDNg2jd6g=
295298
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
296299
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
297300
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=

0 commit comments

Comments
 (0)