Skip to content

Commit f789396

Browse files
M0NsTeRRRnickfloyd
M0NsTeRRR
and
nickfloyd
authored
feat: support workflow permissions in repository (#2309)
* feat: support workflow permissions Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr> * chore(docs): add github_workflow_repository_permissions documentation Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr> * fix: use resourceGithubWorkflowRepositoryPermissionsRead on create Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr> * fix: update go-github to v67 Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr> --------- Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr> Co-authored-by: Nick Floyd <139819+nickfloyd@users.noreply.github.com>
1 parent ebd358f commit f789396

File tree

4 files changed

+290
-0
lines changed

4 files changed

+290
-0
lines changed

‎github/provider.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ func Provider() *schema.Provider {
202202
"github_user_ssh_key": resourceGithubUserSshKey(),
203203
"github_enterprise_organization": resourceGithubEnterpriseOrganization(),
204204
"github_enterprise_actions_runner_group": resourceGithubActionsEnterpriseRunnerGroup(),
205+
"github_workflow_repository_permissions": resourceGithubWorkflowRepositoryPermissions(),
205206
},
206207

207208
DataSourcesMap: map[string]*schema.Resource{

‎github/resource_github_workflow_repository_permissions.go‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
package github
2+
3+
import (
4+
"context"
5+
6+
"github.com/google/go-github/v67/github"
7+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
9+
)
10+
11+
func resourceGithubWorkflowRepositoryPermissions() *schema.Resource {
12+
return &schema.Resource{
13+
Create: resourceGithubWorkflowRepositoryPermissionsCreateOrUpdate,
14+
Read: resourceGithubWorkflowRepositoryPermissionsRead,
15+
Update: resourceGithubWorkflowRepositoryPermissionsCreateOrUpdate,
16+
Delete: resourceGithubWorkflowRepositoryPermissionsDelete,
17+
Importer: &schema.ResourceImporter{
18+
StateContext: schema.ImportStatePassthroughContext,
19+
},
20+
21+
Schema: map[string]*schema.Schema{
22+
"default_workflow_permissions": {
23+
Type: schema.TypeString,
24+
Optional: true,
25+
Description: "The default workflow permissions granted to the GITHUB_TOKEN when running workflows.",
26+
ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"read", "write"}, false), "default_workflow_permissions"),
27+
},
28+
"can_approve_pull_request_reviews": {
29+
Type: schema.TypeBool,
30+
Optional: true,
31+
Default: false,
32+
Description: "Whether GitHub Actions can approve pull requests. Enabling this can be a security risk.",
33+
},
34+
"repository": {
35+
Type: schema.TypeString,
36+
Required: true,
37+
Description: "The GitHub repository.",
38+
ValidateDiagFunc: toDiagFunc(validation.StringLenBetween(1, 100), "repository"),
39+
},
40+
},
41+
}
42+
}
43+
44+
func resourceGithubWorkflowRepositoryPermissionsCreateOrUpdate(d *schema.ResourceData, meta interface{}) error {
45+
client := meta.(*Owner).v3client
46+
47+
owner := meta.(*Owner).name
48+
repoName := d.Get("repository").(string)
49+
ctx := context.Background()
50+
if !d.IsNewResource() {
51+
ctx = context.WithValue(ctx, ctxId, d.Id())
52+
}
53+
54+
defaultWorkflowPermissions := d.Get("default_workflow_permissions").(string)
55+
canApprovePullRequestReviews := d.Get("can_approve_pull_request_reviews").(bool)
56+
57+
repoWorkflowPermissions := github.DefaultWorkflowPermissionRepository{
58+
DefaultWorkflowPermissions: &defaultWorkflowPermissions,
59+
CanApprovePullRequestReviews: &canApprovePullRequestReviews,
60+
}
61+
62+
_, _, err := client.Repositories.EditDefaultWorkflowPermissions(ctx,
63+
owner,
64+
repoName,
65+
repoWorkflowPermissions,
66+
)
67+
if err != nil {
68+
return err
69+
}
70+
71+
d.SetId(repoName)
72+
return resourceGithubWorkflowRepositoryPermissionsRead(d, meta)
73+
}
74+
75+
func resourceGithubWorkflowRepositoryPermissionsRead(d *schema.ResourceData, meta interface{}) error {
76+
client := meta.(*Owner).v3client
77+
78+
owner := meta.(*Owner).name
79+
repoName := d.Id()
80+
ctx := context.WithValue(context.Background(), ctxId, d.Id())
81+
82+
workflowsPermissions, _, err := client.Repositories.GetDefaultWorkflowPermissions(ctx, owner, repoName)
83+
if err != nil {
84+
return err
85+
}
86+
87+
if err = d.Set("default_workflow_permissions", workflowsPermissions.GetDefaultWorkflowPermissions()); err != nil {
88+
return err
89+
}
90+
if err = d.Set("can_approve_pull_request_reviews", workflowsPermissions.GetCanApprovePullRequestReviews()); err != nil {
91+
return err
92+
}
93+
if err = d.Set("repository", repoName); err != nil {
94+
return err
95+
}
96+
97+
return nil
98+
}
99+
100+
func resourceGithubWorkflowRepositoryPermissionsDelete(d *schema.ResourceData, meta interface{}) error {
101+
client := meta.(*Owner).v3client
102+
owner := meta.(*Owner).name
103+
repoName := d.Id()
104+
105+
ctx := context.WithValue(context.Background(), ctxId, d.Id())
106+
107+
// Reset the repo to "default" settings
108+
repoWorkflowPermissions := github.DefaultWorkflowPermissionRepository{
109+
DefaultWorkflowPermissions: github.String("read"),
110+
CanApprovePullRequestReviews: github.Bool(false),
111+
}
112+
113+
_, _, err := client.Repositories.EditDefaultWorkflowPermissions(ctx,
114+
owner,
115+
repoName,
116+
repoWorkflowPermissions,
117+
)
118+
if err != nil {
119+
return err
120+
}
121+
122+
return nil
123+
}

‎github/resource_github_workflow_repository_permissions_test.go‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
package github
2+
3+
import (
4+
"fmt"
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
9+
)
10+
11+
func TestAccGithubWorkflowRepositoryPermissions(t *testing.T) {
12+
13+
t.Run("test setting of basic workflow repository permissions", func(t *testing.T) {
14+
15+
defaultWorkflowPermissions := "read"
16+
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
17+
18+
config := fmt.Sprintf(`
19+
resource "github_repository" "test" {
20+
name = "tf-acc-test-topic-%[1]s"
21+
description = "Terraform acceptance tests %[1]s"
22+
topics = ["terraform", "testing"]
23+
}
24+
25+
resource "github_workflow_repository_permissions" "test" {
26+
default_workflow_permissions = "%s"
27+
repository = github_repository.test.name
28+
}
29+
`, randomID, defaultWorkflowPermissions)
30+
31+
check := resource.ComposeTestCheckFunc(
32+
resource.TestCheckResourceAttr(
33+
"github_workflow_repository_permissions.test", "default_workflow_permissions", defaultWorkflowPermissions,
34+
),
35+
)
36+
37+
testCase := func(t *testing.T, mode string) {
38+
resource.Test(t, resource.TestCase{
39+
PreCheck: func() { skipUnlessMode(t, mode) },
40+
Providers: testAccProviders,
41+
Steps: []resource.TestStep{
42+
{
43+
Config: config,
44+
Check: check,
45+
},
46+
},
47+
})
48+
}
49+
50+
t.Run("with an anonymous account", func(t *testing.T) {
51+
t.Skip("anonymous account not supported for this operation")
52+
})
53+
54+
t.Run("with an individual account", func(t *testing.T) {
55+
testCase(t, individual)
56+
})
57+
58+
t.Run("with an organization account", func(t *testing.T) {
59+
testCase(t, organization)
60+
})
61+
62+
})
63+
64+
t.Run("imports entire set of github workflow repository permissions without error", func(t *testing.T) {
65+
66+
defaultWorkflowPermissions := "read"
67+
canApprovePullRequestReviews := "true"
68+
69+
randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
70+
71+
config := fmt.Sprintf(`
72+
resource "github_repository" "test" {
73+
name = "tf-acc-test-topic-%[1]s"
74+
description = "Terraform acceptance tests %[1]s"
75+
topics = ["terraform", "testing"]
76+
}
77+
78+
resource "github_workflow_repository_permissions" "test" {
79+
default_workflow_permissions = "%s"
80+
can_approve_pull_request_reviews = %s
81+
repository = github_repository.test.name
82+
}
83+
`, randomID, defaultWorkflowPermissions, canApprovePullRequestReviews)
84+
85+
check := resource.ComposeTestCheckFunc(
86+
resource.TestCheckResourceAttr(
87+
"github_workflow_repository_permissions.test", "default_workflow_permissions", defaultWorkflowPermissions,
88+
),
89+
resource.TestCheckResourceAttr(
90+
"github_workflow_repository_permissions.test", "can_approve_pull_request_reviews", canApprovePullRequestReviews,
91+
),
92+
)
93+
94+
testCase := func(t *testing.T, mode string) {
95+
resource.Test(t, resource.TestCase{
96+
PreCheck: func() { skipUnlessMode(t, mode) },
97+
Providers: testAccProviders,
98+
Steps: []resource.TestStep{
99+
{
100+
Config: config,
101+
Check: check,
102+
},
103+
{
104+
ResourceName: "github_workflow_repository_permissions.test",
105+
ImportState: true,
106+
ImportStateVerify: true,
107+
},
108+
},
109+
})
110+
}
111+
112+
t.Run("with an anonymous account", func(t *testing.T) {
113+
t.Skip("anonymous account not supported for this operation")
114+
})
115+
116+
t.Run("with an individual account", func(t *testing.T) {
117+
testCase(t, individual)
118+
})
119+
120+
t.Run("with an organization account", func(t *testing.T) {
121+
testCase(t, organization)
122+
})
123+
124+
})
125+
}

‎website/docs/r/workflow_repository_permissions.html.markdown‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: "github"
3+
page_title: "GitHub: github_workflow_repository_permissions"
4+
description: |-
5+
Enables and manages Workflow permissions for a GitHub repository
6+
---
7+
8+
# github_workflow_repository_permissions
9+
10+
This resource allows you to manage GitHub Workflow permissions for a given repository.
11+
You must have admin access to a repository to use this resource.
12+
13+
## Example Usage
14+
15+
```hcl
16+
resource "github_repository" "example" {
17+
name = "my-repository"
18+
}
19+
20+
resource "github_workflow_repository_permissions" "test" {
21+
default_workflow_permissions = "read"
22+
can_approve_pull_request_reviews = true
23+
repository = github_repository.example.name
24+
}
25+
```
26+
27+
## Argument Reference
28+
29+
The following arguments are supported:
30+
31+
* `repository` - (Required) The GitHub repository
32+
* `default_workflow_permissions` - (Optional) The default workflow permissions granted to the GITHUB_TOKEN when running workflows. Can be one of: `read` or `write`.
33+
* `can_approve_pull_request_reviews` - (Optional) Whether GitHub Actions can approve pull requests. Enabling this can be a security risk.
34+
35+
## Import
36+
37+
This resource can be imported using the name of the GitHub repository:
38+
39+
```
40+
$ terraform import github_workflow_repository_permissions.test my-repository
41+
```

0 commit comments

Comments
 (0)