terraform-provider-github: [MAINT]: Public Repositories do not play well with Advanced Security settings

Version 5.13.0 works without any issue.

No it doesn’t.

provider "github" {
  token = "foo"
  owner = "bar"
}

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "5.13.0"
    }
  }
}

resource "github_repository" "repo" {
    name       = "public_security_and_analysis"
    visibility = "public"
    security_and_analysis {
        advanced_security {
            status = "enabled"
        }
        secret_scanning {
            status = "enabled"
        }
        secret_scanning_push_protection {
            status = "disabled"
        }
    }
}

still results in a terraform apply failure of

github_repository.repo: Creating...
╷
│ Error: PATCH https://api.github.com/repos/bar/public_security_and_analysis: 422 Advanced security is always available for public repos []
│ 
│   with github_repository.repo,
│   on main.tf line 18, in resource "github_repository" "repo":
│   18: resource "github_repository" "repo" {
│ 
╵

@miotke This PR fixes this issue, do you mind taking a look and giving feedback? https://github.com/integrations/terraform-provider-github/pull/1431

Version 5.13.0 works without any issue.

For now, pinning to 5.10 is a workaround, but this is a fairly serious bug as it makes github_repository completely unusable in 5.11 and 5.12 and introduced a breaking change.

Just a small correction: unless I’m mistaken, the change was introduced in 5.9.0, so the workaround should be to pin to 5.8.0. Hope this helps someone, and looking forward to the fix! 🙏

Edit: Actually, pinning 5.8.0 means we lose the fix provided in #1368 (released in 5.9.1 in response to GitHub API breaking changes), which means currently no version of the provider is usable by my team. 😓

Hey @nickfloyd - could we rollback https://github.com/integrations/terraform-provider-github/pull/1304 and release a new version? This unintentionally introduced a breaking change. By sending these values in API calls to public repos, GitHub rejects them.

I think we should only add these fields to the API if they are explicitly supplied, or rollback and explore a different engineering option. For now, pinning to 5.10 is a workaround, but this is a fairly serious bug as it makes github_repository completely unusable in 5.11 and 5.12 and introduced a breaking change.

/cc @marzvrover @kfcampbell

@bombelme, yes, we saw the same and “just” had to delete & re-import the state for github_repository resources. 🙃 Hope it helps a little while waiting for #1431 to land.

@jtgrohn do you mind creating a new issue with those details? My guess is that we’re missing a migration function, but I’d like to keep that separate from this issue.

In addition to the public repo issues everyone has been commenting on, there is another issue for private/internal repos with updating the provider version. If a repo was created at/after the security_and_analysis block was introduced (e.g. at 5.9.0+), without the block explicitly set, and then is updated to a newer version (doesn’t seem to matter which), the plan wants to remove the block. e.g.

Terraform will perform the following actions:

  # github_repository.repo will be updated in-place
  ~ resource "github_repository" "repo" {
        id                          = "security_and_analysis_test"
        name                        = "security_and_analysis_test"
      - vulnerability_alerts        = true -> null
        # (28 unchanged attributes hidden)

      - security_and_analysis {
          - advanced_security {
              - status = "enabled" -> null
            }

          - secret_scanning {
              - status = "enabled" -> null
            }

          - secret_scanning_push_protection {
              - status = "enabled" -> null
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

provider "github" {
  token = "foo"
  owner = "bar"
}

terraform {

  required_providers {
    github = {
      source  = "integrations/github"
      version = "5.9.0"
    }
  }

  backend "local" {}
}

resource "github_repository" "repo" {
    name       = "security_and_analysis_test"
    visibility = "internal"
}}

provider "github" {
  token = "foo"
  owner = "bar"
}

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "5.10.0"
    }
  }

  backend "local" {}
}

resource "github_repository" "repo" {
    name       = "security_and_analysis_test"
    visibility = "internal"
}

@miotke The logic of the PR basically changes the request that is sent to the API based on the repos visibility. Advanced Security is enabled on public repos by default so if you send an API request with that field you will get an error, but you can still control the other aspects of advanced security like push protection and secret scanning on public repos.