diff --git a/examples/secret-drifting/main.tf b/examples/secret-drifting/main.tf new file mode 100644 index 0000000000..b228efccf2 --- /dev/null +++ b/examples/secret-drifting/main.tf @@ -0,0 +1,23 @@ +provider "github" { +} + +terraform { + required_providers { + github = { + source = "integrations/github" + } + } +} + +resource "github_actions_organization_secret" "plaintext_secret" { + secret_name = "test_plaintext_secret" + plaintext_value = "123" + visibility = "private" +} + +resource "github_actions_organization_secret" "encrypted_secret" { + secret_name = "test_encrypted_secret" + plaintext_value = "123" + visibility = "private" + destroy_on_drift = false +} diff --git a/github/resource_github_actions_organization_secret.go b/github/resource_github_actions_organization_secret.go index 4c196f218d..503093fee9 100644 --- a/github/resource_github_actions_organization_secret.go +++ b/github/resource_github_actions_organization_secret.go @@ -78,6 +78,11 @@ func resourceGithubActionsOrganizationSecret() *schema.Resource { Computed: true, Description: "Date of 'actions_secret' update.", }, + "destroy_on_drift": { + Type: schema.TypeBool, + Default: true, + Optional: true, + }, }, } } @@ -214,7 +219,8 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta in // The only solution to enforce consistency between is to mark the resource // as deleted (unset the ID) in order to fix potential drift by recreating // the resource. - if updatedAt, ok := d.GetOk("updated_at"); ok && updatedAt != secret.UpdatedAt.String() { + destroyOnDrift := d.Get("destroy_on_drift").(bool) + if updatedAt, ok := d.GetOk("updated_at"); ok && destroyOnDrift && updatedAt != secret.UpdatedAt.String() { log.Printf("[INFO] The secret %s has been externally updated in GitHub", d.Id()) d.SetId("") } else if !ok { diff --git a/github/resource_github_actions_organization_secret_test.go b/github/resource_github_actions_organization_secret_test.go index fee7aba027..9b20dce0d1 100644 --- a/github/resource_github_actions_organization_secret_test.go +++ b/github/resource_github_actions_organization_secret_test.go @@ -25,6 +25,7 @@ func TestAccGithubActionsOrganizationSecret(t *testing.T) { secret_name = "test_encrypted_secret" encrypted_value = "%s" visibility = "private" + destroy_on_drift = false } `, secretValue, secretValue)