Skip to content

Conversation

@stevehipwell
Copy link
Collaborator

Resolves #2489
Resolves #2495


Before the change?

  • The github_repository resource churned on vulnerability_alerts
  • The github_repository resource churned on pages if build type was workflow

After the change?

  • No churning on the github_repository resource

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

"vulnerability_alerts": {
Type: schema.TypeBool,
Optional: true,
Computed: true,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the documentation, "Computed is often used to represent values that are not user configurable or can not be known at time of terraform plan or apply, such as date of creation or a service specific UUID."

I suppose that Computed is appropriate here since it could be enabled by default at the org level.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is also required in combination with optional if an optional value will be persisted even if it's not been explicitly set.

}
}

err := updateVulnerabilityAlerts(d, client, ctx, owner, repoName)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems wrong, the return resourceGithubRepositoryRead(d, meta) line below can end up calling updateVulnerabilityAlerts again. Is this change actually needed?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This part of the TF provider is a bit of a mess, AFAIK 3 months later this is required.


func updateVulnerabilityAlerts(d *schema.ResourceData, client *github.Client, ctx context.Context, owner, repoName string) error {
updateVulnerabilityAlerts := client.Repositories.DisableVulnerabilityAlerts
if vulnerabilityAlerts, ok := d.GetOk("vulnerability_alerts"); ok && vulnerabilityAlerts.(bool) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not new behavior, but this treats the absense of vulnerability_alerts = "true" as an alias for vulnerability_alerts = "false".

That is not true when a global org-level policy enables vulnerability alerts by default. Is this desirable behavior?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Lekensteyn this is a pattern used throughout the provider, the GetOk() function is intended to only respond if the value has been set.

@stevehipwell
Copy link
Collaborator Author

@nickfloyd this would be a useful quality of life improvement.

@nickfloyd nickfloyd moved this from Backlog to In Progress in Terraform Provider Oct 21, 2025
@nickfloyd nickfloyd merged commit 73fb262 into integrations:main Oct 21, 2025
3 checks passed
@github-project-automation github-project-automation bot moved this from In Progress to Done in Terraform Provider Oct 21, 2025
@github-project-automation github-project-automation bot moved this from 👀 In review to ✅ Done in 🧰 Octokit Active Oct 21, 2025
@stevehipwell stevehipwell deleted the fix-repo-churn branch October 22, 2025 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

3 participants