repository·main·Indexed 22 days ago
https://github.com/integrations/terraform-provider-githubThe Terraform Provider GitHub allows developers to manage GitHub infrastructure as code, including repositories, teams, organization settings, and Actions configurations. It is compatible with both GitHub.com and GitHub Enterprise Server. Key capabilities include authenticating via GitHub Apps, managing repository access and collaborators, configuring GitHub Enterprise settings, and controlling GitHub Actions permissions and workflow settings.
The GitHub provider allows you to manage a wide range of GitHub resources using Terraform. It supports both GitHub.com and GitHub Enterprise Server by interacting with their REST and GraphQL APIs.
Managed resources include:
The github_actions_secret resource allows you to manage secrets for a specific GitHub repository. You must have write access to the repository to use this resource.
value and value_encrypted fields are marked as sensitive in Terraform, which hides them from CLI output. However, they are still stored in plaintext in your Terraform state file. Always treat your state file as sensitive./crypto/box module (interoperable with libsodium).value_encrypted populated from a data source, variable, or another resource, rather than using the value field directly.# Un-encrypted Secret Example
resource "github_actions_secret" "example" {
repository = "example-repo"
secret_name = "EXAMPLE_SECRET_NAME"
value = "example-value"
}The github_dependabot_secret resource allows you to manage secrets used by Dependabot within a specific GitHub repository.
Security Considerations:
/crypto/box module (interoperable with libsodium).value field is marked as sensitive in Terraform, it is not hidden from state files. Always treat your Terraform state as sensitive.value_encrypted populated from a variable or data source to keep sensitive data out of your configuration files.Handling Drift:
If you create a secret with a placeholder value and then modify it outside of Terraform, you can use a lifecycle ignore_changes block on updated_at to prevent Terraform from attempting to revert the secret.
resource "github_dependabot_secret" "example" {
repository = "example-repo"
secret_name = "EXAMPLE_SECRET_NAME"
value = "example-value"
}Use the github_actions_organization_secret resource to manage secrets available to GitHub Actions across an entire organization.
Security Note: While the value field is marked as sensitive in Terraform, it is not hidden from state files. Always treat your Terraform state as sensitive. To avoid storing plaintext in your code, it is recommended to use value_encrypted populated from a variable or data source.
Access Control: You can control which repositories can access the secret using the visibility argument. Valid values are:
all: All repositories in the organization.private: Only private repositories.selected: Only specific repositories (requires managing github_actions_organization_secret_repositories).resource "github_actions_organization_secret" "example" {
secret_name = "EXAMPLE_SECRET_NAME"
value = "example-value"
visibility = "all"
}Use the github_actions_organization_workflow_permissions resource to control the default permissions granted to the GITHUB_TOKEN during workflow execution and to enable or disable GitHub Actions' ability to approve pull request reviews for a GitHub Organization.
Requirements:
resource "github_actions_organization_workflow_permissions" "example" {
organization_slug = "my-organization"
default_workflow_permissions = "read"
can_approve_pull_request_reviews = false
}The github_team_settings resource manages team settings within a GitHub organization, specifically focusing on request review delegation settings.
Important Requirements:
resource "github_team_settings" "code_review_settings" {
team_id = github_team.some_team.id
review_request_delegation {
algorithm = "ROUND_ROBIN"
member_count = 1
notify = true
}
}The github_repository_file resource allows you to create and manage files within a specific GitHub repository.
Important Note on Archived Repositories: When a repository is archived, it becomes read-only. To avoid API errors, Terraform will skip the deletion of repository files during a destroy operation. Instead, the files will be removed from the Terraform state without attempting to delete them from GitHub.
resource "github_repository_file" "foo" {
repository = "example"
branch = "main"
file = ".gitignore"
content = "**/*.tfstate"
commit_message = "Managed by Terraform"
commit_author = "Terraform User"
commit_email = "terraform@example.com"
overwrite_on_create = true
}The provider is organized into a specific directory structure that separates core logic, resource implementations, and utilities. Understanding this layout helps in locating specific logic or identifying where new components should be added.
github/provider.go: The entry point where all resources and data sources are registered.github/config.go: Handles authentication, HTTP client setup, rate limiting, and transport.github/resource_github_*.go: Contains the implementation for GitHub resources.github/data_source_github_*.go: Contains the implementation for GitHub data sources.github/resource_*_migration.go: Contains state migration functions (StateUpgraders).github/util.go & github/util_*.go: Core and domain-specific utilities (e.g., validation, label rules).github/transport.go: Manages HTTP transports including ETag caching, rate limiting, and retries.The github_team_membership resource allows you to add or remove specific users from teams within a GitHub organization.
github_team_members. You must choose one approach for managing team memberships.member of a team; they can only be set as maintainer. Attempting to set an owner as a member may cause a terraform plan diff that repeatedly tries to revert them to maintainer status.resource "github_team_membership" "some_team_membership" {
team_id = github_team.some_team.id
username = "SomeUser"
role = "member"
}The visibility argument determines which repositories can access the organization secret.
all: All repositories in the organization can access the secret.private: Only private repositories in the organization can access the secret.selected: Only specific repositories can access the secret. When using selected, you must provide the selected_repository_ids argument containing an array of repository IDs.resource "github_codespaces_organization_secret" "example_secret" {
secret_name = "example_secret_name"
visibility = "selected"
encrypted_value = var.some_encrypted_secret_string
selected_repository_ids = [data.github_repository.repo.repo_id]
}The visibility argument determines which repositories in the organization can access the secret. Valid values are:
all: All repositories in the organization.private: Only private repositories in the organization.selected: Only specific repositories. If you use selected, you must manage repository access using the github_dependabot_organization_secret_repositories resource.resource "github_dependabot_organization_secret" "example" {
secret_name = "EXAMPLE_SECRET_NAME"
value = "example-value"
visibility = "selected"
}
data "github_repository" "example" {
name = "example-repo"
}
resource "github_dependabot_organization_secret_repositories" "example" {
secret_name = github_dependabot_organization_secret.example.secret_name
selected_repository_ids = [data.github_repository.example.repo_id]
}