Skip to content

Conversation

@nickfloyd
Copy link
Member

@nickfloyd nickfloyd commented Nov 13, 2025

Resolves: #2809, #2602
Relates to: #2898

This change set is large. This was an intentional decision to drive forward our need to update go-github given the current provider was 10 or more versions behind the latest. The hope is that the release will encapsulate all of the breaking changes over the last 12 months. This helps to make us just deal with them once if we choose to move forward on the major version bump. The last two releases were packed with much needed changes - so users, if they choose, can migrate as time allows while using the updates from v6.7.x and v6.8.x.

Additionally, we'll most likely cherry-pick out feature sets from this branch that are not actual fixes and the like - i.e. projects APIs have stopped working so we can look at projects v2 as a new feature.


Before the change?

  • go-github v67

After the change?

  • go-github v77

Checklist

  • Update go-github to >= v77
    • Vendor / Mod
  • [x] Convert/Replace projects to projects v2 (feat: Projects v2 project items & go-github v79 #2898)
  • API renames edit > update
    • resource_github_actions_organization_permissions.go
    • resource_github_actions_repository_permissions.go
    • resource_github_enterprise_actions_permissions.go
    • resource_github_enterprise_actions_workflow_permissions.go
  • Fix CreateReference
  • Default Ruleset changes
    • resource_github_organization_ruleset.go
    • resource_github_repository_ruleset.go
    • respository_rules_utils.go
  • Ensure test coverage and documentation (for new and deprecated)
  • Ensure schema migrations if needed
    • RuleSet migrations

Pull request checklist

  • Schema migrations have been created if needed (example)
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@nickfloyd nickfloyd self-assigned this Nov 13, 2025
@nickfloyd nickfloyd added the Type: Breaking change Used to note any change that requires a major version bump label Nov 13, 2025
@nickfloyd nickfloyd added the Type: Maintenance Any dependency, housekeeping, and clean up Issue or PR label Nov 13, 2025
@nickfloyd nickfloyd moved this from Backlog to In Progress in Terraform Provider Nov 13, 2025
@nickfloyd nickfloyd changed the title Updates go-github dep to v68 Updates go-github dep to v77 Nov 13, 2025
austenstone added a commit to austenstone/terraform-provider-github that referenced this pull request Nov 14, 2025
- Implements CRUD operations for GitHub organization network configurations
- Supports configuration of network settings for hosted compute (Actions)
- Validates name format (alphanumeric, '.', '-', '_') and length (1-100 chars)
- Enforces compute_service enum ('none', 'actions')
- Requires exactly one network_settings_id
- Includes comprehensive test suite with create, update, and import tests
- Depends on go-github v77 (merged from PR integrations#2891)

Resolves network configuration management for GitHub Actions hosted runners
and other hosted compute services at the organization level.
@nickfloyd nickfloyd mentioned this pull request Nov 14, 2025
5 tasks
@stevehipwell
Copy link
Collaborator

@nickfloyd I've noticed that you've swapped out team ids for slugs to deal with the deprecated methods but that will break the provider for anyone using it at any serious scale. The fix here is to deprecate the team_id field and introduce a parallel team_slug field; the cost of using a single field for both is significant and I previously optimised it for ID as that's what the provider was using in the REST API.

See #2497.

Copy link
Contributor

@deiga deiga left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initial pass, looking good.

}

client := meta.(*Owner).v3client
orgId := meta.(*Owner).id
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: removing this looks inconsistent with the existing convention

for _, t := range want {
teamData := t.(map[string]any)
teamIDString := teamData["team_id"].(string)
teamSlug, err := getTeamSlug(teamIDString, meta)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nickfloyd I think this change might need cleanup?

}

ctx := context.WithValue(context.Background(), ctxId, d.Id())
ctx := context.WithValue(context.Background(), ctxId, rulesetID)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we putting the ID in the context?

repositorySchema := resource.Schema["repository"]
if repositorySchema == nil {
t.Fatal("repository field should exist in schema")
return
Copy link
Collaborator

@diofeher diofeher Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you add these returns? t.Fatal is supposed to stop the execution of the test, so adding it is redundant.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is because of staticcheck linter - specifically the SA5011 rule about nil pointer dereferences.

Technically the code is unreachable and I didn't want to put another ignore in there.

Copy link
Collaborator

@diofeher diofeher Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's strange. Is this raised by make lint?

I removed those lines here and ran the linter; it didn't find any issues.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From what I'm reading here: https://staticcheck.dev/docs/checks#SA5011, it seems staticcheck can catch this kind of error without introducing return. I'm just curious in which lint you're using to see this error to see if I could reproduce here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting... I am definitely running make lint - I'll need to see if I can track down what the variation might be.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was picking them up when I updated the linter, I think it's a golangci-lint issue and not directly a static check issue. Also it looks like these ones didn't require the return in my PR which seems slightly odd. There is a new linter version literally just released, so it might be worth giving it a try with that?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was picking them up when I updated the linter, I think it's a golangci-lint issue and not directly a static check issue. Also it looks like these ones didn't require the return in my PR which seems slightly odd. There is a new linter version literally just released, so it might be worth giving it a try with that?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was picking them up when I updated the linter, I think it's a golangci-lint issue and not directly a static check issue. Also it looks like these ones didn't require the return in my PR which seems slightly odd. There is a new linter version literally just released, so it might be worth giving it a try with that?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stevehipwell Thanks for the suggestion!

Just tried with 2.7.0 (the latest release) and was still able to run the lint without errors after removing the returns.

sourceBranchSchema := resource.Schema["source_branch"]
if sourceBranchSchema == nil {
t.Fatal("source_branch field should exist in schema")
return
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return

sourceSHASchema := resource.Schema["source_sha"]
if sourceSHASchema == nil {
t.Fatal("source_sha field should exist in schema")
return
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above

branchSchema := resource.Schema["branch"]
if branchSchema == nil {
t.Fatal("branch field should exist in schema")
return
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above

t.Fatalf("Expected 4 expanded rules for organization push ruleset, got %d", len(expandedRules))
if expandedRules == nil {
t.Fatal("Expected expanded rules to not be nil")
return
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above

Comment on lines 716 to 718
ruleset, _, err = client.Repositories.UpdateRuleset(ctx, owner, repoName, rulesetID, *rulesetReq)
} else {
ruleset, _, err = client.Repositories.UpdateRuleset(ctx, owner, repoName, rulesetID, rulesetReq)
ruleset, _, err = client.Repositories.UpdateRuleset(ctx, owner, repoName, rulesetID, *rulesetReq)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we consolidate that in a single line?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice and tidy! Great catch!

//nolint:staticcheck // SA1019: EditTeamByID is deprecated but still needed for legacy compatibility
_, _, err := client.Teams.EditTeamByID(ctx,
*githubTeam.Organization.ID,
meta.(*Owner).id,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just double-checking if this is right. Would it be possible to change teams in another organization?

Comment on lines +20 to +21
default:
return 0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a huge fan of returning 0 when passing other types to this function, as it can turn later debugging errors into a nightmare.

Comment on lines +34 to +36
default:
return 0
}
Copy link
Collaborator

@diofeher diofeher Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a huge fan of returning 0 when passing other types to this function, as it can turn later debugging errors into a nightmare. I usually prefer an explicit error or a panic

Copy link
Collaborator

@diofeher diofeher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good, thanks @nickfloyd. I have a few minor suggestions, though!

// See: https://github.com/google/go-github/blob/b6248e6f6aec019e75ba2c8e189bfe89f36b7d01/github/repos_rules.go#L196
var ruleset *github.RepositoryRuleset

if d.HasChange("bypass_actors") {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if d.HasChange("bypass_actors") {
if d.HasChange("bypass_actors") && len(rulesetReq.BypassActors) == 0 {

The clear bypass actors should only need running if there are none left. This pattern likely needs copying to the other ruleset implementations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Type: Breaking change Used to note any change that requires a major version bump Type: Maintenance Any dependency, housekeeping, and clean up Issue or PR

Projects

Status: In Review

Development

Successfully merging this pull request may close these issues.

[MAINT]: Update to go-github v77 w/o projects

5 participants