Skip to content

(fix): add the handlers for empty values - #2404

Draft
mauromedda wants to merge 5 commits into
integrations:mainfrom
omnifra:users/mauromedda/fix_github_actions_permissions
Draft

(fix): add the handlers for empty values#2404
mauromedda wants to merge 5 commits into
integrations:mainfrom
omnifra:users/mauromedda/fix_github_actions_permissions

Conversation

@mauromedda

@mauromedda mauromedda commented Sep 27, 2024

Copy link
Copy Markdown

This commit add the control of the allowed_repositories and the allowed_actions for the actions_permission resources. Without them the API calls will fail because the allowed_actions and the allowed_repository are passed to the API with a null value.

The patch removes them from the HTTP request.

Resolves #2405


Before the change?

After the change?

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

This commit add the control of the allowed_repositories
and the allowed_actions for the actions_permission resources.
Without them the API calls will fail because the allowed_actions and
the allowed_repository are passed to the API with a null value.

The patch removes them from the HTTP request.
@kfcampbell

Copy link
Copy Markdown
Contributor

Is there an issue that this resolves? Can you add test cases to validate this behavior for the future?

@mauromedda

Copy link
Copy Markdown
Author

@kfcampbell I created the issue for it, happy to add further details if required. #2405
I'm going to add the tests for the change.

@github-actions

Copy link
Copy Markdown

👋 Hey Friends, this pull request has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!

@github-actions github-actions Bot added the Status: Stale Used by stalebot to clean house label Aug 23, 2025
@benjaminlukeclark

Copy link
Copy Markdown

Adding a comment here to flag this and hopefully get it re-opened.

At the moment, this not being supported means the provider docs are just plain wrong. i.e. https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_organization_permissions states that I should be a able to provide none as a value for enabled_repositories to disable GitHub Actions but as per #2405 this is not the case; instead the request to the Github RESTAPI times out.

When organisations manage the entirety of their SCM in Terraform, having the ability to disable GitHub Actions in favour of another CI/CD Platform they already utilise is a valuable and necessary thing. The alternative is tool creep.

Especially if Terraform is being used to spin up multiple organisations within an Enterprise, and you want the ability to toggle if GitHub Actions is allowed on a per-organisation basis.

Please may I request either:

  • This is re-opened to look at @mauromedda 's suggested fix (big thanks for raising the PR!)
  • The docs are updated to remove none as an option, as at the moment it's misleading

@github-actions github-actions Bot removed the Status: Stale Used by stalebot to clean house label Aug 30, 2025
@deiga

deiga commented Jan 17, 2026

Copy link
Copy Markdown
Collaborator

Hey @mauromedda
Would you be available to rebase your PR?

Comment on lines +150 to +168
if allowedActions != "" {
_, _, err = client.Actions.EditActionsPermissions(ctx,
orgName,
github.ActionsPermissions{
AllowedActions: &allowedActions,
EnabledRepositories: &enabledRepositories,
})
if err != nil {
return err
}
} else {
_, _, err = client.Actions.EditActionsPermissions(ctx,
orgName,
github.ActionsPermissions{
EnabledRepositories: &enabledRepositories,
})
if err != nil {
return err
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can reduce duplication here by setting AllowedActions conditionally

Suggested change
if allowedActions != "" {
_, _, err = client.Actions.EditActionsPermissions(ctx,
orgName,
github.ActionsPermissions{
AllowedActions: &allowedActions,
EnabledRepositories: &enabledRepositories,
})
if err != nil {
return err
}
} else {
_, _, err = client.Actions.EditActionsPermissions(ctx,
orgName,
github.ActionsPermissions{
EnabledRepositories: &enabledRepositories,
})
if err != nil {
return err
}
actionsPermissions := github.ActionsPermissions{
EnabledRepositories: github.Ptr(enabledRepositories),
}
allowedActions, ok := d.GetOk("allowed_actions")
if ok {
actionsPermissions.AllowedActions = github.Ptr(allowedActions.(string))
}
_, _, err = client.Actions.EditActionsPermissions(ctx,
orgName,
actionsPermissions)
if err != nil {
return err
}

t.Run("with an organization account", func(t *testing.T) {
testCase(t, organization)
})
})

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
})
resource.Test(t, resource.TestCase{
PreCheck: func() { skipUnlessOrgs(t) },
ProviderFactories: providerFactories,
Steps: []resource.TestStep{
{
Config: config,
Check: check,
},
},
})

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Disabling the GH actions at organization or enterprise level is not supported

4 participants