fix: handle `sha_pinning_required=false` by sheeeng · Pull Request #3224 · integrations/terraform-provider-github

sheeeng · 2026-02-25T09:36:51Z

Replace Computed: true with Default: false on the
sha_pinning_required schema field and send it unconditionally
via d.Get() on every API call. The previous d.GetOk() approach
returned ok=false for zero-value booleans, causing
sha_pinning_required=false to be silently ignored.

This ensures both true and false values are correctly applied,
eliminating perpetual drift when disabling SHA pinning enforcement.

Affects github_actions_organization_permissions and
github_actions_repository_permissions resources.

Update tests to use ConfigStateChecks with statecheck package
instead of deprecated Check field, and consolidate duplicate
config templates into single reusable template strings.

Fix #3223.

Resolve #3223.

Before the change?

Setting sha_pinning_required = false applied successfully in Terraform, but not actually changed in GitHub resources itself.

After the change?

Setting sha_pinning_required = false applied successfully in Terraform, and actually changed in GitHub resources itself.

Pull request checklist

Schema migrations have been created if needed (example)
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

Yes
No

github-actions · 2026-02-25T09:37:16Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

github/resource_github_actions_organization_permissions.go

github/resource_github_actions_organization_permissions_test.go

deiga

LGTM! @stevehipwell WDYT?

stevehipwell

@sheeeng I thought the whole point here was that SHA pinning was dependent on organization configuration? This change would not fix the issue, but would break this resource.

I'm not sure how I missed this in review, but I'll repeat my suggestion to look at how allow_forking works in the repository resource. To fix this you should split the create and update functions in the resource to simplify the logic. Then in create you can use d.GetOkExists() to see if it should be sent. In update you need to check d.Changed() and if it has changed you need to use d.Get() and then send that value.

Split `CreateOrUpdate` into separate `Create` and `Update` functions to properly handle the `sha_pinning_required` boolean field's zero-value problem: - Use `d.GetOkExists()` in `Create` to only send the field when the user explicitly sets it in config, even to `false`. - Use `d.HasChange()` in `Update` to detect when the value changes and `d.Get()` to read the new value. Keep schema as `Optional` + `Computed` (not `Default: false`) so the resource inherits the organization-level setting when not explicitly configured. This follows the same pattern used by `allow_forking` in `resource_github_repository.go`. Fixes integrations#3223

deiga

Partial review. Apply comments suggestions to all applicable sections

deiga · 2026-02-28T12:32:31Z

github/resource_github_actions_organization_permissions.go

-		Create: resourceGithubActionsOrganizationPermissionsCreateOrUpdate,
+		Create: resourceGithubActionsOrganizationPermissionsCreate,
 		Read:   resourceGithubActionsOrganizationPermissionsRead,
-		Update: resourceGithubActionsOrganizationPermissionsCreateOrUpdate,
+		Update: resourceGithubActionsOrganizationPermissionsUpdate,
 		Delete: resourceGithubActionsOrganizationPermissionsDelete,


While you're in here, please refactor these to use the Context-aware functions

deiga · 2026-02-28T12:34:14Z

github/resource_github_actions_organization_permissions.go

+	if allowedActions == "selected" {
+		actionsAllowedData := resourceGithubActionsOrganizationAllowedObject(d)
+		if actionsAllowedData != nil {
+			log.Printf("[DEBUG] Update `actionsAllowedData` configuration.")


Please use tflog.Debug instead

deiga · 2026-02-28T12:35:48Z

github/resource_github_actions_organization_permissions.go

+		}
+	}
+
+	d.SetId(orgName)


Update should not be updating resource Id

deiga · 2026-02-28T12:37:16Z

github/resource_github_actions_organization_permissions.go

+	}
+
+	d.SetId(orgName)
+	return resourceGithubActionsOrganizationPermissionsRead(d, meta)


Please set any computed fields in Update, instead of calling Read

Suggested change

return resourceGithubActionsOrganizationPermissionsRead(d, meta)

return nil

deiga · 2026-02-28T12:37:40Z

github/resource_github_actions_repository_permissions.go

-		Create: resourceGithubActionsRepositoryPermissionsCreateOrUpdate,
+		Create: resourceGithubActionsRepositoryPermissionsCreate,
 		Read:   resourceGithubActionsRepositoryPermissionsRead,
-		Update: resourceGithubActionsRepositoryPermissionsCreateOrUpdate,
+		Update: resourceGithubActionsRepositoryPermissionsUpdate,
 		Delete: resourceGithubActionsRepositoryPermissionsDelete,


Please refactor to use the Context-aware functions

github-actions bot added the Type: Bug Something isn't working as documented label Feb 25, 2026

sheeeng force-pushed the fix/sha-pinning-required-false-ignored branch from 0dee61f to 3067dd7 Compare February 25, 2026 09:38

sheeeng changed the title ~~fix: handle sha_pinning_required=false~~ fix: handle sha_pinning_required = false Feb 25, 2026

sheeeng changed the title ~~fix: handle sha_pinning_required = false~~ fix: handle sha_pinning_required=false Feb 25, 2026

deiga suggested changes Feb 26, 2026

View reviewed changes

github/resource_github_actions_organization_permissions.go Outdated Show resolved Hide resolved

github/resource_github_actions_organization_permissions_test.go Outdated Show resolved Hide resolved

github/resource_github_actions_organization_permissions_test.go Outdated Show resolved Hide resolved

sheeeng force-pushed the fix/sha-pinning-required-false-ignored branch from 3067dd7 to fd7ac91 Compare February 26, 2026 16:08

sheeeng requested a review from deiga February 26, 2026 16:10

deiga approved these changes Feb 26, 2026

View reviewed changes

stevehipwell requested changes Feb 27, 2026

View reviewed changes

sheeeng force-pushed the fix/sha-pinning-required-false-ignored branch 14 times, most recently from e5919ce to fef996b Compare February 28, 2026 09:12

sheeeng force-pushed the fix/sha-pinning-required-false-ignored branch from fef996b to 5b44ee6 Compare February 28, 2026 09:14

sheeeng requested review from deiga and stevehipwell February 28, 2026 09:18

deiga suggested changes Feb 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: handle `sha_pinning_required=false`#3224

fix: handle `sha_pinning_required=false`#3224
sheeeng wants to merge 1 commit intointegrations:mainfrom
sheeeng:fix/sha-pinning-required-false-ignored

sheeeng commented Feb 25, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga left a comment

Uh oh!

stevehipwell left a comment

Uh oh!

deiga left a comment

Uh oh!

deiga Feb 28, 2026

Uh oh!

deiga Feb 28, 2026

Uh oh!

deiga Feb 28, 2026

Uh oh!

deiga Feb 28, 2026

Uh oh!

deiga Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	return resourceGithubActionsOrganizationPermissionsRead(d, meta)
	return nil

Conversation

sheeeng commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

deiga Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sheeeng commented Feb 25, 2026 •

edited

Loading