integrations / integrations/terraform-provider-github

[FEAT]: Add a provider function to handle encrypting secrets

Open
#2,411 3 comments 13 reactions 0 assignees View on GitHub
Status: Blocked Type: Feature
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Describe the need

Aside from the lack of documentation (#888), there is a lack of practical usage considering Vault, AWS SSM, Azure Key Vault, 1Password, etc.

Requirements:
* When pulling a secret from a data source, one should be able to encrypt that data to meet the GitHub API's requirements without running local commands, writing their own customer provider, or any other mechanism.

Recommendation:

As of Terraform 1.8 it is possible for a provider to distribute a custom [function](https://developer.hashicorp.com/terraform/tutorials/providers-plugin-framework/providers-plugin-framework-functions) that can be leveraged in HCL. This provider should implement that.

How the usage might look (based on example in #888 )
```
terraform {
required_providers {
github = {
source = "integrations/github"
version = ">= 6.3.0"
}
vault = {
source = "hashicorp/vault"
version = "4.4.0"
}
}
}

provider "github" {
owner = var.repo_owner
token = var.github_token
}

data "github_actions_public_key" "main" {
repository = var.repo_name
}

data "vault_kv_secret_v2" "main" {
mount = "secret"
name = "secret/github/repo"
}

resource "github_actions_secret" "main" {
repository = var.repo_name
secret_name = "SECRET_KEY"
encrypted_value = provider::github::encrypt(
data.github_actions_public_key.main.key,
lookup(data.vault_kv_secret_v2.main[0].data, "mysecret", "")
)
}
```

### SDK Version

_No response_

### API Version

_No response_

### Relevant log output

_No response_

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.