integrations / integrations/terraform-provider-github

[FEAT]: Allow for Cross-Organization Use of Private Template Repositories when creating repositories using GitHub Apps framework

Open
#2,576 1 comment 0 reactions 0 assignees View on GitHub
Status: Triage Type: Feature
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Describe the need

Hello,

When creating a repository using terraform `resource "github_repository" "this" {}`, there is a param available `template { owner = "github"; repository = "terraform-template-module"; include_all_branches = true }` which allows the repo to pull the template and apply it as the repository initial commit.

However, when using the GitHub Apps framework in the provider authentication, the provider creates an Installation Access Token (IAT) which can only ever get resources from a single organization. If the Template is not in the same organization as the target organization for the new repository, the apply fails with a 404 error.

Potential solutions:
- **Recommended:** Split the `template` parameter to its own resource and allow the `github_repository` resource to consume that resource as an input. This would allow a user to provide a different provider alias to the template repository resource if necessary.
- _Not Recommended:_ Allow a single provider to mint multiple IATs for multiple organizations and choose which IAT to leverage based on the resource names. Would require that users specify the `owner` on every resource, which may require refactoring additional `resource`s.
- _Enterprise Only:_ Change the GitHub APIs to allow IATs to consume _Internal_ template repositories from any organization within the Enterprise. Seems like a potentially reasonable change, but outside the scope of the Terraform provider.

For now, my workaround is to fork the template repositories into the organizations that need them, which is less than ideal but still allows for some level of tracking.

Additionally, if the resource could fail earlier by actually attempting to read the template repository during the plan, it would help developers. This could be treated as a minor bugfix item, and might be better to split it out of the feature request.

### SDK Version

_No response_

### API Version

_No response_

### Relevant log output

```shell
Error: POST https://api.github.com/repos/my-organization/terraform-template-repository/generate: 404 Not Found []

with module.this.module.this["instance"].github_repository.repository
on .terraform/modules/this.this/main.tf line 99, in resource "github_repository" "repository":
`resource "github_repository" "repository" {`
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.