integrations / integrations/terraform-provider-github
[BUG]: github_app_installation_repository allows per-repo add for all-repo app installs, leading to undeletable state
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 8
Description
### Expected Behavior
When using the github_app_installation_repository resource, if the GitHub App installation is configured with repository_selection = "all" (the "All repositories" setting in the GitHub UI), Terraform should prevent creating a per-repository installation resource and return a clear error. It should not allow applying a repo-level install when the installation already has global access, and should not create state that will later be undeletable.
### Actual Behavior
Currently, creation of the resource is allowed even when the installation is set to "all" repositories. This results in state being created, and the repo appears to be "added". However, when attempting to destroy the resource, the API returns a 422 error: This installation is on all repositories, please update in the Web UI, and destroy fails. This leads to a situation where state is orphaned and manual intervention is required to remove it.
### Terraform Version
Terraform v1.6+ (also seen on v1.9.2)
Provider registry.terraform.io/integrations/github v6.x
### Affected Resource(s)
- github_app_installation_repository
### Terraform Configuration Files
```hcl
resource "github_app_installation_repository" "all_repo_app_installations" {
installation_id = "12345678"
repository = "repo1"
}
```
### Steps to Reproduce
1. Install a GitHub App in your org with access to "All repositories".
2. Apply a resource like above to "add" a repo.
3. Observe that apply succeeds and state is created.
4. Remove the resource from config and apply. Observe destroy fails with 422 error.
### Debug Output
```shell
Error: DELETE https://api.github.com/user/installations/12345678/repositories/1011111111: 422 This installation is on all repositories, please update in the Web UI. []
```
### Panic Output
```shell
N/A
```
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Assessment
This issue has not been assessed yet.