integrations / integrations/terraform-provider-github

[FEAT]: Support write-only (ephemeral) values for GitHub environment secrets in Terraform

Open
#3,202 5 comments 12 reactions 0 assignees View on GitHub
Needs Discussion r/actions_secret r/repository_environment Status: Blocked Status: Triage Type: Feature
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Describe the need

### Summary
We need to create GitHub environment secrets via Terraform without persisting sensitive values in state.

### Problem
Terraform now supports ephemeral values, which allows generating secrets without statefile persistence. However, the GitHub provider does not support write-only (_wo) arguments for secrets, so any secret value passed to github_actions_environment_secret is stored in the Terraform state.

### Why this matters
This prevents using Terraform to manage GitHub environment secrets in a secure, state-free way, even when the secret is generated ephemerally.

### Expected behavior
Allow write-only (or equivalent) secret inputs for GitHub environment secrets so sensitive values are never written to state.

### SDK Version

_No response_

### API Version

_No response_

### Relevant log output

```shell

```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.