integrations / integrations/terraform-provider-github

[BUG]: github_branch_protection fails with 'Resource not accessible by integration' when app node_id is in dismissal_restrictions

Open
#3,257 7 comments 4 reactions 0 assignees View on GitHub
r/branch_protection Status: Triage Type: Bug
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

### Expected Behavior

When a GitHub App node ID is included in `dismissal_restrictions` of `github_branch_protection`, the provider should be able to read and manage the branch protection rule, including setting app node IDs alongside team node IDs.

### Actual Behavior

The provider fails with `Resource not accessible by integration` during both **plan** and **apply** when:
1. An app node ID is specified in `dismissal_restrictions` in the HCL config, OR
2. An app has been added to `dismissal_restrictions` via the GitHub API externally (state refresh fails)

This makes it impossible to use Terraform to manage branch protection rules that include GitHub Apps in dismissal restrictions.

### Terraform Version

```
Terraform v1.6.0
+ provider registry.terraform.io/integrations/github v6.x
```

### Affected Resource(s)

- `github_branch_protection`

### Terraform Configuration Files

```hcl
data "github_team" "maintainers" {
for_each = {
for team in var.teams : team.team_slug => team
if team.role == "maintain" || team.role == "admin"
}
slug = each.key
}

resource "github_branch_protection" "this" {
for_each = toset(var.protected_branches)
repository_id = github_repository.this.node_id
pattern = each.value

required_pull_request_reviews {
dismiss_stale_reviews = false
require_code_owner_reviews = true
required_approving_review_count = 1
restrict_dismissals = true
dismissal_restrictions = concat(
[for team_data in data.github_team.maintainers : team_data.node_id],
["A_kwPOAAELEM4AECna"] # GitHub App node ID
)
}

enforce_admins = false
}
```

### Steps to Reproduce

1. Create a `github_branch_protection` resource with `restrict_dismissals = true`
2. Include a GitHub App node ID in `dismissal_restrictions` alongside team node IDs
3. Run `terraform plan` or `terraform apply`

**Alternative reproduction:**
1. Have a working `github_branch_protection` with only team node IDs in `dismissal_restrictions`
2. Externally add a GitHub App to `dismissal_restrictions` via the GitHub REST API:
```
PATCH /repos/{owner}/{repo}/branches/{branch}/protection/required_pull_request_reviews
{ "dismissal_restrictions": { "teams": [...], "apps": ["my-app-slug"] } }
```
3. Run `terraform plan` — fails during state refresh

### Error Output

```
Error: Resource not accessible by integration

with github_branch_protection.this["main"],
on repo.tf line 158, in resource "github_branch_protection" "this":
158: resource "github_branch_protection" "this" {
```

### Additional Context

- The GitHub REST API supports apps in `dismissal_restrictions` and works correctly with user PATs
- The GitHub App used by the Terraform provider has `administration:write` permission on the org
- The error occurs even when the app node ID in `dismissal_restrictions` belongs to a different (non-Terraform) app that is installed on the repository
- This appears to be a provider-level limitation where the GraphQL mutation used for branch protection rules doesn't support app actors in `dismissalRestrictionsActorIds`, or the provider doesn't properly translate app node IDs for the mutation

### Workaround

Currently the only workaround is to manage the app entry in `dismissal_restrictions` via the GitHub REST API outside of Terraform, and ensure Terraform never touches repos where an app has been added. This is fragile and creates state drift.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.