integrations / integrations/terraform-provider-github

misleading diff (false -> true) for merge settings when authenticated with restricted GitHub App token

Open
#3,382 8 comments 0 reactions 0 assignees View on GitHub
Status: Triage
Dominant language
Go
Stars
1.2k
Forks
1k
Avg merge
1d 14h
Merged PRs (30d)
8

Description

## Description

When using the `integrations/github` provider with a GitHub App token that has `Administration: Read` but lacks `Contents: Write` (push access), `terraform plan` shows a perpetual diff for repository merge settings even if they are already correctly configured on GitHub.

### Current Behavior
The GitHub API omits merge settings (like `allow_merge_commit`, `allow_squash_merge`, etc.) from the repository response if the authenticated user lacks push access. The Terraform provider currently interprets these missing fields as `false` (or empty strings), leading to a diff where Terraform attempts to change them from `false -> true` (or similar) on every plan.

### Expected Behavior
If these fields are missing from the API response due to permission restrictions, the provider should throw an error if all required information cannot be fetched from the api, explainind which permissions are needed.

### Impact
Users wanting to perform "Read-only" plans or audits using restricted GitHub App tokens (following the principle of least privilege) are forced to either:
- Grant `Contents: Write` (push access) just to get a clean plan.
- Use `lifecycle { ignore_changes = [...] }`, which prevents Terraform from managing these settings even when using a high-privilege token.

### Terraform Version
- Provider: `integrations/github` v6.2.1 and v6.12.1

### Relevant Permissions
- **Administration**: Read
- **Contents**: Read (Missing Write)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.