integrations / integrations/terraform-provider-github
misleading diff (false -> true) for merge settings when authenticated with restricted GitHub App token
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 8
Description
## Description
When using the `integrations/github` provider with a GitHub App token that has `Administration: Read` but lacks `Contents: Write` (push access), `terraform plan` shows a perpetual diff for repository merge settings even if they are already correctly configured on GitHub.
### Current Behavior
The GitHub API omits merge settings (like `allow_merge_commit`, `allow_squash_merge`, etc.) from the repository response if the authenticated user lacks push access. The Terraform provider currently interprets these missing fields as `false` (or empty strings), leading to a diff where Terraform attempts to change them from `false -> true` (or similar) on every plan.
### Expected Behavior
If these fields are missing from the API response due to permission restrictions, the provider should throw an error if all required information cannot be fetched from the api, explainind which permissions are needed.
### Impact
Users wanting to perform "Read-only" plans or audits using restricted GitHub App tokens (following the principle of least privilege) are forced to either:
- Grant `Contents: Write` (push access) just to get a clean plan.
- Use `lifecycle { ignore_changes = [...] }`, which prevents Terraform from managing these settings even when using a high-privilege token.
### Terraform Version
- Provider: `integrations/github` v6.2.1 and v6.12.1
### Relevant Permissions
- **Administration**: Read
- **Contents**: Read (Missing Write)
Contributor guide
Assessment
This issue has not been assessed yet.