integrations / integrations/terraform-provider-github
[BUG]: github_app_installation_repository fails with 403 using GitHub App auth after upgrading from v6.12.1 to v6.13.0
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 8
Description
### Expected Behavior
Terraform plan should succeed with provider v6.13.0, as it did with v6.12.1, when using GitHub App authentication to manage a github_app_installation_repository resource.
The resource should either:
1. continue to work with the same GitHub App authentication setup that worked in v6.12.1, or
2. return a clearer provider-side error if this authentication mode is no longer supported for this resource.
### Actual Behavior
After upgrading the integrations/github provider from v6.12.1 to v6.13.0, terraform plan fails during refresh/read of github_app_installation_repository with:
Error: GET https://api.github.com/user/installations/{redacted}/repositories?per_page=100: 403 Resource not accessible by integration []
The same configuration succeeds after downgrading the provider back to v6.12.1.
The provider is authenticated using an enterprise GitHub App with broad permissions. This Terraform GitHub App is used to manage GitHub Enterprise/org resources, including adjusting repository access for another GitHub App installation.
### Terraform Version
Terraform v1.15.8
on linux_amd64
provider registry.terraform.io/integrations/github:
- works: v6.12.1
- fails: v6.13.0
### GitHub Installation Type
- [ ] GitHub.com (Free, Pro, or Team)
- [ ] GitHub Enterprise Server (on-premises)
- [ ] GitHub Enterprise Cloud with Personal Accounts (github.com)
- [x] GitHub Enterprise Cloud with Managed Users/EMU (github.com)
- [ ] GitHub Enterprise Cloud with Data Residency (*.ghe.com)
- [ ] I don't know
### Affected Resource(s)
- github_app_installation_repository
### Terraform Configuration Files
```hcl
terraform {
required_version = "~> 1.14"
required_providers {
github = {
source = "integrations/github"
version = "~> 6.0" # later was changed to "6.12.1"
}
}
backend "azurerm" {
...redacted...
}
}
variable "org_name" {
type = string
default = "redacted"
}
provider "github" {
owner = var.org_name
app_auth {
installation_id = "redacted"
}
}
```
### Steps to Reproduce
```
1. Configure the GitHub provider using GitHub App authentication.
provider "github" {
owner = var.github_owner
app_auth {
id = var.github_app_id
installation_id = var.github_app_installation_id
pem_file = var.github_app_private_key
}
}
2. Define a github_app_installation_repository resource that manages repository access for another GitHub App installation.
resource "github_app_installation_repository" "gh_app_repo" {
installation_id = var.target_github_app_installation_id
repository = var.repository_name
}
3. Pin provider version to v6.12.1.
terraform {
required_providers {
github = {
source = "integrations/github"
version = "= 6.12.1"
}
}
}
4. Run:
terraform init -upgrade
terraform plan
Result: plan succeeds.
5. Change only the provider version to v6.13.0.
terraform {
required_providers {
github = {
source = "integrations/github"
version = "= 6.13.0"
}
}
}
6. Run:
terraform init -upgrade
terraform plan
Result: plan fails with:
Error: GET https://api.github.com/user/installations/{redacted}/repositories?per_page=100: 403 Resource not accessible by integration []
```
### Debug Output
```shell
```
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Research direction
Start by comparing the github_app_installation_repository refresh/read path and GitHub App authentication behavior between provider v6.12.1 and v6.13.0. Reproduce the failure with the supplied Terraform configuration and terraform plan; done means the resource works with the existing authentication setup or returns a clear provider-side unsupported-authentication error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, terraform
- Domain
- authorization, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100