Skip to content

Commit 2ebf158

Browse files
ihor-hrytskivnickfloyd
ihor-hrytskiv
and
nickfloyd
authored
fix: importing rulesets (#2488)
* fix: importing rulesets * feat: adding tests * Update resource_github_repository_ruleset_test.go * Update resource_github_repository_ruleset_test.go * Update respository_rules_utils.go * Update respository_rules_utils.go * fix: lint * Fix indentation for vulnerability_alerts in test --------- Co-authored-by: Nick Floyd <[email protected]>
1 parent 20c7f40 commit 2ebf158

4 files changed

Lines changed: 118 additions & 5 deletions

‎github/resource_github_organization_ruleset.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -428,6 +428,11 @@ func resourceGithubOrganizationRuleset() *schema.Resource {
428428
Description: "Choose which Actions workflows must pass before branches can be merged into a branch that matches this rule.",
429429
Elem: &schema.Resource{
430430
Schema: map[string]*schema.Schema{
431+
"do_not_enforce_on_create": {
432+
Type: schema.TypeBool,
433+
Optional: true,
434+
Description: "Allow repositories and branches to be created if a check would otherwise prohibit it.",
435+
},
431436
"required_workflow": {
432437
Type: schema.TypeSet,
433438
MinItems: 1,

‎github/resource_github_organization_ruleset_test.go‎

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ func TestGithubOrganizationRulesets(t *testing.T) {
6363
}
6464
6565
required_workflows {
66+
do_not_enforce_on_create = true
6667
required_workflow {
6768
path = "path/to/workflow.yaml"
6869
repository_id = 1234
@@ -91,13 +92,45 @@ func TestGithubOrganizationRulesets(t *testing.T) {
9192

9293
check := resource.ComposeTestCheckFunc(
9394
resource.TestCheckResourceAttr(
94-
"github_organization_ruleset.test", "name",
95+
"github_organization_ruleset.test",
96+
"name",
9597
"test",
9698
),
9799
resource.TestCheckResourceAttr(
98-
"github_organization_ruleset.test", "enforcement",
100+
"github_organization_ruleset.test",
101+
"enforcement",
99102
"active",
100103
),
104+
resource.TestCheckResourceAttr(
105+
"github_organization_ruleset.test",
106+
"rules.0.required_workflows.0.do_not_enforce_on_create",
107+
"true",
108+
),
109+
resource.TestCheckResourceAttr(
110+
"github_organization_ruleset.test",
111+
"rules.0.required_workflows.0.required_workflow.0.path",
112+
"path/to/workflow.yaml",
113+
),
114+
resource.TestCheckResourceAttr(
115+
"github_organization_ruleset.test",
116+
"rules.0.required_workflows.0.required_workflow.0.repository_id",
117+
"1234",
118+
),
119+
resource.TestCheckResourceAttr(
120+
"github_repository_ruleset.test",
121+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.alerts_threshold",
122+
"errors",
123+
),
124+
resource.TestCheckResourceAttr(
125+
"github_repository_ruleset.test",
126+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.security_alerts_threshold",
127+
"high_or_higher",
128+
),
129+
resource.TestCheckResourceAttr(
130+
"github_repository_ruleset.test",
131+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.tool",
132+
"CodeQL",
133+
),
101134
)
102135

103136
testCase := func(t *testing.T, mode string) {

‎github/resource_github_repository_ruleset_test.go‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ func TestGithubRepositoryRulesets(t *testing.T) {
2222
name = "tf-acc-test-%s"
2323
auto_init = true
2424
default_branch = "main"
25+
vulnerability_alerts = true
2526
}
2627
2728
resource "github_repository_environment" "example" {
@@ -84,20 +85,45 @@ func TestGithubRepositoryRulesets(t *testing.T) {
8485
do_not_enforce_on_create = true
8586
}
8687
88+
required_code_scanning {
89+
required_code_scanning_tool {
90+
alerts_threshold = "errors"
91+
security_alerts_threshold = "high_or_higher"
92+
tool = "CodeQL"
93+
}
94+
}
95+
8796
non_fast_forward = true
8897
}
8998
}
9099
`, randomID)
91100

92101
check := resource.ComposeTestCheckFunc(
93102
resource.TestCheckResourceAttr(
94-
"github_repository_ruleset.test", "name",
103+
"github_repository_ruleset.test",
104+
"name",
95105
"test",
96106
),
97107
resource.TestCheckResourceAttr(
98-
"github_repository_ruleset.test", "enforcement",
108+
"github_repository_ruleset.test",
109+
"enforcement",
99110
"active",
100111
),
112+
resource.TestCheckResourceAttr(
113+
"github_repository_ruleset.test",
114+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.alerts_threshold",
115+
"errors",
116+
),
117+
resource.TestCheckResourceAttr(
118+
"github_repository_ruleset.test",
119+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.security_alerts_threshold",
120+
"high_or_higher",
121+
),
122+
resource.TestCheckResourceAttr(
123+
"github_repository_ruleset.test",
124+
"rules.0.required_code_scanning.0.required_code_scanning_tool.0.tool",
125+
"CodeQL",
126+
),
101127
)
102128

103129
testCase := func(t *testing.T, mode string) {
@@ -140,6 +166,7 @@ func TestGithubRepositoryRulesets(t *testing.T) {
140166
resource "github_repository" "test" {
141167
name = "tf-acc-test-%s"
142168
auto_init = false
169+
vulnerability_alerts = true
143170
}
144171
145172
resource "github_repository_environment" "example" {
@@ -211,6 +238,7 @@ func TestGithubRepositoryRulesets(t *testing.T) {
211238
resource "github_repository" "test" {
212239
name = "%[1]s"
213240
description = "Terraform acceptance tests %[2]s"
241+
vulnerability_alerts = true
214242
}
215243
216244
resource "github_repository_ruleset" "test" {
@@ -283,6 +311,7 @@ func TestGithubRepositoryRulesets(t *testing.T) {
283311
description = "Terraform acceptance tests %[1]s"
284312
auto_init = true
285313
default_branch = "main"
314+
vulnerability_alerts = true
286315
}
287316
288317
resource "github_repository_environment" "example" {

‎github/respository_rules_utils.go‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,8 @@ func expandRules(input []interface{}, org bool) []*github.RepositoryRule {
375375
}
376376

377377
params := &github.RequiredWorkflowsRuleParameters{
378-
RequiredWorkflows: requiredWorkflows,
378+
DoNotEnforceOnCreate: requiredWorkflowsMap["do_not_enforce_on_create"].(bool),
379+
RequiredWorkflows: requiredWorkflows,
379380
}
380381
rulesSlice = append(rulesSlice, github.NewRequiredWorkflowsRule(params))
381382
}
@@ -524,6 +525,51 @@ func flattenRules(rules []*github.RepositoryRule, org bool) []interface{} {
524525
rule["do_not_enforce_on_create"] = params.DoNotEnforceOnCreate
525526
rulesMap[v.Type] = []map[string]interface{}{rule}
526527

528+
case "workflows":
529+
var params github.RequiredWorkflowsRuleParameters
530+
531+
err := json.Unmarshal(*v.Parameters, &params)
532+
if err != nil {
533+
log.Printf("[INFO] Unexpected error unmarshalling rule %s with parameters: %v",
534+
v.Type, v.Parameters)
535+
}
536+
537+
requiredWorkflowsSlice := make([]map[string]interface{}, 0)
538+
for _, check := range params.RequiredWorkflows {
539+
requiredWorkflowsSlice = append(requiredWorkflowsSlice, map[string]interface{}{
540+
"repository_id": check.RepositoryID,
541+
"path": check.Path,
542+
"ref": check.Ref,
543+
})
544+
}
545+
546+
rule := make(map[string]interface{})
547+
rule["do_not_enforce_on_create"] = params.DoNotEnforceOnCreate
548+
rule["required_workflow"] = requiredWorkflowsSlice
549+
rulesMap["required_workflows"] = []map[string]interface{}{rule}
550+
551+
case "code_scanning":
552+
var params github.RequiredCodeScanningRuleParameters
553+
554+
err := json.Unmarshal(*v.Parameters, &params)
555+
if err != nil {
556+
log.Printf("[INFO] Unexpected error unmarshalling rule %s with parameters: %v",
557+
v.Type, v.Parameters)
558+
}
559+
560+
requiredCodeScanningSlice := make([]map[string]interface{}, 0)
561+
for _, check := range params.RequiredCodeScanningTools {
562+
requiredCodeScanningSlice = append(requiredCodeScanningSlice, map[string]interface{}{
563+
"alerts_threshold": check.AlertsThreshold,
564+
"security_alerts_threshold": check.SecurityAlertsThreshold,
565+
"tool": check.Tool,
566+
})
567+
}
568+
569+
rule := make(map[string]interface{})
570+
rule["required_code_scanning_tool"] = requiredCodeScanningSlice
571+
rulesMap["required_code_scanning"] = []map[string]interface{}{rule}
572+
527573
case "merge_queue":
528574
var params github.MergeQueueRuleParameters
529575

0 commit comments

Comments
 (0)