Ensure empty bypass_actors clear them from API first

Resolves #2952

Signed-off-by: Timo Sand <[email protected]>

Author: deiga

github/resource_github_organization_ruleset.go

@@ -697,6 +697,14 @@ func resourceGithubOrganizationRulesetUpdate(ctx context.Context, d *schema.Reso
 
 	var ruleset *github.RepositoryRuleset
 
+	if d.HasChange("bypass_actors") && len(rulesetReq.BypassActors) == 0 {
+		// Clear bypass actors first, then update with new ruleset
+		_, err = client.Organizations.UpdateRepositoryRulesetClearBypassActor(ctx, org, rulesetID)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
 	ruleset, _, err = client.Organizations.UpdateRepositoryRuleset(ctx, org, rulesetID, *rulesetReq)
 	if err != nil {
 		return diag.FromErr(err)

github/resource_github_repository_ruleset.go

@@ -724,7 +724,7 @@ func resourceGithubRepositoryRulesetUpdate(d *schema.ResourceData, meta any) err
 
 	var ruleset *github.RepositoryRuleset
 
-	if d.HasChange("bypass_actors") {
+	if d.HasChange("bypass_actors") && len(rulesetReq.BypassActors) == 0 {
 		// Clear bypass actors first, then update with new ruleset
 		_, err = client.Repositories.UpdateRulesetClearBypassActor(ctx, owner, repoName, rulesetID)
 		if err != nil {