[BUG]: github_repository_webhook wrongfully identifies org repos as user repos after 6.9.0

[8fuhst]

Expected Behavior

The terraform provider creates a webhook for the passed repository.

Expected URL should be something like: https://api.github.com/repos/ORGANIZATION/REPO/hooks

Actual Behavior

The url is constructed incorrectly, with the current user being injected into it, instead of only the organization.

Actual URL is something like: https://api.github.com/repos/LOCAL-USER/ORGANIZATION/REPO/hooks, which 404's as LOCAL-USER does not own the actual repository.

Terraform Version

OpenTofu v1.10.7
Github Provider Version (integrations/github) v6.9.0, rolling back to v6.8.3 fixes the issue for now

Affected Resource(s)

• github_repository_webhook

Terraform Configuration Files

terraform {
  required_providers {
    github = {
      source = "integrations/github"
    }
  }
}

provider "github" {
  token = ***
  owner = "OWNER"
}

resource "github_repository_webhook" "webhook" {

  repository = "ORGANIZATION/REPO"

  configuration {
    url          = URL
    secret       = ***
    content_type = "json"

  active = true
  events = var.events
  }

Steps to Reproduce

1. Create organizational repository
2. Create token for user with org access
3. Authenticate using e.g. GH CLI
4. Create a github_repository_webhook resource for the org repo
5. terraform apply

Debug Output

* Failed to execute "tofu apply" in ./.terragrunt-cache/5xbDhd0o58dlc-OW65wpCtUfrxc/TYx-cNMOLlc0h6FEuz8-jExTYNQ
  ╷
  │ Error: POST https://api.github.com/repos/USER/ORGANIZATION/WEBHOOK_NAME/hooks: 404 Not Found []
  │ 
  │   with MODULE.github_repository_webhook.WEBHOOK_NAME[0],
  │   on .terraform/modules/MODULE/main.tf line 127, in resource "github_repository_webhook" "WEBHOOK_NAME":
  │  127: resource "github_repository_webhook" "WEBHOOK_NAME" {
  │ 
  ╵
  
  exit status 1

Panic Output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[deiga]

Hi @8fuhst 👋

Thanks for raising this issue!

I see that the error is coming from a module resource. Are you explicitly configuring the provider inside the module?
Something like:

terraform {
  required_version = ">= 1.13.1"
  required_providers {
    github = {
      source  = "integrations/github"
      version = ">= 6.6.0"
    }
  }
}

If not, that could be the source of the problem, as terraform defaults to using the deprecated hashicorp/github provider

[8fuhst]

Hey @deiga :) Our problem is indeed coming from inside a module resource, but we are configuring the provider to explicitly be the integrations/github provider inside, so that should not be the issue.

[deiga]

Darn it, that would've been too easy 😂

Okay, looking at the source I see this https://github.com/integrations/terraform-provider-github/blob/main/github/resource_github_repository_webhook.go#L104-L109

Meaning that it fetches owner from the provider configuration and it expects repository to be just the name of the repo without the owner.

Have you configured the owner variable in the provider or set GITHUB_OWNER?

[stevehipwell]

It looks like you're using the wrong pattern for repository (repository = "ORGANIZATION/REPO"), which should just be the repository name without the owner prefix. This isn't currently documented outside of the code and I can't see why the code can't remove owner prefixes to make it work (this pattern isn't consistent across the whole provider).

[stevehipwell]

@8fuhst to further clarify how this provider works; the provider currently only supports a single owner (so either a user or an organization, not both). It looks like you've configured the provider for the user instead of for the organization, this should be just a case of changing the provider configuration.

[8fuhst]

Hey @stevehipwell, thanks for the clarification. We are, however, only passing the repository name to the github_repository_webhook declaration (we are stripping off the organization name in the module, sorry, should have clarified that). In case we try to pass organization/repository, the attempted URL is of this pattern: https://api.github.com/repos/LOCAL-USER/ORGANIZATION/REPO/hooks, and if we only pass the repository, the URL pattern is https://api.github.com/repos/LOCAL-USER/REPO/hooks - so in my case e.g. https://api.github.com/repos/8fuhst/REPO/hooks, despite our owner in the provider configuration not being set to 8fuhst. As mentioned, without any changes on our side, if we roll back to provider version 6.8.3 everything works fine, just version 6.9.0 breaks it

[8fuhst]

Also, we do not have the GITHUB_OWNER env variable set. We're using the owner variable when configuring the provider :)

[deiga]

Let me guess the owner is set in the root module and not inside this module?

Could you provide a full DEBUG level output of a failing apply?

[stevehipwell]

@8fuhst what's the owner set to in the provider configuration?

[8fuhst]

Hey @deiga, @stevehipwell, turns out the issue was indeed on our end - the project we experienced this issue on did not receive a required file that ensured the correct provider for the root module. Thus, the explicit configuration to use the integrations/github provider was indeed missing (it was only set in the module that used the provider directly, but apparently it needs to be set in the module-calling code as well). Sorry about the confusion! This can be closed :)