github_organization_ruleset gets in bad state and can't recover

[pdewilde]

Expected Behavior

1. I modify a ruleset, terraform apply fails due to the required workflow being in a repo with action sharing disabled.
2. I fix the action sharing setting.
3. Another apply sets the correct ruleset.

Actual Behavior

1. I modify a ruleset, terraform apply fails due to the required workflow being in a repo with action sharing disabled. 422 Validation Failed [{Resource: Field: Code: Message:Invalid rule 'workflows': Invalid parameter workflows: Workflow error at index 0: Workflow source repository 'my-org/required-scan' has actions sharing disabled}]
2. I fix the action sharing setting.
3. Apply/plan says there is nothing to change. TF state command shows my changes, but when I actually look in org settings, the ruleset has not been updated.

I think there are two things going on:

1. A bug somewhere that causes the state to be updated despite the 422 validation failure. The state gets updated with the changes, but the etag is from the old version of the rule since the update failed.
2. Since the etag matches the old version of the rule, the provider sends it to GitHub when refreshing state and is told nothing is changed. Terraform provider has incorrect state, but since "nothing changed" it assumes that its internal state is accurate.

Terraform Version

Terraform Version:

v1.7.1

GitHub provider:

• Bad state created in v6.7.9
• Updated to v6.9.1 and it didn't help recover

Affected Resource(s)

• resource_github_organization_ruleset

Terraform Configuration Files

Steps to Reproduce

1. Have an existing github org ruleset with no required workflow action (in evaluate)
2. Update tf config to add a required workflow from a repo that doesn't have action sharing enabled. Also switch to active
3. terraform apply: Fails with

Error: PUT https://(gh instance)/api/v3/orgs/my-org/rulesets/108: 422 Validation Failed [{Resource: Field: Code: Message:Invalid rule 'workflows': Invalid parameter workflows: Workflow error at index 0: Workflow source repository 'my-org/required-scan' has actions sharing disabled}]

4. Enable action sharing on the repo
5. Re-apply workflow rule

Debug Output

Panic Output

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[stevehipwell]

@pdewilde could you please see if v6.10.x fixes your issue?

[pdewilde]

@stevehipwell Was able to reproduce after updating to v6.10.2

Repro steps:

1. Make rule with no required workflow
2. Modify rule to include required workflow for repo that has workflow sharing turned off (Env GHES if that matters, don't know if that is an option in .com).
3. Apply will fail
4. Enable workflow sharing
5. Re-apply --> no changes

The provider debug logging changes in 6.10 are really nice though. I can see my intuition with etag was right. I am getting:

 API responded with StatusNotModified, not refreshing state:

When it tries to read state for my ruleset.

[pdewilde]

One interesting note: after removing required workflow my rulset to get to step 1, when I was making plan for step 3, it noticed there was some external change in etag. I did a 2nd apply of my no-workflow state and that etag change warning went away. There is definitly something wonky going on with etags.

[stevehipwell]

@pdewilde thanks for the clarification, this seems to be a defect in the etag pattern around an assumption. I have no idea how etags ended up in the business logic rather than the transport logic but it looks like the logic is fundamentally flawed. I'll open up a new issue to track this as it doesn't only impact the github_organization_ruleset resource.