feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource by sprioriello · Pull Request #3143 · integrations/terraform-provider-github

sprioriello · 2026-01-30T10:30:14Z

This commit adds a new resource github_organization_security_configuration & github_enterprise_security_configuration to manage Code Security Configurations at the organization & enterprise level respectively. It includes:

Resource implementation.
Acceptance tests.
Documentation.
Provider registration.

Resolves #2412

Before the change?

Resource not available.

After the change?

Implement code security configuration resource on organizational level.

Pull request checklist

Schema migrations have been created if needed (example)
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

Yes
No

Tests

==> Running acceptance tests on branch: ðŸŒ¿ feat/organization-security-configuration ðŸŒ¿...
TF_ACC=1 CGO_ENABLED=0 go test ./github/... -v -run '^TestAcc' -run='TestAccGithubOrganizationSecurityConfiguration'  -timeout 120m -count=1
=== RUN   TestAccGithubOrganizationSecurityConfiguration
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_without_error
=== RUN   TestAccGithubOrganizationSecurityConfiguration/updates_organization_security_configuration_without_error
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_options
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_minimal_config
--- PASS: TestAccGithubOrganizationSecurityConfiguration (48.02s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_without_error (12.08s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/updates_organization_security_configuration_without_error (15.99s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_options (10.98s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_minimal_config (8.96s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     48.317s
==> Running acceptance tests on branch: ðŸŒ¿ feat/organization-security-configuration ðŸŒ¿...
TF_ACC=1 CGO_ENABLED=0 go test ./github/... -v -run '^TestAcc' -run='TestAccGithubEnterpriseSecurityConfiguration'  -timeout 120m -count=1
=== RUN   TestAccGithubEnterpriseSecurityConfiguration
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_without_error
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/updates_enterprise_security_configuration_without_error
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_options
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_minimal_config
--- PASS: TestAccGithubEnterpriseSecurityConfiguration (46.68s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_without_error (10.97s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/updates_enterprise_security_configuration_without_error (15.31s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_options (11.52s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_minimal_config (8.88s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     46.923s

github-actions · 2026-01-30T10:30:25Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

github/resource_github_organization_security_configuration.go

sprioriello · 2026-02-03T08:59:23Z

@deiga ready for review

sprioriello · 2026-02-09T23:33:16Z

@nickfloyd @deiga is there anything else you need to help get this through. We are keen on this feature :)

deiga · 2026-02-13T22:20:56Z

@sprioriello You'll need to at least rebase this 😬

deiga

Please apply applicable changes also to the Org resource, I don't want to repeat myself there

github/resource_github_enterprise_security_configuration.go

github/resource_github_enterprise_security_configuration_test.go

github/resource_github_enterprise_security_configuration.go

github/resource_github_organization_security_configuration.go

sprioriello · 2026-02-16T10:34:19Z

Acceptance Test Results

All 8 acceptance tests pass (4 organization + 4 enterprise):

--- PASS: TestAccGithubOrganizationSecurityConfiguration (56.53s)
    --- PASS: .../creates_organization_security_configuration_without_error (13.28s)
    --- PASS: .../updates_organization_security_configuration_without_error (19.47s)
    --- PASS: .../creates_organization_security_configuration_with_options (12.26s)
    --- PASS: .../creates_organization_security_configuration_with_minimal_config (11.51s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     56.936s

--- PASS: TestAccGithubEnterpriseSecurityConfiguration (54.89s)
    --- PASS: .../creates_enterprise_security_configuration_without_error (13.85s)
    --- PASS: .../updates_enterprise_security_configuration_without_error (17.04s)
    --- PASS: .../creates_enterprise_security_configuration_with_options (12.63s)
    --- PASS: .../creates_enterprise_security_configuration_with_minimal_config (11.38s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     55.324s

sprioriello · 2026-02-16T10:44:44Z

@sprioriello You'll need to at least rebase this 😬

@deiga rebased and addressed comments as requested. Thank you

deiga

Please review all the comments we've left before and check that they are actually done. Many seem to have somehow gotten reverted

github/resource_github_enterprise_security_configuration.go

github/resource_github_enterprise_security_configuration_test.go

github/util_security_configuration.go

github/resource_github_organization_security_configuration.go

sprioriello · 2026-02-28T20:33:23Z

@deiga @stevehipwell ready for review

deiga

Before asking for review after this round, please make sure that any discussions from previous rounds have been addressed.

And see to it that comments are addressed across all changes, not just where we left them.

github/resource_github_enterprise_security_configuration.go

deiga · 2026-03-01T06:43:30Z

github/resource_github_enterprise_security_configuration.go

+	enterprise := d.Get("enterprise_slug").(string)
+	name := d.Get("name").(string)
+
+	tflog.Debug(ctx, fmt.Sprintf("Creating enterprise code security configuration: %s/%s", enterprise, name), map[string]any{


Don't use fmt.Sprintf inside tflog. calls

Suggested change

tflog.Debug(ctx, fmt.Sprintf("Creating enterprise code security configuration: %s/%s", enterprise, name), map[string]any{

tflog.Debug(ctx, "Creating enterprise code security configuration", map[string]any{

deiga · 2026-03-01T06:46:38Z

github/resource_github_enterprise_security_configuration.go

+		"id":         configuration.GetID(),
+	})
+
+	return resourceGithubEnterpriseSecurityConfigurationRead(ctx, d, meta)


You've managed to revert to the problematic behaviour, which we already asked you to remove.

deiga · 2026-03-01T06:53:10Z

github/resource_github_enterprise_security_configuration.go

+	enterprise, idStr, err := parseID2(d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}


Replace parsing fields from the ID with d.Get calls when we should have the information in State already

deiga · 2026-03-01T06:55:28Z

github/resource_github_enterprise_security_configuration.go

+	enterprise, idStr, err := parseID2(d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil {
+		return diag.FromErr(err)
+	}


Replace with fetching data from State

deiga · 2026-03-01T06:56:03Z

github/resource_github_enterprise_security_configuration.go

+		"id":         id,
+	})
+
+	return resourceGithubEnterpriseSecurityConfigurationRead(ctx, d, meta)


You need to populate any Computed fields inside Update

Suggested change

return resourceGithubEnterpriseSecurityConfigurationRead(ctx, d, meta)

return nil

deiga · 2026-03-01T06:56:25Z

github/resource_github_enterprise_security_configuration.go

+	enterprise, idStr, err := parseID2(d.Id())
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	id, err := strconv.ParseInt(idStr, 10, 64)
+	if err != nil {
+		return diag.FromErr(err)
+	}


No parsing fields from ID

deiga · 2026-03-01T06:57:19Z

github/resource_github_enterprise_security_configuration.go

+	id, err := buildID(enterpriseSlug, configID)
+	if err != nil {
+		return nil, err
+	}
+	d.SetId(id)


Since this is already the ID value, setting it again seems unnecessary

deiga · 2026-03-01T06:59:03Z

github/resource_github_enterprise_security_configuration.go

+		return diag.FromErr(err)
+	}
+
+	id, err := buildID(enterprise, strconv.FormatInt(configuration.GetID(), 10))


Since the configuration ID is needed for API calls, we should store it separately in the State as well

deiga · 2026-03-01T07:07:58Z

github/util_security_configuration.go

Please add tests for these util functions

…prise_security_configuration resources Adds resources to manage Code Security Configurations at the organization and enterprise level. Addresses all reviewer feedback from PR integrations#3143: - Fixed go-github import to v82 (matching go.mod) - Removed fmt.Sprintf from all tflog calls, using structured fields only - Create/Update set Computed fields directly and return nil (no Read call) - Added configuration_id Computed field for numeric API ID in State - Update/Delete use d.Get() from State instead of parsing composite ID - Simplified Import function, removed redundant buildID/SetId - Extracted setState helpers to DRY up Computed field population - Added unit tests for all util flatten functions Resolves integrations#2412

…prise_security_configuration resources Adds two new resources to manage Code Security Configurations: - github_organization_security_configuration: manages code security configurations at the organization level - github_enterprise_security_configuration: manages code security configurations at the enterprise level Both resources include: - Full CRUD operations using GitHub's Code Security Configurations API - Composite IDs (org/enterprise + config ID) - 404-tolerant delete - tflog structured logging throughout - All optional fields use GetOk to avoid sending unset values - Custom import support - Shared expandCodeSecurityConfigurationCommon helper to avoid duplication - All 4 delegated fields on enterprise: code_scanning_delegated_alert_dismissal, secret_scanning_delegated_bypass, secret_scanning_delegated_bypass_options, secret_scanning_delegated_alert_dismissal - Fix flattenCodeScanningDefaultSetupOptions runner_type empty string drift Acceptance tests (5 per resource): - creates without error (with import verification) - updates without error - creates with nested options (runner, autosubmit) - creates with minimal config (with import verification) - creates with delegated bypass options Documentation added for both resources. Resolves integrations#2412 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Make `description` Optional+Computed on both org and enterprise security configuration resources (the API does not require it) - Add unit tests for `flattenCodeScanningDefaultSetupOptions` covering the empty RunnerType edge case that caused spurious plan diffs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deiga · 2026-03-16T21:28:20Z

Something went wrong with your changes. Please open a new PR

sprioriello · 2026-03-16T21:45:53Z

New PR: #3284

- Remove fmt.Sprintf from all tflog calls; use static messages with structured fields map for dynamic data (28 instances fixed) - Add configuration_id Computed field to both resources so the numeric config ID is stored separately in state - Update/Delete now read enterprise_slug and configuration_id from state via d.Get() instead of parsing the composite ID - Update enterprise docs with configuration_id attribute Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…view feedback - Upgrade go-github imports from v83 to v84 across all feature files - Remove secret_scanning_delegated_bypass from enterprise resource (org-only API) - Fix reviewer_type enum casing to TEAM/ROLE to match GitHub API - Wire expandSecretScanningDelegatedBypass into org Create/Update - Remove hardcoded "disabled" defaults for code_security/secret_protection - Use GetOk for description field in expand (consistency with other Optional fields) - Add unit tests for all flatten utility functions (deiga requested) - Add missing ImportState steps to acceptance tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions bot added the Type: Feature New feature or request label Jan 30, 2026

sprioriello changed the title ~~feat: Add github_organization_security_configuration resource~~ [FEAT]: Add github_organization_security_configuration resource Jan 30, 2026

sprioriello changed the title ~~[FEAT]: Add github_organization_security_configuration resource~~ feat: Add github_organization_security_configuration resource Jan 30, 2026

deiga suggested changes Jan 30, 2026

View reviewed changes

github/resource_github_organization_security_configuration.go Outdated Show resolved Hide resolved

github/resource_github_organization_security_configuration.go Outdated Show resolved Hide resolved

sprioriello changed the title ~~feat: Add github_organization_security_configuration resource~~ feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource Feb 1, 2026

sprioriello requested a review from deiga February 3, 2026 10:55

deiga suggested changes Feb 13, 2026

View reviewed changes

sprioriello force-pushed the feat/organization-security-configuration branch from 47e7766 to 33ae057 Compare February 16, 2026 10:42

sprioriello requested a review from deiga February 17, 2026 11:27

deiga suggested changes Feb 17, 2026

View reviewed changes

sprioriello force-pushed the feat/organization-security-configuration branch from a14d69e to 6fec8f5 Compare February 18, 2026 10:49

sprioriello requested a review from deiga February 18, 2026 11:00

sprioriello force-pushed the feat/organization-security-configuration branch 2 times, most recently from cdb1e63 to 6d3c919 Compare February 18, 2026 11:12

deiga suggested changes Mar 1, 2026

View reviewed changes

sprioriello force-pushed the feat/organization-security-configuration branch from 8c53a8b to 616802e Compare March 16, 2026 10:30

sprioriello and others added 2 commits March 16, 2026 23:03

sprioriello force-pushed the feat/organization-security-configuration branch from 616802e to ee7c8d5 Compare March 16, 2026 21:18

deiga closed this Mar 16, 2026

	tflog.Debug(ctx, fmt.Sprintf("Creating enterprise code security configuration: %s/%s", enterprise, name), map[string]any{
	tflog.Debug(ctx, "Creating enterprise code security configuration", map[string]any{

	return resourceGithubEnterpriseSecurityConfigurationRead(ctx, d, meta)
	return nil

Conversation

sprioriello commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Tests

Uh oh!

github-actions bot commented Jan 30, 2026

Uh oh!

Uh oh!

Uh oh!

sprioriello commented Feb 3, 2026

Uh oh!

sprioriello commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deiga commented Feb 13, 2026

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sprioriello commented Feb 16, 2026

Acceptance Test Results

Uh oh!

sprioriello commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sprioriello commented Feb 28, 2026

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

deiga commented Mar 16, 2026

Uh oh!

sprioriello commented Mar 16, 2026

Uh oh!

sprioriello commented Jan 30, 2026 •

edited

Loading

sprioriello commented Feb 9, 2026 •

edited

Loading

sprioriello commented Feb 16, 2026 •

edited

Loading