Skip to content

[BUG] fix rulesets update_allows_fetch_and_merge validation#3547

Open
deiga wants to merge 6 commits into
integrations:mainfrom
F-Secure-web:fix-update_allows_fetch_and_merge-validation
Open

[BUG] fix rulesets update_allows_fetch_and_merge validation#3547
deiga wants to merge 6 commits into
integrations:mainfrom
F-Secure-web:fix-update_allows_fetch_and_merge-validation

Conversation

@deiga

@deiga deiga commented Jul 16, 2026

Copy link
Copy Markdown
Collaborator

Resolves #3543


Before the change?

  • rules.0.update_allows_fetch_and_merge is being marked as invalid config for repository ruleset

After the change?

  • rules.0.update_allows_fetch_and_merge will be allowed as config for repository rulesets
  • Adds Create and Update validation to ensure only Forked repos can set rules.0.update_allows_fetch_and_merge
  • Adds test helper for archiving a repository and for configuring repository visibility
  • Refactors github_repository_ruleset tests to follow modern practices

Pull request checklist

  • Schema migrations have been created if needed (example)
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@github-actions

Copy link
Copy Markdown

👋 Hi, and thank you for this contribution!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions.


🤖 This is an automated message.

@github-actions github-actions Bot added the Type: Bug Something isn't working as documented label Jul 16, 2026
deiga added 5 commits July 19, 2026 08:19
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
…n non-forked repos

Signed-off-by: Timo Sand <timo.sand@f-secure.com>
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
@deiga
deiga force-pushed the fix-update_allows_fetch_and_merge-validation branch from e68c40e to ce2ffca Compare July 19, 2026 06:20
Signed-off-by: Timo Sand <timo.sand@f-secure.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@deiga
deiga marked this pull request as ready for review July 19, 2026 06:49
@deiga
deiga requested review from Copilot and stevehipwell July 19, 2026 06:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Comment on lines 939 to +941
resource "github_repository_ruleset" "test" {
name = "%s"
repository = github_repository.test.name
name = "%[3]s"
repository = "%[2]s"
}
}

func mustArchiveTestRepository(t *testing.T, repo *github.Repository) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you need to retry in this function, which I question for a test function, then could you use retryUntilOK. That said see below for what I think might be the actual solution.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll look at retry until ok.
Retry is my choice as a static sleep felt worse than a retry. And since repo creation is async and archiving right after creation usually returns a 422, something is necessary

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that it's for a test, wouldn't the flexible repo create pattern below be a better option as it's allow you to create a repo already archived?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be, but it's not possible to create repos as "archived" 🫠

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did wonder, so I think using retryUntilOK in the helper would be the best bet.

return mustCreateConfigurableTestRepository(t, "internal")
}

func mustCreateConfigurableTestRepository(t *testing.T, visibility string) *github.Repository {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pattern I'm working towards is below, with the expectation that we probably want to move them into separate files such as acc_helpers_repository_test.go.

type createTestRepositoryOptionsFunc func(*github.Repository)

func mustCreateTestRepository(t *testing.T, f ...createTestRepositoryOptionsFunc) *github.Repository {
	t.Helper()

	randomID := acctest.RandString(testRandomIDLength)
	name := fmt.Sprintf("%s%s", testResourcePrefix, randomID)

	req := &github.Repository{
		Name:     &name,
		AutoInit: new(true),
	}

	for _, fn := range f {
		fn(req)
	}

	repo, _, err := testAccConf.meta.v3client.Repositories.Create(t.Context(), testAccConf.meta.name, req)
	if err != nil {
		t.Fatalf("failed to create test repository: %v", err)
	}

	t.Cleanup(func() {
		if _, err := testAccConf.meta.v3client.Repositories.Delete(context.Background(), testAccConf.meta.name, name); err != nil {
			if err, ok := errors.AsType[*github.ErrorResponse](err); ok && err.Response.StatusCode == 404 {
				return
			}
			t.Logf("failed to delete test repository %s: %v", name, err)
		}
	})

	return repo
}

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is way better! I'll adopt this

visibility = "%s"
}

resource "github_repository_environment" "example" {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can create the environment outside of the TF cnfig too.

resource.TestCheckResourceAttr("github_repository_ruleset.test", "rules.0.copilot_code_review.0.review_draft_pull_requests", "false"),
),
ConfigStateChecks: []statecheck.StateCheck{
statecheck.ExpectKnownValue("github_repository_ruleset.test", tfjsonpath.New("name"), knownvalue.StringExact("test")),

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You don't need to check for value in the config, the framework does this for you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Type: Bug Something isn't working as documented

Projects

None yet

3 participants