fix: remove vulnerability alerts from state for archived/deleted repos#3553
Open
DrFaust92 wants to merge 1 commit into
Open
fix: remove vulnerability alerts from state for archived/deleted repos#3553DrFaust92 wants to merge 1 commit into
DrFaust92 wants to merge 1 commit into
Conversation
|
👋 Hi, and thank you for this contribution! This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can. You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions. 🤖 This is an automated message. |
The Read function for github_repository_vulnerability_alerts returned a
hard error when the underlying repository was archived or no longer
existed, wedging every subsequent plan/apply with:
repository <name> is archived, please remove the resource from your
configuration
Per the provider's own Read convention (a 404 means "remove from state"),
Read now calls d.SetId("") and returns nil in these cases instead of
erroring, so Terraform drops the resource gracefully. Also guards against
a nil *http.Response before dereferencing StatusCode, and fixes the
existing 404 branch that set the ID to "" but then returned an error
(which the SDK discards, so the removal never took effect).
Resolves integrations#3369
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DrFaust92
force-pushed
the
fix-vuln-alerts-archived-state-removal
branch
from
July 23, 2026 09:05
a5959ba to
32b0152
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
These provider review instructions are being used.
Updates vulnerability-alert refresh behavior so archived or deleted repositories are removed from Terraform state rather than blocking refresh.
Changes:
- Gracefully clears state for unavailable alerts and archived/deleted repositories.
- Updates acceptance coverage for archived repositories.
- Documents archived-repository behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
github/resource_github_repository_vulnerability_alerts.go |
Updates read/error handling. |
github/resource_github_repository_vulnerability_alerts_test.go |
Tests archived-repository refresh. |
templates/resources/repository_vulnerability_alerts.md.tmpl |
Adds behavior notes. |
docs/resources/repository_vulnerability_alerts.md |
Regenerates documentation. |
Comment on lines
109
to
+113
| repo, _, err := client.Repositories.Get(ctx, owner, repoName) | ||
| if err != nil { | ||
| return diag.Errorf("repository doesn't exist anymore, please remove the resource from your configuration: %s", err.Error()) | ||
| tflog.Warn(ctx, "Repository doesn't exist anymore, removing resource from state", map[string]any{"owner": owner, "repo_name": repoName}) | ||
| d.SetId("") | ||
| return nil |
Comment on lines
241
to
242
| Config: fmt.Sprintf(withAlertsConfig, repoName, true), | ||
| ExpectNonEmptyPlan: true, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #3369
Before the change?
resourceGithubRepositoryVulnerabilityAlertsReadreturned a hard error when the underlying repository was archived or no longer existed:Because this surfaces during refresh, every subsequent
plan/applyfails until the resource is manually removed from both config and state — you can't eventerraform state rmcleanly while the read errors. Archiving a repo auto-disables its vulnerability alerts on GitHub's side, so the resource is genuinely unmanageable at that point.The existing 404 branch also set
d.SetId("")and then returneddiag.Errorf(...); since the SDK discards state changes when Read returns an error, that removal never actually took effect.After the change?
Read now follows the provider's documented convention (
.github/instructions/schema-and-state.instructions.md: "In Read, a 404 from GitHub means 'remove from state' — calld.SetId("")and return nil"):d.SetId("")+return nil(removed the straydiag.Errorf).d.SetId("")+return nil.d.SetId("")+return nil, with atflog.Warn.Also guards against a nil
*http.Responsebefore dereferencingStatusCode.Net effect: Terraform drops the resource from state gracefully. If the config still declares it on an archived repo, the follow-up plan is non-empty (recreate), and
Createstill returns the pre-existingcannot enable vulnerability alerts on archived repositoryerror — so users get a clear signal to remove the block, instead of a wedged refresh.Pull request checklist
errors_when_reading_archived_repository→removes_from_state_when_reading_archived_repository, asserting graceful removal + non-empty plan instead of an error)Does this introduce a breaking change?
Read no longer returns an error for archived/deleted repositories; instead the resource is removed from state. This is a behavior change but not a schema breaking change.