Migrate vulnerability_alerts off deprecated repo argument - #6
Merged
Conversation
The `vulnerability_alerts` attribute on `github_repository` is deprecated in favor of the dedicated `github_repository_vulnerability_alerts` resource. Until now every plan emitted one warning per managed repo (17 total). Migration approach: - Drop the `vulnerability_alerts` assignment from `github_repository.managed`. - Add `lifecycle.ignore_changes = [vulnerability_alerts]` so removing the field doesn't cause Tofu to call the disable API on the existing state. - Add `github_repository_vulnerability_alerts.alerts` for each repo where the resolved config wants alerts on. Provider's create is idempotent against the GitHub enable endpoint, so no behavioral change. Applied locally: 10 to add, 0 to change, 0 to destroy. The 17 warnings collapse to 1 (the unavoidable reference inside `ignore_changes`).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Provider deprecated
github_repository.vulnerability_alertsin favor of the dedicatedgithub_repository_vulnerability_alertsresource. Every plan was emitting one warning per managed repo — 17 in total — drowning out real signal.Changes:
vulnerability_alerts = each.value.vulnerability_alertsline fromgithub_repository.managed.lifecycle.ignore_changes = [vulnerability_alerts]so removing the field doesn't cause Tofu to call the disable API on the existing state.github_repository_vulnerability_alerts.alertsfor each repo where the resolved config wants alerts on. The provider's create function calls GitHub's enable endpoint, which is idempotent against already-enabled repos — so no behavioral change.Applied locally so cluster (well, GitHub) state matches before merge:
After this lands, the 17
vulnerability_alertswarnings collapse to 1 — that last one comes from referencing the deprecated attribute name insideignore_changes, which is unavoidable until the provider drops the attribute entirely.Test plan
tofu planshows 10 adds, 0 changes, 0 destroysgithub_repository.managed[*]resources show avulnerability_alerts: true -> falsediff (the dangerous case)tofu applysucceedstofu planafter apply is a no-op (idempotent)