From e39131e3e3d69c3cef2481dfaede49fee80e7498 Mon Sep 17 00:00:00 2001
From: Nick Vigilante <github@vigiemail.com>
Date: Mon, 11 May 2026 23:27:13 +0000
Subject: [PATCH] Migrate vulnerability_alerts off deprecated repo argument

The `vulnerability_alerts` attribute on `github_repository` is deprecated
in favor of the dedicated `github_repository_vulnerability_alerts`
resource. Until now every plan emitted one warning per managed repo
(17 total).

Migration approach:

- Drop the `vulnerability_alerts` assignment from `github_repository.managed`.
- Add `lifecycle.ignore_changes = [vulnerability_alerts]` so removing the
  field doesn't cause Tofu to call the disable API on the existing state.
- Add `github_repository_vulnerability_alerts.alerts` for each repo where
  the resolved config wants alerts on. Provider's create is idempotent
  against the GitHub enable endpoint, so no behavioral change.

Applied locally: 10 to add, 0 to change, 0 to destroy. The 17 warnings
collapse to 1 (the unavoidable reference inside `ignore_changes`).
---
 homelab/github.tf | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/homelab/github.tf b/homelab/github.tf
index 477c4be..ecaf6d1 100644
--- a/homelab/github.tf
+++ b/homelab/github.tf
@@ -21,14 +21,29 @@ resource "github_repository" "managed" {
   allow_rebase_merge          = each.value.allow_rebase_merge
   allow_auto_merge            = each.value.allow_auto_merge
   delete_branch_on_merge      = each.value.delete_branch_on_merge
-  vulnerability_alerts        = each.value.vulnerability_alerts
   web_commit_signoff_required = each.value.web_commit_signoff_required
 
   lifecycle {
     prevent_destroy = true
+    # `vulnerability_alerts` is now managed via the dedicated
+    # `github_repository_vulnerability_alerts` resource below. Ignore any
+    # drift on the deprecated field so removing it from config doesn't
+    # cause Tofu to call the disable API.
+    ignore_changes = [vulnerability_alerts]
   }
 }
 
+# Dependabot vulnerability alerts. Migrated out of the deprecated
+# `github_repository.vulnerability_alerts` argument per provider guidance.
+resource "github_repository_vulnerability_alerts" "alerts" {
+  for_each = {
+    for name, cfg in local.repos_resolved : name => cfg
+    if cfg.vulnerability_alerts
+  }
+
+  repository = github_repository.managed[each.key].name
+}
+
 # Branch protection on `main` for every repo where protect_main = true.
 resource "github_branch_protection" "main" {
   for_each = {