feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource by sprioriello · Pull Request #3284 · integrations/terraform-provider-github

sprioriello · 2026-03-16T21:31:31Z

This commit adds a new resource github_organization_security_configuration & github_enterprise_security_configuration to manage Code Security Configurations at the organization & enterprise level respectively. It includes:

Resource implementation.
Acceptance tests.
Documentation.
Provider registration.

Resolves #2412

Before the change?

Resource not available.

After the change?

Implement code security configuration resource on organizational level.

Pull request checklist

Schema migrations have been created if needed (example)
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

Yes
No

Tests

==> Running acceptance tests on branch: ðŸŒ¿ feat/organization-security-configuration ðŸŒ¿...
TF_ACC=1 CGO_ENABLED=0 go test ./github/... -v -run '^TestAcc' -run='TestAccGithubOrganizationSecurityConfiguration'  -timeout 120m -count=1
=== RUN   TestAccGithubOrganizationSecurityConfiguration
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_without_error
=== RUN   TestAccGithubOrganizationSecurityConfiguration/imports_organization_security_configuration_without_error
=== RUN   TestAccGithubOrganizationSecurityConfiguration/updates_organization_security_configuration_without_error
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_options
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_minimal_config
=== RUN   TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_delegated_bypass_options
--- PASS: TestAccGithubOrganizationSecurityConfiguration (67.76s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_without_error (13.93s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/imports_organization_security_configuration_without_error (11.92s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/updates_organization_security_configuration_without_error (15.15s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_options (8.70s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_minimal_config (8.84s)
    --- PASS: TestAccGithubOrganizationSecurityConfiguration/creates_organization_security_configuration_with_delegated_bypass_options (9.21s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     68.139s
==> Running acceptance tests on branch: ðŸŒ¿ feat/organization-security-configuration ðŸŒ¿...
TF_ACC=1 CGO_ENABLED=0 go test ./github/... -v -run '^TestAcc' -run='TestAccGithubEnterpriseSecurityConfiguration'  -timeout 120m -count=1
=== RUN   TestAccGithubEnterpriseSecurityConfiguration
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_without_error
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/imports_enterprise_security_configuration_without_error
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/updates_enterprise_security_configuration_without_error
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_options
=== RUN   TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_minimal_config
--- PASS: TestAccGithubEnterpriseSecurityConfiguration (53.47s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_without_error (11.07s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/imports_enterprise_security_configuration_without_error (10.70s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/updates_enterprise_security_configuration_without_error (14.06s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_options (8.78s)
    --- PASS: TestAccGithubEnterpriseSecurityConfiguration/creates_enterprise_security_configuration_with_minimal_config (8.85s)
PASS
ok      github.com/integrations/terraform-provider-github/v6/github     53.817s

github-actions · 2026-03-16T21:31:43Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

…prise_security_configuration resources Adds two new resources to manage Code Security Configurations: - github_organization_security_configuration: manages code security configurations at the organization level - github_enterprise_security_configuration: manages code security configurations at the enterprise level Both resources include: - Full CRUD operations using GitHub's Code Security Configurations API - Composite IDs (org/enterprise + config ID) - 404-tolerant delete - tflog structured logging throughout - All optional fields use GetOk to avoid sending unset values - Custom import support - Shared expandCodeSecurityConfigurationCommon helper to avoid duplication - All 4 delegated fields on enterprise: code_scanning_delegated_alert_dismissal, secret_scanning_delegated_bypass, secret_scanning_delegated_bypass_options, secret_scanning_delegated_alert_dismissal - Fix flattenCodeScanningDefaultSetupOptions runner_type empty string drift Acceptance tests (5 per resource): - creates without error (with import verification) - updates without error - creates with nested options (runner, autosubmit) - creates with minimal config (with import verification) - creates with delegated bypass options Documentation added for both resources. Resolves integrations#2412 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ppers - Add setCodeSecurityConfigurationState() to util_security_configuration.go, replacing ~83 identical d.Set() lines duplicated across both Read functions - Remove expandCodeSecurityConfiguration() and expandEnterpriseCodeSecurityConfiguration() one-liner wrappers; callers now call expandCodeSecurityConfigurationCommon() directly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Remove fmt.Sprintf from all tflog calls; use static messages with structured fields map for dynamic data (28 instances fixed) - Add configuration_id Computed field to both resources so the numeric config ID is stored separately in state - Update/Delete now read enterprise_slug and configuration_id from state via d.Get() instead of parsing the composite ID - Update enterprise docs with configuration_id attribute Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…n_id - Add missing organization_security_configuration documentation - Fix enterprise docs: description is Optional not Required - Add configuration_id assertions to both test files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…view feedback - Upgrade go-github imports from v83 to v84 across all feature files - Remove secret_scanning_delegated_bypass from enterprise resource (org-only API) - Fix reviewer_type enum casing to TEAM/ROLE to match GitHub API - Wire expandSecretScanningDelegatedBypass into org Create/Update - Remove hardcoded "disabled" defaults for code_security/secret_protection - Use GetOk for description field in expand (consistency with other Optional fields) - Add unit tests for all flatten utility functions (deiga requested) - Add missing ImportState steps to acceptance tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sprioriello · 2026-03-17T09:10:31Z

@deiga ready for review. Thanks for your patience!

I have allowed edits by maintainers.

deiga

Partial review.

Please take some time and look at lately merged PRs to understand what kind of structures we are looking for.
I don't have the energy to review thousands of lines of code, when you haven't put in the work to adhere to the standards of the repo

github/resource_github_organization_security_configuration_test.go

github/resource_github_organization_security_configuration.go

…nventions - Add custom importer functions so Read doesn't parse from ID - Read fetches org/enterprise and configuration_id from state - Create/Update return nil instead of calling Read directly - Use diags.HasError() instead of diags != nil - Use testResourcePrefix in all test resource names - Extract import tests into separate t.Run blocks - Inline test HCL templates instead of shared tmpl variables

… Read Create and Update functions now set state directly from the API response via setCodeSecurityConfigurationState, rather than only setting configuration_id. Enterprise Update also captures the API response instead of discarding it.

…escription - Add CheckDestroy functions to all acceptance tests for both org and enterprise security configuration resources - Cast configuration.GetID() to int to match schema.TypeInt - Fix redundant "code security configuration for the code security configuration" description on the code_security field

sprioriello · 2026-03-23T09:55:04Z

Reviewed and looking at the recent PRs to add in the changes the maintainers are implementing to try and make it consistent. I hope we are much closer this time.

github/resource_github_enterprise_security_configuration_test.go

github/resource_github_organization_security_configuration.go

github/util_security_configuration_test.go

Use single template string in enterprise update test, remove superfluous buildID/SetId in import functions, refactor util tests to table-driven arrays.

Adds table-driven tests for expandCodeSecurityConfigurationCommon and expandSecretScanningDelegatedBypass, covering minimal input, all string fields, nested block options, and delegated bypass with reviewers.

deiga · 2026-04-05T13:42:57Z

github/resource_github_organization_security_configuration.go

+}
+
+func resourceGithubOrganizationSecurityConfigurationImport(_ context.Context, d *schema.ResourceData, _ any) ([]*schema.ResourceData, error) {
+	_, configIDStr, err := parseID2(d.Id())


question: if we're not using the first part of the import id, why do we include it in the id?

Good catch, thanks. The org part of the ID wasn't being used anywhere. The Read/Update/Delete functions all get the org from meta.(*Owner).name, and the import was discarding it with _. I've simplified this to use a plain numeric ID (just the configuration_id), which is consistent with how other org-scoped resources in this provider handle it (organization_ruleset, organization_webhook, organization_custom_role, etc.). Updated the import function and docs accordingly.

Drop the org name from the compound resource ID since it was never used — Read/Update/Delete all get the org from meta.(*Owner).name. This aligns with the convention used by other org-scoped resources (organization_ruleset, organization_webhook, organization_custom_role, etc.).

sprioriello · 2026-04-11T11:30:11Z

@deiga Thank you for taking the time to review this PR and for the detailed feedback across each round. All comments have been addressed. Looking forward to getting this feature out for the GitHub community!

github-actions bot added the Type: Feature New feature or request label Mar 16, 2026

sprioriello changed the title ~~feat: Add github_organization_security_configuration and github_enter…~~ feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource Mar 16, 2026

sprioriello mentioned this pull request Mar 16, 2026

feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource #3143

Closed

5 tasks

sprioriello and others added 4 commits March 17, 2026 19:31

sprioriello force-pushed the feat/organization-security-configuration branch from 8b5e69b to 20f4c17 Compare March 17, 2026 08:38

deiga suggested changes Mar 17, 2026

View reviewed changes

sprioriello added 4 commits March 18, 2026 22:34

Merge branch 'main' into feat/organization-security-configuration

5b487d4

Merge branch 'main' into feat/organization-security-configuration

5ee009b

sprioriello requested a review from deiga March 25, 2026 21:43

deiga suggested changes Mar 25, 2026

View reviewed changes

github/resource_github_enterprise_security_configuration_test.go Outdated Show resolved Hide resolved

github/resource_github_organization_security_configuration.go Outdated Show resolved Hide resolved

github/util_security_configuration_test.go Show resolved Hide resolved

fix: address PR integrations#3284 review feedback from deiga (round 2)

f8abb8f

Use single template string in enterprise update test, remove superfluous buildID/SetId in import functions, refactor util tests to table-driven arrays.

sprioriello requested a review from deiga March 26, 2026 22:12

test: add unit tests for expand functions in util_security_configuration

dadd5b4

Adds table-driven tests for expandCodeSecurityConfigurationCommon and expandSecretScanningDelegatedBypass, covering minimal input, all string fields, nested block options, and delegated bypass with reviewers.

deiga reviewed Apr 5, 2026

View reviewed changes

sprioriello added 2 commits April 11, 2026 21:14

Merge branch 'main' into feat/organization-security-configuration

8d0c624

sprioriello requested a review from deiga April 11, 2026 11:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource#3284

feat: Add github_organization_security_configuration and github_enterprise_security_configuration resource#3284
sprioriello wants to merge 14 commits intointegrations:mainfrom
sprioriello:feat/organization-security-configuration

sprioriello commented Mar 16, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 16, 2026

Uh oh!

sprioriello commented Mar 17, 2026 •

edited

Loading

Uh oh!

deiga left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sprioriello commented Mar 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga Apr 5, 2026

Uh oh!

sprioriello Apr 11, 2026 •

edited

Loading

Uh oh!

sprioriello commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sprioriello commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Tests

Uh oh!

github-actions bot commented Mar 16, 2026

Uh oh!

sprioriello commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sprioriello commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

sprioriello Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sprioriello commented Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sprioriello commented Mar 16, 2026 •

edited

Loading

sprioriello commented Mar 17, 2026 •

edited

Loading

sprioriello commented Mar 23, 2026 •

edited

Loading

sprioriello Apr 11, 2026 •

edited

Loading