From a865960c3d17e3a98100c4d06381cd50f508f81a Mon Sep 17 00:00:00 2001 From: Reinoldo Krause Junior Date: Thu, 15 Oct 2026 09:07:01 -0300 Subject: [PATCH 1/3] Support read and write team repository permissions Accept GitHub UI permission names read and write as aliases for pull and push while preserving existing Terraform configurations. --- docs/resources/team_repository.md | 4 +- .../resources/team_repository/example_1.tf | 2 +- github/resource_github_team_repository.go | 9 ++- .../resource_github_team_repository_test.go | 56 +++++++++++++++++-- templates/resources/team_repository.md.tmpl | 2 +- 5 files changed, 61 insertions(+), 12 deletions(-) diff --git a/docs/resources/team_repository.md b/docs/resources/team_repository.md index ce43f73bdc..ee20e1feb7 100644 --- a/docs/resources/team_repository.md +++ b/docs/resources/team_repository.md @@ -34,7 +34,7 @@ resource "github_repository" "some_repo" { resource "github_team_repository" "some_team_repo" { team_id = github_team.some_team.id repository = github_repository.some_repo.name - permission = "pull" + permission = "read" } ``` @@ -44,7 +44,7 @@ The following arguments are supported: - `team_id` - (Required) The GitHub team id or the GitHub team slug - `repository` - (Required) The repository to add to the team. -- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `pull`, `triage`, `push`, `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. +- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. ## Import diff --git a/examples/resources/team_repository/example_1.tf b/examples/resources/team_repository/example_1.tf index c2276ec830..8b14e9ac53 100644 --- a/examples/resources/team_repository/example_1.tf +++ b/examples/resources/team_repository/example_1.tf @@ -11,5 +11,5 @@ resource "github_repository" "some_repo" { resource "github_team_repository" "some_team_repo" { team_id = github_team.some_team.id repository = github_repository.some_repo.name - permission = "pull" + permission = "read" } diff --git a/github/resource_github_team_repository.go b/github/resource_github_team_repository.go index 4fe4593544..b870ec1a6a 100644 --- a/github/resource_github_team_repository.go +++ b/github/resource_github_team_repository.go @@ -56,7 +56,10 @@ func resourceGithubTeamRepository() *schema.Resource { Type: schema.TypeString, Optional: true, Default: "pull", - Description: "The permissions of team members regarding the repository. Must be one of 'pull', 'triage', 'push', 'maintain', 'admin' or the name of an existing custom repository role within the organisation.", + DiffSuppressFunc: func(_, oldValue, newValue string, _ *schema.ResourceData) bool { + return getPermission(oldValue) == getPermission(newValue) + }, + Description: "The permissions of team members regarding the repository. Must be one of 'read' (equivalent to 'pull'), 'triage', 'write' (equivalent to 'push'), 'maintain', 'admin' or the name of an existing custom repository role within the organisation. Defaults to 'pull'.", }, "etag": { Type: schema.TypeString, @@ -94,7 +97,7 @@ func resourceGithubTeamRepositoryCreate(ctx context.Context, d *schema.ResourceD orgName, repoName, &github.TeamAddTeamRepoOptions{ - Permission: permission, + Permission: getPermission(permission), }, ) if err != nil { @@ -197,7 +200,7 @@ func resourceGithubTeamRepositoryUpdate(ctx context.Context, d *schema.ResourceD orgName, repoName, &github.TeamAddTeamRepoOptions{ - Permission: permission, + Permission: getPermission(permission), }, ) if err != nil { diff --git a/github/resource_github_team_repository_test.go b/github/resource_github_team_repository_test.go index a72eb20d11..4b19e5f39f 100644 --- a/github/resource_github_team_repository_test.go +++ b/github/resource_github_team_repository_test.go @@ -44,6 +44,40 @@ func Test_resourceGithubTeamRepositoryDelete_nilResponseDoesNotPanic(t *testing. } } +func Test_resourceGithubTeamRepositoryPermissionAliases(t *testing.T) { + t.Parallel() + + for _, testCase := range []struct { + permission string + want string + }{ + {permission: "read", want: "pull"}, + {permission: "write", want: "push"}, + {permission: "pull", want: "pull"}, + {permission: "push", want: "push"}, + {permission: "triage", want: "triage"}, + } { + t.Run(testCase.permission, func(t *testing.T) { + t.Parallel() + + if got := getPermission(testCase.permission); got != testCase.want { + t.Errorf("getPermission(%q) = %q, want %q", testCase.permission, got, testCase.want) + } + }) + } + + permissionSchema := resourceGithubTeamRepository().Schema["permission"] + if !permissionSchema.DiffSuppressFunc("permission", "pull", "read", nil) { + t.Error("expected read and pull permissions to suppress a diff") + } + if !permissionSchema.DiffSuppressFunc("permission", "push", "write", nil) { + t.Error("expected write and push permissions to suppress a diff") + } + if permissionSchema.DiffSuppressFunc("permission", "pull", "push", nil) { + t.Error("expected read and write permissions to remain distinct") + } +} + func TestAccGithubTeamRepository(t *testing.T) { t.Parallel() @@ -67,7 +101,7 @@ func TestAccGithubTeamRepository(t *testing.T) { resource "github_team_repository" "test" { team_id = "${github_team.test.id}" repository = "${github_repository.test.name}" - permission = "pull" + permission = "read" } `, teamName, repoName) @@ -114,25 +148,37 @@ func TestAccGithubTeamRepository(t *testing.T) { }, { Config: strings.Replace(config, - `permission = "pull"`, + `permission = "read"`, + `permission = "pull"`, 1), + Check: checks["pull"], + }, + { + Config: strings.Replace(config, + `permission = "read"`, `permission = "triage"`, 1), Check: checks["triage"], }, { Config: strings.Replace(config, - `permission = "pull"`, + `permission = "read"`, + `permission = "write"`, 1), + Check: checks["push"], + }, + { + Config: strings.Replace(config, + `permission = "read"`, `permission = "push"`, 1), Check: checks["push"], }, { Config: strings.Replace(config, - `permission = "pull"`, + `permission = "read"`, `permission = "maintain"`, 1), Check: checks["maintain"], }, { Config: strings.Replace(config, - `permission = "pull"`, + `permission = "read"`, `permission = "admin"`, 1), Check: checks["admin"], }, diff --git a/templates/resources/team_repository.md.tmpl b/templates/resources/team_repository.md.tmpl index 4a20a59b2c..157d313d2d 100644 --- a/templates/resources/team_repository.md.tmpl +++ b/templates/resources/team_repository.md.tmpl @@ -28,7 +28,7 @@ The following arguments are supported: - `team_id` - (Required) The GitHub team id or the GitHub team slug - `repository` - (Required) The repository to add to the team. -- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `pull`, `triage`, `push`, `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. +- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. ## Import From 4c8fb019b3a8b7188cb5f285eff6e6e9b20272e9 Mon Sep 17 00:00:00 2001 From: Reinoldo Krause Junior Date: Thu, 15 Oct 2026 09:42:07 -0300 Subject: [PATCH 2/3] Use read as default team repository permission Make the UI-facing read permission the schema and documentation default; its pull alias preserves API behavior. --- docs/resources/team_repository.md | 2 +- github/resource_github_team_repository.go | 4 ++-- github/resource_github_team_repository_test.go | 3 +++ 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/resources/team_repository.md b/docs/resources/team_repository.md index ee20e1feb7..598567475a 100644 --- a/docs/resources/team_repository.md +++ b/docs/resources/team_repository.md @@ -44,7 +44,7 @@ The following arguments are supported: - `team_id` - (Required) The GitHub team id or the GitHub team slug - `repository` - (Required) The repository to add to the team. -- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. +- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `read`. ## Import diff --git a/github/resource_github_team_repository.go b/github/resource_github_team_repository.go index b870ec1a6a..42c788e2a3 100644 --- a/github/resource_github_team_repository.go +++ b/github/resource_github_team_repository.go @@ -55,11 +55,11 @@ func resourceGithubTeamRepository() *schema.Resource { "permission": { Type: schema.TypeString, Optional: true, - Default: "pull", + Default: "read", DiffSuppressFunc: func(_, oldValue, newValue string, _ *schema.ResourceData) bool { return getPermission(oldValue) == getPermission(newValue) }, - Description: "The permissions of team members regarding the repository. Must be one of 'read' (equivalent to 'pull'), 'triage', 'write' (equivalent to 'push'), 'maintain', 'admin' or the name of an existing custom repository role within the organisation. Defaults to 'pull'.", + Description: "The permissions of team members regarding the repository. Must be one of 'read' (equivalent to 'pull'), 'triage', 'write' (equivalent to 'push'), 'maintain', 'admin' or the name of an existing custom repository role within the organisation. Defaults to 'read'.", }, "etag": { Type: schema.TypeString, diff --git a/github/resource_github_team_repository_test.go b/github/resource_github_team_repository_test.go index 4b19e5f39f..09457ecd81 100644 --- a/github/resource_github_team_repository_test.go +++ b/github/resource_github_team_repository_test.go @@ -67,6 +67,9 @@ func Test_resourceGithubTeamRepositoryPermissionAliases(t *testing.T) { } permissionSchema := resourceGithubTeamRepository().Schema["permission"] + if permissionSchema.Default != "read" { + t.Errorf("permission default = %q, want %q", permissionSchema.Default, "read") + } if !permissionSchema.DiffSuppressFunc("permission", "pull", "read", nil) { t.Error("expected read and pull permissions to suppress a diff") } From ff1867f0f138c4bfea08c248f493541738bc773a Mon Sep 17 00:00:00 2001 From: Reinoldo Krause Junior Date: Thu, 15 Oct 2026 09:43:38 -0300 Subject: [PATCH 3/3] Document read as team repository default Keep the source template aligned with the schema default and generated docs. --- templates/resources/team_repository.md.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/resources/team_repository.md.tmpl b/templates/resources/team_repository.md.tmpl index 157d313d2d..7e20b85f42 100644 --- a/templates/resources/team_repository.md.tmpl +++ b/templates/resources/team_repository.md.tmpl @@ -28,7 +28,7 @@ The following arguments are supported: - `team_id` - (Required) The GitHub team id or the GitHub team slug - `repository` - (Required) The repository to add to the team. -- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `pull`. +- `permission` - (Optional) The permissions of team members regarding the repository. Must be one of `read` (equivalent to `pull`), `triage`, `write` (equivalent to `push`), `maintain`, `admin` or the name of an existing [custom repository role](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-repository-roles-for-an-organization) within the organisation. Defaults to `read`. ## Import