Skip to content

Commit 1e45509

Browse files
mariuxmariux
authored
Merge pull request #106 from mineiros-io/require_conversation_resolution
Add Setting require_conversation_resolution for Branch Protection
2 parents 7945749 + 13b66b7 commit 1e45509

File tree

7 files changed

+54
-250
lines changed

7 files changed

+54
-250
lines changed

‎CHANGELOG.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.14.0]
11+
12+
### Added
13+
14+
- Add suport for `require_conversation_resolution` for Branch Protection (thanks to @0x46616c6b)
15+
16+
### Changed
17+
18+
- BREAKING: update to provider `~> 4.20` fixing an issue that was just supporting `v4.19.x`
19+
1020
## [0.13.0]
1121

1222
### Added
@@ -340,7 +350,8 @@ Please review plans and report regressions and issues asap so we can improve doc
340350
- This is the initial release of our GitHub Repository module with support for
341351
creating and managing GitHub Repositories for Organizations.
342352

343-
[unreleased]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.13.0...HEAD
353+
[unreleased]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.14.0...HEAD
354+
[0.14.0]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.13.0...v0.14.0
344355
[0.13.0]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.12.0...v0.13.0
345356
[0.12.0]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.11.0...v0.12.0
346357
[0.11.0]: https://github.com/mineiros-io/terraform-github-repository/compare/v0.10.1...v0.11.0

‎README.md

Lines changed: 10 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -483,15 +483,15 @@ This is due to some terraform limitation and we will update the module once terr
483483

484484
#### Branch Protections Configuration
485485

486-
- [**`branch_protections_v3`**](#var-branch_protections_v3): *(Optional `list(branch_protection)`)*<a name="var-branch_protections_v3"></a>
486+
- [**`branch_protections_v3`**](#var-branch_protections_v3): *(Optional `list(branch_protection_v3)`)*<a name="var-branch_protections_v3"></a>
487487

488488
This resource allows you to configure branch protection for repositories in your organization.
489489
When applied, the branch will be protected from forced pushes and deletion.
490490
Additional constraints, such as required status checks or restrictions on users and teams, can also be configured.
491491

492492
Default is `[]`.
493493

494-
Each `branch_protection` object in the list accepts the following attributes:
494+
Each `branch_protection_v3` object in the list accepts the following attributes:
495495

496496
- [**`branch`**](#attr-branch_protections_v3-branch): *(**Required** `string`)*<a name="attr-branch_protections_v3-branch"></a>
497497

@@ -503,6 +503,12 @@ This is due to some terraform limitation and we will update the module once terr
503503

504504
Default is `false`.
505505

506+
- [**`require_conversation_resolution`**](#attr-branch_protections_v3-require_conversation_resolution): *(Optional `bool`)*<a name="attr-branch_protections_v3-require_conversation_resolution"></a>
507+
508+
Setting this to true requires all conversations to be resolved.
509+
510+
Default is `false`.
511+
506512
- [**`require_signed_commits`**](#attr-branch_protections_v3-require_signed_commits): *(Optional `bool`)*<a name="attr-branch_protections_v3-require_signed_commits"></a>
507513

508514
Setting this to true requires all commits to be signed with GPG.
@@ -592,113 +598,13 @@ This is due to some terraform limitation and we will update the module once terr
592598

593599
Default is `[]`.
594600

595-
- [**`branch_protections`**](#var-branch_protections): *(Optional `list(branch_protection)`)*<a name="var-branch_protections"></a>
601+
- [**`branch_protections`**](#var-branch_protections): *(Optional `list(branch_protection_v3)`)*<a name="var-branch_protections"></a>
596602

597603
**_DEPRECATED_** To ensure compatibility with future versions of this module, please use `branch_protections_v3`.
598-
This argument is ignored if `branch_protections_v3` is used.
604+
This argument is ignored if `branch_protections_v3` is used. Please see `branch_protections_v3` for supported attributes.
599605

600606
Default is `[]`.
601607

602-
Each `branch_protection` object in the list accepts the following attributes:
603-
604-
- [**`branch`**](#attr-branch_protections-branch): *(**Required** `string`)*<a name="attr-branch_protections-branch"></a>
605-
606-
The Git branch to protect.
607-
608-
- [**`enforce_admins`**](#attr-branch_protections-enforce_admins): *(Optional `bool`)*<a name="attr-branch_protections-enforce_admins"></a>
609-
610-
Setting this to true enforces status checks for repository administrators.
611-
612-
Default is `false`.
613-
614-
- [**`require_signed_commits`**](#attr-branch_protections-require_signed_commits): *(Optional `bool`)*<a name="attr-branch_protections-require_signed_commits"></a>
615-
616-
Setting this to true requires all commits to be signed with GPG.
617-
618-
Default is `false`.
619-
620-
- [**`required_status_checks`**](#attr-branch_protections-required_status_checks): *(Optional `object(required_status_checks)`)*<a name="attr-branch_protections-required_status_checks"></a>
621-
622-
Enforce restrictions for required status checks.
623-
See Required Status Checks below for details.
624-
625-
Default is `{}`.
626-
627-
The `required_status_checks` object accepts the following attributes:
628-
629-
- [**`strict`**](#attr-branch_protections-required_status_checks-strict): *(Optional `bool`)*<a name="attr-branch_protections-required_status_checks-strict"></a>
630-
631-
Require branches to be up to date before merging.
632-
Defaults is `false`.
633-
634-
- [**`contexts`**](#attr-branch_protections-required_status_checks-contexts): *(Optional `list(string)`)*<a name="attr-branch_protections-required_status_checks-contexts"></a>
635-
636-
The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required.
637-
638-
Default is `[]`.
639-
640-
- [**`required_pull_request_reviews`**](#attr-branch_protections-required_pull_request_reviews): *(Optional `object(required_pull_request_reviews)`)*<a name="attr-branch_protections-required_pull_request_reviews"></a>
641-
642-
Enforce restrictions for pull request reviews.
643-
644-
Default is `{}`.
645-
646-
The `required_pull_request_reviews` object accepts the following attributes:
647-
648-
- [**`dismiss_stale_reviews`**](#attr-branch_protections-required_pull_request_reviews-dismiss_stale_reviews): *(Optional `bool`)*<a name="attr-branch_protections-required_pull_request_reviews-dismiss_stale_reviews"></a>
649-
650-
Dismiss approved reviews automatically when a new commit is pushed.
651-
652-
Default is `true`.
653-
654-
- [**`dismissal_users`**](#attr-branch_protections-required_pull_request_reviews-dismissal_users): *(Optional `list(string)`)*<a name="attr-branch_protections-required_pull_request_reviews-dismissal_users"></a>
655-
656-
The list of user logins with dismissal access
657-
658-
Default is `[]`.
659-
660-
- [**`dismissal_teams`**](#attr-branch_protections-required_pull_request_reviews-dismissal_teams): *(Optional `list(string)`)*<a name="attr-branch_protections-required_pull_request_reviews-dismissal_teams"></a>
661-
662-
The list of team slugs with dismissal access.
663-
Always use slug of the team, not its name.
664-
Each team already has to have access to the repository.
665-
666-
Default is `[]`.
667-
668-
- [**`require_code_owner_reviews`**](#attr-branch_protections-required_pull_request_reviews-require_code_owner_reviews): *(Optional `bool`)*<a name="attr-branch_protections-required_pull_request_reviews-require_code_owner_reviews"></a>
669-
670-
Require an approved review in pull requests including files with a designated code owner.
671-
672-
Default is `false`.
673-
674-
- [**`restrictions`**](#attr-branch_protections-restrictions): *(Optional `object(restrictions)`)*<a name="attr-branch_protections-restrictions"></a>
675-
676-
Enforce restrictions for the users and teams that may push to the branch - only available for organization-owned repositories. See Restrictions below for details.
677-
678-
Default is `{}`.
679-
680-
The `restrictions` object accepts the following attributes:
681-
682-
- [**`users`**](#attr-branch_protections-restrictions-users): *(Optional `list(string)`)*<a name="attr-branch_protections-restrictions-users"></a>
683-
684-
The list of user logins with push access.
685-
686-
Default is `[]`.
687-
688-
- [**`teams`**](#attr-branch_protections-restrictions-teams): *(Optional `list(string)`)*<a name="attr-branch_protections-restrictions-teams"></a>
689-
690-
The list of team slugs with push access.
691-
Always use slug of the team, not its name.
692-
Each team already has to have access to the repository.
693-
694-
Default is `[]`.
695-
696-
- [**`apps`**](#attr-branch_protections-restrictions-apps): *(Optional `list(string)`)*<a name="attr-branch_protections-restrictions-apps"></a>
697-
698-
The list of app slugs with push access.
699-
700-
Default is `[]`.
701-
702608
#### Issue Labels Configuration
703609

704610
- [**`issue_labels`**](#var-issue_labels): *(Optional `list(issue_label)`)*<a name="var-issue_labels"></a>

‎README.tfdoc.hcl

Lines changed: 11 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -622,7 +622,7 @@ section {
622622
title = "Branch Protections Configuration"
623623

624624
variable "branch_protections_v3" {
625-
type = list(branch_protection)
625+
type = list(branch_protection_v3)
626626
default = []
627627
description = <<-END
628628
This resource allows you to configure branch protection for repositories in your organization.
@@ -646,6 +646,14 @@ section {
646646
END
647647
}
648648

649+
attribute "require_conversation_resolution" {
650+
type = bool
651+
default = false
652+
description = <<-END
653+
Setting this to true requires all conversations to be resolved.
654+
END
655+
}
656+
649657
attribute "require_signed_commits" {
650658
type = bool
651659
default = false
@@ -757,137 +765,12 @@ section {
757765
}
758766

759767
variable "branch_protections" {
760-
type = list(branch_protection)
768+
type = list(branch_protection_v3)
761769
default = []
762770
description = <<-END
763771
**_DEPRECATED_** To ensure compatibility with future versions of this module, please use `branch_protections_v3`.
764-
This argument is ignored if `branch_protections_v3` is used.
772+
This argument is ignored if `branch_protections_v3` is used. Please see `branch_protections_v3` for supported attributes.
765773
END
766-
767-
attribute "branch" {
768-
required = true
769-
type = string
770-
description = <<-END
771-
The Git branch to protect.
772-
END
773-
}
774-
775-
attribute "enforce_admins" {
776-
type = bool
777-
default = false
778-
description = <<-END
779-
Setting this to true enforces status checks for repository administrators.
780-
END
781-
}
782-
783-
attribute "require_signed_commits" {
784-
type = bool
785-
default = false
786-
description = <<-END
787-
Setting this to true requires all commits to be signed with GPG.
788-
END
789-
}
790-
791-
attribute "required_status_checks" {
792-
type = object(required_status_checks)
793-
default = {}
794-
description = <<-END
795-
Enforce restrictions for required status checks.
796-
See Required Status Checks below for details.
797-
END
798-
799-
attribute "strict" {
800-
type = bool
801-
description = <<-END
802-
Require branches to be up to date before merging.
803-
Defaults is `false`.
804-
END
805-
}
806-
807-
attribute "contexts" {
808-
type = list(string)
809-
default = []
810-
description = <<-END
811-
The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required.
812-
END
813-
}
814-
}
815-
816-
attribute "required_pull_request_reviews" {
817-
type = object(required_pull_request_reviews)
818-
default = {}
819-
description = <<-END
820-
Enforce restrictions for pull request reviews.
821-
END
822-
823-
attribute "dismiss_stale_reviews" {
824-
type = bool
825-
default = true
826-
description = <<-END
827-
Dismiss approved reviews automatically when a new commit is pushed.
828-
END
829-
}
830-
831-
attribute "dismissal_users" {
832-
type = list(string)
833-
default = []
834-
description = <<-END
835-
The list of user logins with dismissal access
836-
END
837-
}
838-
839-
attribute "dismissal_teams" {
840-
type = list(string)
841-
default = []
842-
description = <<-END
843-
The list of team slugs with dismissal access.
844-
Always use slug of the team, not its name.
845-
Each team already has to have access to the repository.
846-
END
847-
}
848-
849-
attribute "require_code_owner_reviews" {
850-
type = bool
851-
default = false
852-
description = <<-END
853-
Require an approved review in pull requests including files with a designated code owner.
854-
END
855-
}
856-
}
857-
858-
attribute "restrictions" {
859-
type = object(restrictions)
860-
default = {}
861-
description = <<-END
862-
Enforce restrictions for the users and teams that may push to the branch - only available for organization-owned repositories. See Restrictions below for details.
863-
END
864-
865-
attribute "users" {
866-
type = list(string)
867-
default = []
868-
description = <<-END
869-
The list of user logins with push access.
870-
END
871-
}
872-
873-
attribute "teams" {
874-
type = list(string)
875-
default = []
876-
description = <<-END
877-
The list of team slugs with push access.
878-
Always use slug of the team, not its name.
879-
Each team already has to have access to the repository.
880-
END
881-
}
882-
883-
attribute "apps" {
884-
type = list(string)
885-
default = []
886-
description = <<-END
887-
The list of app slugs with push access.
888-
END
889-
}
890-
}
891774
}
892775
}
893776

‎examples/public-repository/main.tf

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,10 @@ module "repository" {
4949

5050
branch_protections = [
5151
{
52-
branch = "main"
53-
enforce_admins = true
54-
require_signed_commits = true
52+
branch = "main"
53+
enforce_admins = true
54+
require_conversation_resolution = true
55+
require_signed_commits = true
5556

5657
required_status_checks = {
5758
strict = true

‎main.tf

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,13 @@ locals {
4343
locals {
4444
branch_protections = try([
4545
for b in local.branch_protections_v3 : merge({
46-
branch = null
47-
enforce_admins = null
48-
require_signed_commits = null
49-
required_status_checks = {}
50-
required_pull_request_reviews = {}
51-
restrictions = {}
46+
branch = null
47+
enforce_admins = null
48+
require_conversation_resolution = null
49+
require_signed_commits = null
50+
required_status_checks = {}
51+
required_pull_request_reviews = {}
52+
restrictions = {}
5253
}, b)
5354
], [])
5455

@@ -171,10 +172,11 @@ resource "github_branch_protection_v3" "branch_protection" {
171172
github_team_repository.team_repository_by_slug
172173
]
173174

174-
repository = github_repository.repository.name
175-
branch = local.branch_protections[count.index].branch
176-
enforce_admins = local.branch_protections[count.index].enforce_admins
177-
require_signed_commits = local.branch_protections[count.index].require_signed_commits
175+
repository = github_repository.repository.name
176+
branch = local.branch_protections[count.index].branch
177+
enforce_admins = local.branch_protections[count.index].enforce_admins
178+
require_conversation_resolution = local.branch_protections[count.index].require_conversation_resolution
179+
require_signed_commits = local.branch_protections[count.index].require_signed_commits
178180

179181
dynamic "required_status_checks" {
180182
for_each = local.required_status_checks[count.index]

0 commit comments

Comments
 (0)