Skip to content

Commit 346b4e0

Browse files
author
Illia Karenhin
committed
Added security_and_analysis block support
1 parent ee6001a commit 346b4e0

File tree

7 files changed

+113
-56
lines changed

7 files changed

+113
-56
lines changed

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.19.0]
11+
12+
### Added
13+
14+
- Added support for `security_and_analysis`.
15+
1016
## [0.18.0]
1117

1218
### Added

README.md

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,8 @@
99
# terraform-github-repository
1010

1111
A [Terraform] module for creating a public or private repository on [Github].
12-
1312
**_This module supports Terraform v1.x and is compatible with the Official Terraform GitHub Provider v4.20 and above from `integrations/github`._**
14-
1513
**Attention: This module is incompatible with the Hashicorp GitHub Provider! The latest version of this module supporting `hashicorp/github` provider is `~> 0.10.0`**
16-
1714
** Note: Versions 5.3.0, 5.4.0, and 5.5.0 of the Terraform Github Provider have broken branch protections support and should not be used.**
1815

1916

@@ -30,6 +27,7 @@ A [Terraform] module for creating a public or private repository on [Github].
3027
- [Deploy Keys Configuration](#deploy-keys-configuration)
3128
- [Branch Protections v3 Configuration](#branch-protections-v3-configuration)
3229
- [Branch Protections v4 Configuration](#branch-protections-v4-configuration)
30+
- [Security And Analysis Configuration](#security-and-analysis-configuration)
3331
- [Issue Labels Configuration](#issue-labels-configuration)
3432
- [Projects Configuration](#projects-configuration)
3533
- [Webhooks Configuration](#webhooks-configuration)
@@ -61,26 +59,22 @@ rollouts** and **rollbacks**. It's a comprehensive, ready-to-use blueprint
6159
maintained by our team of platform engineering experts and saves
6260
companies such as yours tons of time by building on top of a pre-configured
6361
solution instead of building and maintaining it yourself.
64-
6562
For details please see [https://mineiros.io/github-as-code][github-as-code].
6663

6764
## Module Features
6865

6966
In contrast to the plain `github_repository` resource this module enables various other
7067
features like Branch Protection or Collaborator Management.
71-
7268
- **Default Security Settings**:
7369
This module creates a `private` repository by default,
7470
Deploy keys are `read-only` by default
75-
7671
- **Standard Repository Features**:
7772
Setting basic Metadata,
7873
Merge Strategy,
7974
Auto Init,
8075
License Template,
8176
Gitignore Template,
8277
Template Repository
83-
8478
- **Extended Repository Features**:
8579
Branches,
8680
Branch Protection,
@@ -91,7 +85,6 @@ features like Branch Protection or Collaborator Management.
9185
Deploy Keys,
9286
Projects,
9387
Repository Webhooks
94-
9588
- _Features not yet implemented_:
9689
Project Columns support,
9790
Actions,
@@ -100,12 +93,10 @@ features like Branch Protection or Collaborator Management.
10093
## Getting Started
10194

10295
Most basic usage creating a new private github repository.
103-
10496
```hcl
10597
module "repository" {
10698
source = "mineiros-io/repository/github"
10799
version = "~> 0.18.0"
108-
109100
name = "terraform-github-repository"
110101
license_template = "apache-2.0"
111102
gitignore_template = "Terraform"
@@ -616,12 +607,9 @@ This is due to some terraform limitation and we will update the module once terr
616607
- [**`branch_protections_v4`**](#var-branch_protections_v4): *(Optional `list(branch_protection_v4)`)*<a name="var-branch_protections_v4"></a>
617608

618609
This resource allows you to configure v4 branch protection for repositories in your organization.
619-
620610
Each element in the list is a branch to be protected and the value the corresponding to the desired configuration for the branch.
621-
622611
When applied, the branch will be protected from forced pushes and deletion.
623612
Additional constraints, such as required status checks or restrictions on users and teams, can also be configured.
624-
625613
**_NOTE:_** May conflict with v3 branch protections if used for the same branch.
626614

627615
Default is `[]`.
@@ -749,6 +737,35 @@ This is due to some terraform limitation and we will update the module once terr
749737

750738
Default is `[]`.
751739

740+
#### Security And Analysis Configuration
741+
742+
- [**`security_and_analysis`**](#var-security_and_analysis): *(Optional `object(security_and_analysis)`)*<a name="var-security_and_analysis"></a>
743+
744+
(Optional) The repository's [security and analysis](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) configuration.
745+
See [Security and Analysis Configuration](#security-and-analysis-configuration) below for details.
746+
747+
Default is `{}`.
748+
749+
The `security_and_analysis` object accepts the following attributes:
750+
751+
- [**`advanced_security`**](#attr-security_and_analysis-advanced_security): *(**Required** `string`)*<a name="attr-security_and_analysis-advanced_security"></a>
752+
753+
The advanced security configuration for the repository. See [Advanced Security Configuration](#advanced-security-configuration) below for details.
754+
755+
Default is `"disabled"`.
756+
757+
- [**`secret_scanning`**](#attr-security_and_analysis-secret_scanning): *(**Required** `string`)*<a name="attr-security_and_analysis-secret_scanning"></a>
758+
759+
The secret scanning configuration for the repository. See [Secret Scanning Configuration](#secret-scanning-configuration) below for details.
760+
761+
Default is `"disabled"`.
762+
763+
- [**`secret_scanning_push_protection`**](#attr-security_and_analysis-secret_scanning_push_protection): *(**Required** `string`)*<a name="attr-security_and_analysis-secret_scanning_push_protection"></a>
764+
765+
The secret scanning push protection configuration for the repository. See [Secret Scanning Push Protection Configuration](#secret-scanning-push-protection-configuration) below for details.
766+
767+
Default is `"disabled"`.
768+
752769
#### Issue Labels Configuration
753770

754771
- [**`issue_labels`**](#var-issue_labels): *(Optional `list(issue_label)`)*<a name="var-issue_labels"></a>
@@ -859,13 +876,9 @@ This is due to some terraform limitation and we will update the module once terr
859876
- [**`plaintext_secrets`**](#var-plaintext_secrets): *(Optional `map(string)`)*<a name="var-plaintext_secrets"></a>
860877

861878
This map allows you to create and manage secrets for repositories in your organization.
862-
863879
Each element in the map is considered a secret to be managed, being the key map the secret name and the value the corresponding secret in plain text:
864-
865880
When applied, a secret with the given key and value will be created in the repositories.
866-
867881
The value of the secrets must be given in plain text, GitHub provider is in charge of encrypting it.
868-
869882
**Attention:** You should treat state as sensitive always. It is also advised that you do not store plaintext values in your code but rather populate the encrypted_value using fields from a resource, data source or variable as, while encrypted in state, these will be easily accessible in your code. See below for an example of this abstraction.
870883

871884
Default is `{}`.
@@ -882,9 +895,7 @@ This is due to some terraform limitation and we will update the module once terr
882895
- [**`encrypted_secrets`**](#var-encrypted_secrets): *(Optional `map(string)`)*<a name="var-encrypted_secrets"></a>
883896

884897
This map allows you to create and manage encrypted secrets for repositories in your organization.
885-
886898
Each element in the map is considered a secret to be managed, being the key map the secret name and the value the corresponding encrypted value of the secret using the Github public key in Base64 format.b
887-
888899
When applied, a secret with the given key and value will be created in the repositories.
889900

890901
Default is `{}`.
@@ -1033,9 +1044,7 @@ The following attributes are exported by the module:
10331044
## Module Versioning
10341045

10351046
This Module follows the principles of [Semantic Versioning (SemVer)].
1036-
10371047
Given a version number `MAJOR.MINOR.PATCH`, we increment the:
1038-
10391048
1. `MAJOR` version when we make incompatible changes,
10401049
2. `MINOR` version when we add functionality in a backwards compatible manner, and
10411050
3. `PATCH` version when we make backwards compatible bug fixes.
@@ -1049,10 +1058,8 @@ Given a version number `MAJOR.MINOR.PATCH`, we increment the:
10491058

10501059
[Mineiros][homepage] is a remote-first company headquartered in Berlin, Germany
10511060
that solves development, automation and security challenges in cloud infrastructure.
1052-
10531061
Our vision is to massively reduce time and overhead for teams to manage and
10541062
deploy production-grade and secure cloud infrastructure.
1055-
10561063
We offer commercial support for all of our modules and encourage you to reach out
10571064
if you have any questions or need help. Feel free to email us at [[email protected]] or join our
10581065
[Community Slack channel][slack].
@@ -1074,10 +1081,8 @@ Run `make help` to see details on each available target.
10741081
## License
10751082

10761083
[![license][badge-license]][apache20]
1077-
10781084
This module is licensed under the Apache License Version 2.0, January 2004.
10791085
Please see [LICENSE] for full details.
1080-
10811086
Copyright &copy; 2020-2022 [Mineiros GmbH][homepage]
10821087

10831088

README.tfdoc.hcl

Lines changed: 42 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,8 @@ section {
3838
toc = true
3939
content = <<-END
4040
A [Terraform] module for creating a public or private repository on [Github].
41-
4241
**_This module supports Terraform v1.x and is compatible with the Official Terraform GitHub Provider v4.20 and above from `integrations/github`._**
43-
4442
**Attention: This module is incompatible with the Hashicorp GitHub Provider! The latest version of this module supporting `hashicorp/github` provider is `~> 0.10.0`**
45-
4643
** Note: Versions 5.3.0, 5.4.0, and 5.5.0 of the Terraform Github Provider have broken branch protections support and should not be used.**
4744
END
4845

@@ -60,7 +57,6 @@ section {
6057
maintained by our team of platform engineering experts and saves
6158
companies such as yours tons of time by building on top of a pre-configured
6259
solution instead of building and maintaining it yourself.
63-
6460
For details please see [https://mineiros.io/github-as-code][github-as-code].
6561
END
6662
}
@@ -70,19 +66,16 @@ section {
7066
content = <<-END
7167
In contrast to the plain `github_repository` resource this module enables various other
7268
features like Branch Protection or Collaborator Management.
73-
7469
- **Default Security Settings**:
7570
This module creates a `private` repository by default,
7671
Deploy keys are `read-only` by default
77-
7872
- **Standard Repository Features**:
7973
Setting basic Metadata,
8074
Merge Strategy,
8175
Auto Init,
8276
License Template,
8377
Gitignore Template,
8478
Template Repository
85-
8679
- **Extended Repository Features**:
8780
Branches,
8881
Branch Protection,
@@ -93,7 +86,6 @@ section {
9386
Deploy Keys,
9487
Projects,
9588
Repository Webhooks
96-
9789
- _Features not yet implemented_:
9890
Project Columns support,
9991
Actions,
@@ -105,12 +97,10 @@ section {
10597
title = "Getting Started"
10698
content = <<-END
10799
Most basic usage creating a new private github repository.
108-
109100
```hcl
110101
module "repository" {
111102
source = "mineiros-io/repository/github"
112103
version = "~> 0.18.0"
113-
114104
name = "terraform-github-repository"
115105
license_template = "apache-2.0"
116106
gitignore_template = "Terraform"
@@ -796,12 +786,9 @@ section {
796786
default = []
797787
description = <<-END
798788
This resource allows you to configure v4 branch protection for repositories in your organization.
799-
800789
Each element in the list is a branch to be protected and the value the corresponding to the desired configuration for the branch.
801-
802790
When applied, the branch will be protected from forced pushes and deletion.
803791
Additional constraints, such as required status checks or restrictions on users and teams, can also be configured.
804-
805792
**_NOTE:_** May conflict with v3 branch protections if used for the same branch.
806793
END
807794

@@ -970,6 +957,47 @@ section {
970957
}
971958
}
972959

960+
section {
961+
title = "Security And Analysis Configuration"
962+
963+
variable "security_and_analysis" {
964+
type = object(security_and_analysis)
965+
default = {}
966+
description = <<-END
967+
(Optional) The repository's [security and analysis](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) configuration.
968+
See [Security and Analysis Configuration](#security-and-analysis-configuration) below for details.
969+
END
970+
971+
attribute "advanced_security" {
972+
type = string
973+
required = true
974+
default = "disabled"
975+
description = <<-END
976+
The advanced security configuration for the repository. See [Advanced Security Configuration](#advanced-security-configuration) below for details.
977+
END
978+
}
979+
980+
attribute "secret_scanning" {
981+
type = string
982+
required = true
983+
default = "disabled"
984+
description = <<-END
985+
The secret scanning configuration for the repository. See [Secret Scanning Configuration](#secret-scanning-configuration) below for details.
986+
END
987+
}
988+
989+
attribute "secret_scanning_push_protection" {
990+
type = string
991+
required = true
992+
default = "disabled"
993+
description = <<-END
994+
The secret scanning push protection configuration for the repository. See [Secret Scanning Push Protection Configuration](#secret-scanning-push-protection-configuration) below for details.
995+
END
996+
}
997+
998+
}
999+
}
1000+
9731001
section {
9741002
title = "Issue Labels Configuration"
9751003

@@ -1134,13 +1162,9 @@ section {
11341162
default = {}
11351163
description = <<-END
11361164
This map allows you to create and manage secrets for repositories in your organization.
1137-
11381165
Each element in the map is considered a secret to be managed, being the key map the secret name and the value the corresponding secret in plain text:
1139-
11401166
When applied, a secret with the given key and value will be created in the repositories.
1141-
11421167
The value of the secrets must be given in plain text, GitHub provider is in charge of encrypting it.
1143-
11441168
**Attention:** You should treat state as sensitive always. It is also advised that you do not store plaintext values in your code but rather populate the encrypted_value using fields from a resource, data source or variable as, while encrypted in state, these will be easily accessible in your code. See below for an example of this abstraction.
11451169
END
11461170

@@ -1157,9 +1181,7 @@ section {
11571181
default = {}
11581182
description = <<-END
11591183
This map allows you to create and manage encrypted secrets for repositories in your organization.
1160-
11611184
Each element in the map is considered a secret to be managed, being the key map the secret name and the value the corresponding encrypted value of the secret using the Github public key in Base64 format.b
1162-
11631185
When applied, a secret with the given key and value will be created in the repositories.
11641186
END
11651187

@@ -1379,9 +1401,7 @@ section {
13791401
title = "Module Versioning"
13801402
content = <<-END
13811403
This Module follows the principles of [Semantic Versioning (SemVer)].
1382-
13831404
Given a version number `MAJOR.MINOR.PATCH`, we increment the:
1384-
13851405
1. `MAJOR` version when we make incompatible changes,
13861406
2. `MINOR` version when we add functionality in a backwards compatible manner, and
13871407
3. `PATCH` version when we make backwards compatible bug fixes.
@@ -1401,10 +1421,8 @@ section {
14011421
content = <<-END
14021422
[Mineiros][homepage] is a remote-first company headquartered in Berlin, Germany
14031423
that solves development, automation and security challenges in cloud infrastructure.
1404-
14051424
Our vision is to massively reduce time and overhead for teams to manage and
14061425
deploy production-grade and secure cloud infrastructure.
1407-
14081426
We offer commercial support for all of our modules and encourage you to reach out
14091427
if you have any questions or need help. Feel free to email us at [[email protected]] or join our
14101428
[Community Slack channel][slack].
@@ -1438,10 +1456,8 @@ section {
14381456
title = "License"
14391457
content = <<-END
14401458
[![license][badge-license]][apache20]
1441-
14421459
This module is licensed under the Apache License Version 2.0, January 2004.
14431460
Please see [LICENSE] for full details.
1444-
14451461
Copyright &copy; 2020-2022 [Mineiros GmbH][homepage]
14461462
END
14471463
}
@@ -1541,4 +1557,4 @@ references {
15411557
ref "contribution guidelines" {
15421558
value = "https://github.com/mineiros-io/terraform-github-repository/blob/main/CONTRIBUTING.md"
15431559
}
1544-
}
1560+
}

go.sum

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,6 @@ golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8U
379379
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
380380
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
381381
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
382-
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586 h1:7KByu05hhLed2MO29w7p1XfZvZ13m8mub3shuVftRs0=
383382
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
384383
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
385384
golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -424,12 +423,10 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR
424423
golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
425424
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
426425
golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
427-
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA=
428426
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
429427
golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
430428
golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
431429
golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
432-
golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553 h1:efeOvDhwQ29Dj3SdAV/MJf8oukgn+8D8WgaCaRMchF8=
433430
golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
434431
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
435432
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
@@ -579,7 +576,6 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWD
579576
gopkg.in/warnings.v0 v0.1.1/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
580577
gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
581578
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
582-
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
583579
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
584580
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
585581
gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=

0 commit comments

Comments
 (0)