Skip to content

Conversation

stricklerxc
Copy link

@stricklerxc stricklerxc commented Jul 11, 2025

Resolves #2556


Before the change?

  • required_code_scanning blocks would not persist in terraform state leading to a permadiff
  • in the terraform state file, the rules[].required_code_scanning entry would be null even though code scanning was configured on the ruleset. For example:
Example

ruleset.tf

  rules {
    required_code_scanning {
      required_code_scanning_tool {
        alerts_threshold          = "errors_and_warnings"
        security_alerts_threshold = "high_or_higher"
        tool                      = "Scorecard"
      }
    }
  }

terraform.tfstate

{
  "version": 4,
  "terraform_version": "1.12.2",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "github_organization_ruleset",
      "name": "example",
      "provider": "provider[\"registry.terraform.io/integrations/github\"]",
      "instances": [
        {
          "rules": [
            {
              "required_code_scanning": null
            }
          ]
        }
      ]
    }
  ]
}

After the change?

  • required_code_scanning blocks persist in the terraform state. Subsequent executions of terraform plan without any changes do not lead to a diff.
  • in the terraform state file, the rules[].required_code_scanning is properly populated with the code scanning information. For example:
Example

ruleset.tf

  rules {
    required_code_scanning {
      required_code_scanning_tool {
        alerts_threshold          = "errors_and_warnings"
        security_alerts_threshold = "high_or_higher"
        tool                      = "Scorecard"
      }
    }
  }

terraform.tfstate

{
  "version": 4,
  "terraform_version": "1.12.2",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "github_organization_ruleset",
      "name": "example",
      "provider": "provider[\"registry.terraform.io/integrations/github\"]",
      "instances": [
        {
          "rules": [
            {
              "required_code_scanning": [
                {
                  "required_code_scanning_tool": [
                    {
                      "alerts_threshold": "errors_and_warnings",
                      "security_alerts_threshold": "high_or_higher",
                      "tool": "Scorecard"
                    }
                  ]
                }
              ],
            }
          ]
        }
      ]
    }
  ]
}

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@stricklerxc stricklerxc force-pushed the fix/code-scanning-state branch from d609a26 to df3ad10 Compare July 11, 2025 22:54
@stricklerxc stricklerxc marked this pull request as ready for review July 11, 2025 22:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Backlog

Development

Successfully merging this pull request may close these issues.

[BUG]: Plan incorrectly proposes change for repository ruleset code scanning results

1 participant