diff --git a/modules/repository/README.md b/modules/repository/README.md index e8ecb6f..4c1ce48 100644 --- a/modules/repository/README.md +++ b/modules/repository/README.md @@ -3,6 +3,7 @@ This module creates following resources. - `github_repository` +- `github_repository_vulnerability_alerts` - `github_repository_collaborator` (optional) - `github_repository_collaborators` (optional) - `github_repository_custom_property` (optional) @@ -49,6 +50,7 @@ This module creates following resources. | [github_repository_deploy_key.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_deploy_key) | resource | | [github_repository_file.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource | | [github_repository_topics.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_topics) | resource | +| [github_repository_vulnerability_alerts.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_vulnerability_alerts) | resource | | [github_team_repository.this](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository) | resource | ## Inputs @@ -66,7 +68,7 @@ This module creates following resources. | [deploy\_keys](#input\_deploy\_keys) | (Optional) A list of deploy keys to grant access to the repository. A deploy key is a SSH key. Each item of `deploy_keys` block as defined below.
(Optional) `name` - A name of deploy key.
(Required) `key` - A SSH key. Begins with 'ssh-rsa', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519', 'sk-ecdsa-sha2-nistp256@openssh.com', or 'sk-ssh-ed25519@openssh.com'.
(Optional) `writable` - Whether to allow write access to the repository. The key can be used to push to the repository if enabled. Defaults to `false`. | 
list(object({
    name     = optional(string)
    key      = string
    writable = optional(bool, false)
  }))
| `[]` | no | | [description](#input\_description) | (Optional) A description of the repository. | `string` | `"Managed by Terraform."` | no | | [environments](#input\_environments) | (Optional) A list of environments for the repository. Each item of `environments` block as defined below.
(Required) `name` - The name of the environment.
(Optional) `wait_timer` - The amount of time in minutes to wait before allowing deployments to proceed. The default value is `0`.
(Optional) `allow_admin_to_bypass` - Whether to allow admins to bypass the wait timer and deployment review. The default value is `true`.
(Optional) `allow_self_approval` - Whether to allow users to approve their own deployment. The default value is `false`.
(Optional) `reviewers` - A list of reviewers who may review jobs that reference the environment. Each item of `reviewers` block as defined below.
(Required) `type` - The type of the reviewer. Valid values are `USER` or `TEAM`.
(Required) `name` - The name of the reviewer. For a user reviewer, the value should be the user's username. For a team reviewer, the value should be the team's slug.
(Optional) `deployment_policy` - A configuration for deployment policy of the environment. `deployment_policy` block as defined below.
(Optional) `restriction` - The type of deployment restriction. Valid values are `NONE`, `PROTECTED_BRANCH`, or `CUSTOM`. Defaults to `NONE`.
(Optional) `branches` - A set of branch name patterns to restrict deployments to when the restriction type is `CUSTOM`.
(Optional) `tags` - A set of tag name patterns to restrict deployments to when the restriction type is `CUSTOM`.
(Optional) `variables` - A map of GitHub Actions variables to set for the environment. Defaults to `{}`.
(Optional) `secrets` - A map of GitHub Actions secrets to set for the environment. Defaults to `{}`. | 
list(object({
    name                  = string
    wait_timer            = optional(number, 0)
    allow_admin_to_bypass = optional(bool, true)
    allow_self_approval   = optional(bool, false)

    reviewers = optional(list(object({
      type = string
      name = string
    })), [])
    deployment_policy = optional(object({
      restriction = optional(string, "NONE")
      branches    = optional(set(string), [])
      tags        = optional(set(string), [])
    }), {})

    variables = optional(map(string), {})
    secrets   = optional(map(string), {})
  }))
| `[]` | no | -| [features](#input\_features) | (Optional) A list of enabled features on the repository. Available features: `DISCUSSIONS`, `ISSUES`, `PROJECTS`, `WIKI`. Defaults to `["ISSUES"]` | `set(string)` | 
[
  "ISSUES"
]
| no | +| [features](#input\_features) | (Optional) A list of enabled features on the repository. Available features: `DEPENDABOT_ALERTS`, `DISCUSSIONS`, `ISSUES`, `PROJECTS`, `WIKI`. `DEPENDABOT_ALERTS` enables Dependabot alerts for vulnerable dependencies. Defaults to `["ISSUES"]` | `set(string)` | 
[
  "ISSUES"
]
| no | | [files](#input\_files) | (Optional) A list of files to create and manage within the repository. Each item of `files` block as defined below.
(Required) `file` - A `file` block as defined below.
(Required) `path` - The path of the file to manage.
(Required) `content` - The file content.
(Optional) `commit` - A `commit` block as defined below.
(Optional) `author` - Committer author name to use. NOTE: GitHub app users may omit author and email information so GitHub can verify commits as the GitHub App. This maybe useful when a branch protection rule requires signed commits.
(Optional) `email` - Committer email address to use. NOTE: GitHub app users may omit author and email information so GitHub can verify commits as the GitHub App. This may be useful when a branch protection rule requires signed commits.
(Optional) `message` - The commit message when creating, updating or deleting the managed file. Defaults to `chore: managed by Terraform.`.
(Optional) `overwrite_on_create` - Enable overwriting existing files. If set to true it will overwrite an existing file with the same name. If set to false it will fail if there is an existing file with the same name. Defaults to `true`. | 
list(object({
    file = object({
      path    = string
      content = string
    })
    commit = optional(object({
      author  = optional(string)
      email   = optional(string)
      message = optional(string, "chore: managed by Terraform.")
    }), {})
    overwrite_on_create = optional(bool, true)
  }))
| `[]` | no | | [homepage](#input\_homepage) | (Optional) A URL of website describing the repository. | `string` | `""` | no | | [is\_template](#input\_is\_template) | (Optional) Whether this is a template repository. Defaults to `false`. | `bool` | `false` | no | @@ -76,7 +78,6 @@ This module creates following resources. | [template](#input\_template) | (Optional) Use a template repository, license or gitignore to create the repository.this resource. `template` block as defined below.
(Optional) `gitignore` - Choose which files not to track from a list of templates. Use the name of the template without the extension. For example, `Haskell`.
(Optional) `init_readme` - Whether to produce an initial commit with README.md in the repository. Defaults to `false`.
(Optional) `license` - A license tells others what they can and can't do with your code. Use the name of the license template without the extension. For example, `mit` or `mpl-2.0`.
(Optional) `repository` - Start this repository with a template repository's contents. The full name of the repository is required. A string of the form `owner/repository`. | 
object({
    gitignore   = optional(string)
    init_readme = optional(bool, false)
    license     = optional(string)
    repository  = optional(string)
  })
| `{}` | no | | [topics](#input\_topics) | (Optional) A list of topics for the repository. | `set(string)` | `[]` | no | | [visibility](#input\_visibility) | (Optional) Can be `public`, `private` or `internal`. `internal` visibility is only available if your organization is associated with an enterprise account using GitHub Enterprise Cloud or GitHub Enterprise Server 2.20+. | `string` | `"private"` | no | -| [vulnerability\_alerts](#input\_vulnerability\_alerts) | (Optional) Set to true to enable security alerts for vulnerable dependencies. Enabling requires alerts to be enabled on the owner level. GitHub enables the alerts on public repos but disables them on private repos by default. | `bool` | `false` | no | ## Outputs @@ -109,5 +110,4 @@ This module creates following resources. | [topics](#output\_topics) | A list of topics for the repository. | | [url](#output\_url) | The URL of the repository. | | [visibility](#output\_visibility) | The visibility of the repository. Can be `public`, `private` or `internal`. | -| [vulnerability\_alerts](#output\_vulnerability\_alerts) | Whether the security alerts are enabled for vulnerable dpendencies. | diff --git a/modules/repository/main.tf b/modules/repository/main.tf index c21506d..88341c1 100644 --- a/modules/repository/main.tf +++ b/modules/repository/main.tf @@ -19,6 +19,7 @@ locals { # INFO: Use a separate resource # - `topics` # - `default_branch` +# - `vulnerability_alerts` resource "github_repository" "this" { name = var.name description = var.description @@ -28,8 +29,6 @@ resource "github_repository" "this" { archived = var.archived archive_on_destroy = var.archive_on_destroy - vulnerability_alerts = var.vulnerability_alerts - ## Template is_template = var.is_template @@ -107,6 +106,16 @@ resource "github_repository" "this" { } +################################################### +# Vulnerability Alerts for GitHub Repository +################################################### + +resource "github_repository_vulnerability_alerts" "this" { + repository = github_repository.this.name + enabled = contains(var.features, "DEPENDABOT_ALERTS") +} + + ################################################### # Custom Properties for GitHub Repository ################################################### diff --git a/modules/repository/outputs.tf b/modules/repository/outputs.tf index dcdda43..4e63e8d 100644 --- a/modules/repository/outputs.tf +++ b/modules/repository/outputs.tf @@ -170,11 +170,6 @@ output "files" { } } -output "vulnerability_alerts" { - description = "Whether the security alerts are enabled for vulnerable dpendencies." - value = github_repository.this.vulnerability_alerts -} - output "deploy_keys" { description = "A map of deploy keys granted access to the repository." value = { diff --git a/modules/repository/variables.tf b/modules/repository/variables.tf index e6ec056..b1812d8 100644 --- a/modules/repository/variables.tf +++ b/modules/repository/variables.tf @@ -68,7 +68,7 @@ variable "template" { variable "features" { description = <