Skip to content

Commit fefa5b4

Browse files
threeseedthreeseed
authored
Added encrypted_value to Actions + Organizations's secrets (#807)
* Added encrypted_value to Actions + Organizations's secrets * Simplified unit tests * Encrypted value needs to be in Base64 format * Delete data_source_github_repository_branches.go
1 parent 4f7109e commit fefa5b4

6 files changed

+140
-58
lines changed

‎github/resource_github_actions_organization_secret.go‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99

1010
"github.com/google/go-github/v35/github"
1111
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
12+
"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
1213
)
1314

1415
func resourceGithubActionsOrganizationSecret() *schema.Resource {
@@ -31,11 +32,20 @@ func resourceGithubActionsOrganizationSecret() *schema.Resource {
3132
ForceNew: true,
3233
ValidateFunc: validateSecretNameFunc,
3334
},
35+
"encrypted_value": {
36+
Type: schema.TypeString,
37+
ForceNew: true,
38+
Optional: true,
39+
Sensitive: true,
40+
ConflictsWith: []string{"plaintext_value"},
41+
ValidateFunc: validation.StringIsBase64,
42+
},
3443
"plaintext_value": {
35-
Type: schema.TypeString,
36-
Required: true,
37-
ForceNew: true,
38-
Sensitive: true,
44+
Type: schema.TypeString,
45+
ForceNew: true,
46+
Optional: true,
47+
Sensitive: true,
48+
ConflictsWith: []string{"encrypted_value"},
3949
},
4050
"visibility": {
4151
Type: schema.TypeString,
@@ -70,6 +80,7 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
7080

7181
secretName := d.Get("secret_name").(string)
7282
plaintextValue := d.Get("plaintext_value").(string)
83+
var encryptedValue string
7384

7485
visibility := d.Get("visibility").(string)
7586
selectedRepositories, hasSelectedRepositories := d.GetOk("selected_repository_ids")
@@ -95,9 +106,14 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
95106
return err
96107
}
97108

98-
encryptedText, err := encryptPlaintext(plaintextValue, publicKey)
99-
if err != nil {
100-
return err
109+
if encryptedText, ok := d.GetOk("encrypted_value"); ok {
110+
encryptedValue = encryptedText.(string)
111+
} else {
112+
encryptedBytes, err := encryptPlaintext(plaintextValue, publicKey)
113+
if err != nil {
114+
return err
115+
}
116+
encryptedValue = base64.StdEncoding.EncodeToString(encryptedBytes)
101117
}
102118

103119
// Create an EncryptedSecret and encrypt the plaintext value into it
@@ -106,7 +122,7 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
106122
KeyID: keyId,
107123
Visibility: visibility,
108124
SelectedRepositoryIDs: selectedRepositoryIDs,
109-
EncryptedValue: base64.StdEncoding.EncodeToString(encryptedText),
125+
EncryptedValue: encryptedValue,
110126
}
111127

112128
_, err = client.Actions.CreateOrUpdateOrgSecret(ctx, owner, eSecret)
@@ -136,6 +152,7 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta in
136152
return err
137153
}
138154

155+
d.Set("encrypted_value", d.Get("encrypted_value"))
139156
d.Set("plaintext_value", d.Get("plaintext_value"))
140157
d.Set("created_at", secret.CreatedAt.String())
141158
d.Set("visibility", secret.Visibility)

‎github/resource_github_actions_organization_secret_test.go‎

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -14,36 +14,50 @@ func TestAccGithubActionsOrganizationSecret(t *testing.T) {
1414
updatedSecretValue := "updated_super_secret_value"
1515

1616
config := fmt.Sprintf(`
17-
resource "github_actions_organization_secret" "test_secret" {
18-
secret_name = "test_secret_name"
17+
resource "github_actions_organization_secret" "plaintext_secret" {
18+
secret_name = "test_plaintext_secret"
1919
plaintext_value = "%s"
2020
visibility = "private"
2121
}
22-
`, secretValue)
22+
23+
resource "github_actions_organization_secret" "encrypted_secret" {
24+
secret_name = "test_encrypted_secret"
25+
encrypted_value = "%s"
26+
visibility = "private"
27+
}
28+
`, secretValue, secretValue)
2329

2430
checks := map[string]resource.TestCheckFunc{
2531
"before": resource.ComposeTestCheckFunc(
2632
resource.TestCheckResourceAttr(
27-
"github_actions_organization_secret.test_secret", "plaintext_value",
33+
"github_actions_organization_secret.plaintext_secret", "plaintext_value",
34+
secretValue,
35+
),
36+
resource.TestCheckResourceAttr(
37+
"github_actions_organization_secret.encrypted_secret", "encrypted_value",
2838
secretValue,
2939
),
3040
resource.TestCheckResourceAttrSet(
31-
"github_actions_organization_secret.test_secret", "created_at",
41+
"github_actions_organization_secret.plaintext_secret", "created_at",
3242
),
3343
resource.TestCheckResourceAttrSet(
34-
"github_actions_organization_secret.test_secret", "updated_at",
44+
"github_actions_organization_secret.plaintext_secret", "updated_at",
3545
),
3646
),
3747
"after": resource.ComposeTestCheckFunc(
3848
resource.TestCheckResourceAttr(
39-
"github_actions_organization_secret.test_secret", "plaintext_value",
49+
"github_actions_organization_secret.plaintext_secret", "plaintext_value",
50+
updatedSecretValue,
51+
),
52+
resource.TestCheckResourceAttr(
53+
"github_actions_organization_secret.encrypted_secret", "encrypted_value",
4054
updatedSecretValue,
4155
),
4256
resource.TestCheckResourceAttrSet(
43-
"github_actions_organization_secret.test_secret", "created_at",
57+
"github_actions_organization_secret.plaintext_secret", "created_at",
4458
),
4559
resource.TestCheckResourceAttrSet(
46-
"github_actions_organization_secret.test_secret", "updated_at",
60+
"github_actions_organization_secret.plaintext_secret", "updated_at",
4761
),
4862
),
4963
}
@@ -60,7 +74,7 @@ func TestAccGithubActionsOrganizationSecret(t *testing.T) {
6074
{
6175
Config: strings.Replace(config,
6276
secretValue,
63-
updatedSecretValue, 1),
77+
updatedSecretValue, 2),
6478
Check: checks["after"],
6579
},
6680
},
@@ -81,15 +95,17 @@ func TestAccGithubActionsOrganizationSecret(t *testing.T) {
8195
})
8296

8397
t.Run("deletes secrets without error", func(t *testing.T) {
84-
secretValue := "super_secret_value"
98+
config := `
99+
resource "github_actions_organization_secret" "plaintext_secret" {
100+
secret_name = "test_plaintext_secret"
101+
visibility = "private"
102+
}
85103
86-
config := fmt.Sprintf(`
87-
resource "github_actions_organization_secret" "test_secret" {
88-
secret_name = "test_secret_name"
89-
plaintext_value = "%s"
104+
resource "github_actions_organization_secret" "encrypted_secret" {
105+
secret_name = "test_encrypted_secret"
90106
visibility = "private"
91107
}
92-
`, secretValue)
108+
`
93109

94110
testCase := func(t *testing.T, mode string) {
95111
resource.Test(t, resource.TestCase{
@@ -122,7 +138,7 @@ func TestAccGithubActionsOrganizationSecret(t *testing.T) {
122138

123139
config := fmt.Sprintf(`
124140
resource "github_actions_organization_secret" "test_secret" {
125-
secret_name = "test_secret_name"
141+
secret_name = "test_plaintext_secret"
126142
plaintext_value = "%s"
127143
visibility = "private"
128144
}

‎github/resource_github_actions_secret.go‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,19 @@ func resourceGithubActionsSecret() *schema.Resource {
3030
ForceNew: true,
3131
ValidateFunc: validateSecretNameFunc,
3232
},
33+
"encrypted_value": {
34+
Type: schema.TypeString,
35+
ForceNew: true,
36+
Optional: true,
37+
Sensitive: true,
38+
ConflictsWith: []string{"plaintext_value"},
39+
},
3340
"plaintext_value": {
34-
Type: schema.TypeString,
35-
Required: true,
36-
Sensitive: true,
41+
Type: schema.TypeString,
42+
ForceNew: true,
43+
Optional: true,
44+
Sensitive: true,
45+
ConflictsWith: []string{"encrypted_value"},
3746
},
3847
"created_at": {
3948
Type: schema.TypeString,
@@ -55,22 +64,28 @@ func resourceGithubActionsSecretCreateOrUpdate(d *schema.ResourceData, meta inte
5564
repo := d.Get("repository").(string)
5665
secretName := d.Get("secret_name").(string)
5766
plaintextValue := d.Get("plaintext_value").(string)
67+
var encryptedValue string
5868

5969
keyId, publicKey, err := getPublicKeyDetails(owner, repo, meta)
6070
if err != nil {
6171
return err
6272
}
6373

64-
encryptedText, err := encryptPlaintext(plaintextValue, publicKey)
65-
if err != nil {
66-
return err
74+
if encryptedText, ok := d.GetOk("encrypted_value"); ok {
75+
encryptedValue = encryptedText.(string)
76+
} else {
77+
encryptedBytes, err := encryptPlaintext(plaintextValue, publicKey)
78+
if err != nil {
79+
return err
80+
}
81+
encryptedValue = base64.StdEncoding.EncodeToString(encryptedBytes)
6782
}
6883

6984
// Create an EncryptedSecret and encrypt the plaintext value into it
7085
eSecret := &github.EncryptedSecret{
7186
Name: secretName,
7287
KeyID: keyId,
73-
EncryptedValue: base64.StdEncoding.EncodeToString(encryptedText),
88+
EncryptedValue: encryptedValue,
7489
}
7590

7691
_, err = client.Actions.CreateOrUpdateRepoSecret(ctx, owner, repo, eSecret)
@@ -105,6 +120,7 @@ func resourceGithubActionsSecretRead(d *schema.ResourceData, meta interface{}) e
105120
return err
106121
}
107122

123+
d.Set("encrypted_value", d.Get("encrypted_value"))
108124
d.Set("plaintext_value", d.Get("plaintext_value"))
109125
d.Set("created_at", secret.CreatedAt.String())
110126

‎github/resource_github_actions_secret_test.go‎

Lines changed: 33 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -74,36 +74,50 @@ func TestAccGithubActionsSecret(t *testing.T) {
7474
name = "tf-acc-test-%s"
7575
}
7676
77-
resource "github_actions_secret" "test_secret" {
77+
resource "github_actions_secret" "plaintext_secret" {
7878
repository = github_repository.test.name
79-
secret_name = "test_secret_name"
79+
secret_name = "test_plaintext_secret"
8080
plaintext_value = "%s"
8181
}
82-
`, randomID, secretValue)
82+
83+
resource "github_actions_secret" "encrypted_secret" {
84+
repository = github_repository.test.name
85+
secret_name = "test_encrypted_secret"
86+
encrypted_value = "%s"
87+
}
88+
`, randomID, secretValue, secretValue)
8389

8490
checks := map[string]resource.TestCheckFunc{
8591
"before": resource.ComposeTestCheckFunc(
8692
resource.TestCheckResourceAttr(
87-
"github_actions_secret.test_secret", "plaintext_value",
93+
"github_actions_secret.plaintext_secret", "plaintext_value",
94+
secretValue,
95+
),
96+
resource.TestCheckResourceAttr(
97+
"github_actions_secret.encrypted_secret", "encrypted_value",
8898
secretValue,
8999
),
90100
resource.TestCheckResourceAttrSet(
91-
"github_actions_secret.test_secret", "created_at",
101+
"github_actions_secret.plaintext_secret", "created_at",
92102
),
93103
resource.TestCheckResourceAttrSet(
94-
"github_actions_secret.test_secret", "updated_at",
104+
"github_actions_secret.plaintext_secret", "updated_at",
95105
),
96106
),
97107
"after": resource.ComposeTestCheckFunc(
98108
resource.TestCheckResourceAttr(
99-
"github_actions_secret.test_secret", "plaintext_value",
109+
"github_actions_secret.plaintext_secret", "plaintext_value",
110+
updatedSecretValue,
111+
),
112+
resource.TestCheckResourceAttr(
113+
"github_actions_secret.encrypted_secret", "encrypted_value",
100114
updatedSecretValue,
101115
),
102116
resource.TestCheckResourceAttrSet(
103-
"github_actions_secret.test_secret", "created_at",
117+
"github_actions_secret.plaintext_secret", "created_at",
104118
),
105119
resource.TestCheckResourceAttrSet(
106-
"github_actions_secret.test_secret", "updated_at",
120+
"github_actions_secret.plaintext_secret", "updated_at",
107121
),
108122
),
109123
}
@@ -120,7 +134,7 @@ func TestAccGithubActionsSecret(t *testing.T) {
120134
{
121135
Config: strings.Replace(config,
122136
secretValue,
123-
updatedSecretValue, 1),
137+
updatedSecretValue, 2),
124138
Check: checks["after"],
125139
},
126140
},
@@ -138,24 +152,24 @@ func TestAccGithubActionsSecret(t *testing.T) {
138152
t.Run("with an organization account", func(t *testing.T) {
139153
testCase(t, organization)
140154
})
141-
142155
})
143156

144157
t.Run("deletes secrets without error", func(t *testing.T) {
145-
146-
secretValue := "super_secret_value"
147-
148158
config := fmt.Sprintf(`
149159
resource "github_repository" "test" {
150160
name = "tf-acc-test-%s"
151161
}
152162
153-
resource "github_actions_secret" "test_secret" {
154-
repository = github_repository.test.name
155-
secret_name = "test_secret_name"
156-
plaintext_value = "%s"
163+
resource "github_actions_secret" "plaintext_secret" {
164+
repository = github_repository.test.name
165+
secret_name = "test_plaintext_secret"
166+
}
167+
168+
resource "github_actions_secret" "encrypted_secret" {
169+
repository = github_repository.test.name
170+
secret_name = "test_encrypted_secret"
157171
}
158-
`, randomID, secretValue)
172+
`, randomID)
159173

160174
testCase := func(t *testing.T, mode string) {
161175
resource.Test(t, resource.TestCase{
@@ -183,5 +197,4 @@ func TestAccGithubActionsSecret(t *testing.T) {
183197
})
184198

185199
})
186-
187200
}

0 commit comments

Comments
 (0)