Missing state for membership in nested teams

[joebowbeer]

Say a user is a member of team Child which is a child of team Parent, but the user is not directly a member of team Parent.

Then the imported state shows the user to be a member of both teams:

resource "github_team_membership" "Child-user" {
  username = "user"
  team_id = "${github_team.Child.id}"
  role = "member"
}

resource "github_team_membership" "Parent-user" {
  username = "user"
  team_id = "${github_team.Parent.id}"
  role = "member"
}

Adding a new user to both teams via terraform results in similar terraform state, that is the new user is shown to be a member of both teams in the terraform state. However, the result on GitHub is different: the user has been added to both teams, instead of only being a member of the child team.

How to add a user to a child team without adding them to the parent, or requiring a subsequent import?

Terraform Version

Terraform v0.11.8

• provider.github v1.3.0

Affected Resource(s)

github_team_membership

Repro steps

• Create two teams, by any means, one parent and one child
• Add the same user to each team using terraform and apply changes
• Verify that GitHub shows the user to be a member of both teams
• On GitHub, remove the user from the parent team
• Run terraform plan
• Verify that there are no changes to apply! The two states are identical.

References

Related to #47

[megan07]

Hi @joebowbeer !

Thank you for submitting this issue! I was able to reproduce this as well. While digging into it I found a very interesting implementation in the GitHub API where, depending on the media type passed, the API will return child team members along with parent team members when requesting team members of a parent team (https://developer.github.com/v3/teams/members/#get-team-membership). Thus, when we go to GetTeamMembership on the parent team resource, it shows the member of the child team as a member as well.

Unfortunately, the go-github SDK sets this media type for us, so I don't see how we could do this without reimplementing or forking the SDK. (https://github.com/google/go-github/blob/0573e88402f1db392537e0cbb2c79f1c03d1c6a0/github/github.go#L95)

Please let me know if you have further questions or if I can help in any way.

Thanks!

[docwhat]

Is the SDK still unable to differentiate between the two?

[anGie44]

hi @docwhat @joebowbeer! so the v3 github API still returns child team members w/in a parent team as referenced in the comments above; however, the github graphql api v4 provides the ability to explicitly differentiate membership types within a team (https://developer.github.com/v4/enum/teammembershiptype/) such that one can retrieve a team's immediate members vs. child_team members. It looks like adding the graphql client is in the works and tagged for v2.7.0 within the provider (https://github.com/terraform-providers/terraform-provider-github/pull/331) so a re-look at the team_membership resource's Read functionality can take place there. @jcudit or @patrickmarabeas can you confirm if an uplift for this resource is in the works or is something that can be worked on?

[patrickmarabeas]

I have only written a teams data source so far - https://github.com/terraform-providers/terraform-provider-github/pull/339. The schema is radically different, so some discussion is probably warranted around it.

[anGie44]

@patrickmarabeas I'd be happy to contribute to updating the team_membership data_source/resource if it hasn't been started on.

[patrickmarabeas]

I would like some feedback on the schema before any further development effort goes into it. If you want some working code to test with - play around with https://github.com/patrickmarabeas/terraform-provider-github-v4

There's some additional work that needs to go into how we toggle v4 resources that I'm currently working on before any actual resources will make it in.

[jcudit]

I have not looked into this yet. I want to get this one figured out but think we should focus on a plan to toggle v4 resources first.

[github-actions]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!

[github-actions]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!