Skip to content

Commit

Permalink
Fix handling Action secrets (integrations#740)
Browse files Browse the repository at this point in the history
  • Loading branch information
marcinwyszynski authored Apr 17, 2021
1 parent 41a0601 commit 1cf6656
Show file tree
Hide file tree
Showing 2 changed files with 44 additions and 2 deletions.
23 changes: 22 additions & 1 deletion github/resource_github_actions_organization_secret.go
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,6 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta in
}

d.Set("plaintext_value", d.Get("plaintext_value"))
d.Set("updated_at", secret.UpdatedAt.String())
d.Set("created_at", secret.CreatedAt.String())
d.Set("visibility", secret.Visibility)

Expand All @@ -158,6 +157,28 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta in

d.Set("selected_repository_ids", selectedRepositoryIDs)

// This is a drift detection mechanism based on timestamps.
//
// If we do not currently store the "updated_at" field, it means we've only
// just created the resource and the value is most likely what we want it to
// be.
//
// If the resource is changed externally in the meantime then reading back
// the last update timestamp will return a result different than the
// timestamp we've persisted in the state. In that case, we can no longer
// trust that the value (which we don't see) is equal to what we've declared
// previously.
//
// The only solution to enforce consistency between is to mark the resource
// as deleted (unset the ID) in order to fix potential drift by recreating
// the resource.
if updatedAt, ok := d.GetOk("updated_at"); ok && updatedAt != secret.UpdatedAt.String() {
log.Printf("[WARN] The secret %s has been externally updated in GitHub", d.Id())
d.SetId("")
} else if !ok {
d.Set("updated_at", secret.UpdatedAt.String())
}

return nil
}

Expand Down
23 changes: 22 additions & 1 deletion github/resource_github_actions_secret.go
Original file line number Diff line number Diff line change
Expand Up @@ -106,9 +106,30 @@ func resourceGithubActionsSecretRead(d *schema.ResourceData, meta interface{}) e
}

d.Set("plaintext_value", d.Get("plaintext_value"))
d.Set("updated_at", secret.UpdatedAt.String())
d.Set("created_at", secret.CreatedAt.String())

// This is a drift detection mechanism based on timestamps.
//
// If we do not currently store the "updated_at" field, it means we've only
// just created the resource and the value is most likely what we want it to
// be.
//
// If the resource is changed externally in the meantime then reading back
// the last update timestamp will return a result different than the
// timestamp we've persisted in the state. In that case, we can no longer
// trust that the value (which we don't see) is equal to what we've declared
// previously.
//
// The only solution to enforce consistency between is to mark the resource
// as deleted (unset the ID) in order to fix potential drift by recreating
// the resource.
if updatedAt, ok := d.GetOk("updated_at"); ok && updatedAt != secret.UpdatedAt.String() {
log.Printf("[WARN] The secret %s has been externally updated in GitHub", d.Id())
d.SetId("")
} else if !ok {
d.Set("updated_at", secret.UpdatedAt.String())
}

return nil
}

Expand Down

0 comments on commit 1cf6656

Please sign in to comment.