[BUG]: creation of github_repository fails from v6.7.0 onwards

[jtsaito]

Expected Behavior

Applying the Terraform plan for a new github_repository with vulnerability_alerts = true should create the repository without producing an error.

This is running in an GitHub Enterprise Cloud account.

It works fine with provider version 6.6.0 but fails with 6.7.0 to 6.9.0 (error below).

Possibly related to #2501.

Actual Behavior

Terraform errors, creates the repository but the state is broken with some attributes missing. Just applying Terraform again does not fix the issues.

 Error: DELETE https://api.github.com/repos/lessonnine/jts-test.test/vulnerability-alerts: 422 An enforced security configuration prevented modifying dependabot alerts enablement. Contact your organization owner for details. []
│ 
│   with github_repository.lessonnine-jts-test-test,
│   on generated.tf line 50028, in resource "github_repository" "lessonnine-jts-test-test":
│ 50028: resource "github_repository" "lessonnine-jts-test-test" {

Terraform Version

Terraform version 1.11.4 on linux_amd64.

Affected Resource(s)

• github_repository

Terraform Configuration Files

resource "github_repository" "lessonnine-jts-test-test" {
  name        = "jts-test.test"
  description = "Just for testing GitHub api (Infrastructure)"

  topics = [
    "infrastructure",
  ]

  has_issues   = false
  has_projects = true
  has_wiki     = false

  allow_rebase_merge = false
  allow_squash_merge = false

  visibility = "private"

  vulnerability_alerts = true # test adding this attribute

  auto_init              = true
  delete_branch_on_merge = true
  allow_update_branch    = true
  allow_auto_merge       = true

  lifecycle {
    prevent_destroy = true

    ignore_changes = [
      # vulnerability alerts are managed via org-wide settings
      vulnerability_alerts,
    ]
  }
}


with provider version:


    github = {
      source  = "integrations/github"
      version = "6.7.0"
    }

Steps to Reproduce

$ terraform apply

Debug Output

Error: DELETE https://api.github.com/repos/lessonnine/jts-test.test/vulnerability-alerts: 422 An enforced security configuration prevented modifying dependabot alerts enablement. Contact your organization owner for details. []
│ 
│   with github_repository.lessonnine-jts-test-test,
│   on generated.tf line 50028, in resource "github_repository" "lessonnine-jts-test-test":
│ 50028: resource "github_repository" "lessonnine-jts-test-test" {

Panic Output

none

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[stevehipwell]

@jtsaito are you explicitly setting the value on a repo in an organization where this is being managed by the organization? If you don't set it on the repo is it working?

[mark-oppenheim]

I'm seeing the same issue on 6.8.3, whether I explicity set vulnerability_alerts to true, null or rely on the default.

[stevehipwell]

@mark-oppenheim the current implementation always calls one of the vulnerability alert endpoints. AFAIK this has been the case for a long time.

[mark-oppenheim]

@mark-oppenheim the current implementation always calls one of the vulnerability alert endpoints. AFAIK this has been the case for a long time.

That makes sense, but what I'm seeing is errors for all values of vulnerability_alerts unless I tie the provider version to < 6.7.

[stevehipwell]

@mark-oppenheim just to confirm that this is a regression since v6.7.0 with the same GitHub settings?

[tobias-jenkner]

Repo creation still fails with version 6.9.1 in my case with the following error message:

Error: DELETE https://github.domain.de/api/v3/repos/ORG/REPO/vulnerability-alerts: 422 Failed to change dependabot alerts status.

[stevehipwell]

@tobias-jenkner could you provide a bit more context?

[tobias-jenkner]

Terraform Enterprise using Terraform v1.12.2
GitHub Enterprise 3.17
Unfortunately, I cannot share my TF code - I would need to create a separate reproduction example - I can do that during the next days, if it is needed.