Support Github Action Permissions

[mindfulmonk]

Hi,

I currently have a use-case where I would like to roll-out Github Actions in the organization, but only to specific repos, currently this is not supported in the provider.

In particular this:

There are two tickets about github actions #162 and #381 but wasn't sure if they tackling this specific issue.

This probably should be a new param in https://www.terraform.io/docs/providers/github/r/repository.html called actions with 3 params third-party local disabled

Cheers!

[brntbeer]

👋 hi @mindfulmonk it seems you request is geared a little towards this repo but maybe more specifically towards feedback on how GitHub actions works itself. It's a bit unclear to me.

Are you wanting to script being able to enable actions on individual repositories? or script adding particular actions to every repository?

[mindfulmonk]

Hey @brntbeer both, but the more important one is to enable Actions selectively on each repo.

[brntbeer]

ah ok thanks for that @mindfulmonk. So the reason why Terraform cannot do what you're asking for, is there's no API for actions permissions.

I've filed this as feedback for our roadmap team at GitHub

[jcudit]

https://docs.github.com/en/free-pro-team@latest/rest/reference/actions#set-allowed-actions-for-a-repository looks promising. However our underlying client library does not show support for this endpoint at the moment.

[brntbeer]

@mindfulmonk given https://docs.github.com/en/free-pro-team@latest/rest/reference/actions#set-github-actions-permissions-for-an-organization, does this meet you requirements and just need to wait for the client library to implement?

[shields-fn]

It looks like the go-github client library now supports this: https://pkg.go.dev/github.com/google/go-github/v35/github#ActionsPermissions

[j-nix]

I've opened a PR to support this kind of permissions setting on an organizational level #920.

It may or may not cater to your requirements for setting permissions-per repo, but it's a start.

[shinenelson]

This feature is merged and released. Can't this issue be closed now @jcudit ? Ideally, it should have been linked to #920 and closed when the pull request was merged. But it can be done separately now - unless there is something else that I am missing that warrants keeping this issue open.