Understanding the GitHub Provider for Terraform

In this talk, I look at how HashiCorp Terraform can be used to manage GitHub Organizations, including Users, Teams, and Memberships. I also discuss how Terraform makes it easy to manage Repositories and Branch Protections.

This version of the presentation was given at HashiTalks in February 2020.

1. Understanding the GitHub Provider for Terraform
2. @ksatirli on GitHub and Twitter
4. Terraform 125+ Official Providers AWS, GCP, Datadog, etc. 160+ Community Providers 1Password, Jira, Unifi, etc.
5. Terraform 0.12 and newer only
6. Provider Setup
7. Personal Access Token github.com/settings/token/new
8. Personal Access Token github.com/settings/token
9. Provider Setup CODE EDITOR provider "github" { version = "~> 2.3" organization = "operatehappy" token = "abc...890" }
10. TERMINAL > terraform init Initializing the backend... Initializing provider plugins... - Checking for available provider plugins... - Downloading plugin for provider "github" (hashicorp/github) 2.3.0... Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure.
11. TERMINAL > terraform version Terraform v0.12.20 + provider.github v2.3.1
12. Team Management
13. Adding Members CODE EDITOR resource "github_membership" "kibertoad" { username = "kibertoad" role = "member" }
14. Adding Members TERMINAL > terraform fmt providers.tf members.tf
15. Creating Teams CODE EDITOR resource "github_team" "reviewers" { name = "reviewers" description = "Reviewer Team" privacy = "closed" }
16. Updating Teams CODE EDITOR resource "github_team_membership" "reviewers" { count = length(var.reviewers_team) team_id = github_team.reviewers.id username = element(var.reviewers_team, count.index) role = "maintainer" }
17. Repository Management
18. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" description = "Operate Happy’s monitoring app" homepage_url = "https://operatehappy.com/monitoring" private = false }
19. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" has_downloads = false has_issues = true has_projects = false has_wiki = false }
20. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" allow_merge_commit = false allow_rebase_merge = false allow_squash_merge = true }
21. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" auto_init = true }
22. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" auto_init = false template { owner = "operatehappy" repo = "terraform-module-template" } }
23. Managing Repositories CODE EDITOR resource "github_repository" "monitoring-app" { name = "monitoring-app" topics [ "application", "monitoring", } }
24. Renaming Repositories TERMINAL Terraform will perform the following actions: # github_repository.monitoring-app must be replaced -/+ resource "github_repository" "monitoring-app" { ~ id = "monitoring-app" -> (known after apply) ~ name = "monitoring-app" -> "monitoring-application" ... Plan: 1 to add, 0 to change, 1 to destroy.
25. Renaming Repositories github.com/operatehappy/monitoring-application/
26. Renaming Repositories TERMINAL > terraform state rm github_repository.monitoring-app > terraform import \ github_repository.monitoring-app \ monitoring-app
27. Managing Team Repositories CODE EDITOR resource "github_team_repository" "monitoring-app" { team_id = github_team.reviewers.id repository = github_repository.monitoring_app.name permission = "push" }
28. Managing Team Repositories CODE EDITOR resource "github_team_repository" "monitoring-app" { team_id = github_team.reviewers.id repository = github_repository.monitoring_app.name permission = "push" }
29. Managing Team Repositories CODE EDITOR resource "github_team_repository" "monitoring-app" { team_id = github_team.reviewers.id repository = github_repository.monitoring_app.name permission = "push" }
30. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "release-*" }
31. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" }
32. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" enforce_admins = true require_signed_commits = true }
33. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" enforce_admins = true require_signed_commits = true }
34. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" required_status_checks { strict = true contexts = ["ci/enforcer"] } }
35. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" required_pull_request_reviews { dismiss_stale_reviews = true dismissal_teams = [github_team.internal.slug] } }
36. Protecting Repository Branches CODE EDITOR resource "github_branch_protection" "monitoring-app" { repository = github_repository.monitoring_app.name branch = "master" required_pull_request_reviews { dismiss_stale_reviews = true dismissal_teams = [github_team.internal.slug] } }
37. Review ▪ Provider Setup ▪ Team Management ▪ Repository Management ▪ Branch Protection
38. Materials ▪ slides: speakerdeck.com/ksatirli ▪ code: git.io/Jv3YE
39. Thank You kerim@hashicorp.com