Terraform Version

Run terraform -v to show the version. If you are not running the latest version of Terraform, please upgrade because your issue may have already been fixed.

terraform -v
Terraform v1.3.5
on linux_amd64
+ provider registry.terraform.io/integrations/github v5.9.1

Affected Resource(s)

• github_actions_organization_secret

Terraform Configuration Files

resource "github_actions_organization_secret" "secret" {
  secret_name = "TEST_SECRET"
  visibility  = "private"

  lifecycle {
    ignore_changes = [
      plaintext_value,
      encrypted_value
    ]
  }
}

Debug Output

State file

{
  "version": 4,
  "terraform_version": "1.3.5",
  "serial": 20,
  "lineage": "f6210cb1-a789-4343-822c-60148393fdc3",
  "outputs": {},
  "resources": [
    {
      "mode": "managed",
      "type": "github_actions_organization_secret",
      "name": "admin-token",
      "provider": "provider[\"registry.terraform.io/integrations/github\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "created_at": "2022-11-23 10:47:28 +0000 UTC",
            "encrypted_value": "",
            "id": "TEST_SECRET",
            "plaintext_value": "",
            "secret_name": "TEST_SECRET",
            "selected_repository_ids": null,
            "updated_at": "2022-11-23 10:47:53 +0000 UTC",
            "visibility": "private"
          },
          "sensitive_attributes": [],
          "private": "bnVsbA=="
        }
      ]
    }
  ],
  "check_results": null
}

Panic Output

N/A

Expected Behavior

The secret should not be recreated nor updated. I.e. terraform runs should be idempotent.

Actual Behavior

The secret gets recreated resetting the value of the secret to an empty string.

It looks like the id gets changed when the value was manually set in GitHub, hence the provider lost track of the resource. The state file does have the correct information. (see Debug output)

The linked issue (#974) mentions the use of ignore_changes lifecycle. This doesn't resolve the issue. Tested by adding updated_at, but this field is ignored.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply
2. make manual update in GitHub to set the value
3. terraform apply

Important Factoids

N/A

References

• Using github_actions_organization_secret_repositories causes to be updated on each apply even with no changes. #974