diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b4cee3..9595a91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - BREAKING CHANGE: Bump minimum supported version of the GitHub provider to `v5.16` as it contains a [critical fix](https://github.com/integrations/terraform-provider-github/pull/1415) for branch protections. +- BREAKING CHANGE: Rename `required_status_checks.contexts` to `required_status_checks.checks` as contexts is + depcrecated in v3 branch protections ## [0.18.0] diff --git a/README.md b/README.md index 61623ed..db97184 100644 --- a/README.md +++ b/README.md @@ -543,7 +543,7 @@ This is due to some terraform limitation and we will update the module once terr Default is `false`. - - [**`contexts`**](#attr-branch_protections_v3-required_status_checks-contexts): *(Optional `list(string)`)* + - [**`checks`**](#attr-branch_protections_v3-required_status_checks-checks): *(Optional `list(string)`)* The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required. @@ -736,6 +736,12 @@ This is due to some terraform limitation and we will update the module once terr Default is `0`. + - [**`require_last_push_approval`**](#attr-branch_protections_v4-required_pull_request_reviews-require_last_push_approval): *(Optional `bool`)* + + Setting this to true enforces that the most recent push must be approved by someone other than the last pusher. + + Default is `false`. + - [**`required_status_checks`**](#attr-branch_protections_v4-required_status_checks): *(Optional `object(required_status_checks)`)* Enforce restrictions for required status checks. @@ -749,7 +755,7 @@ This is due to some terraform limitation and we will update the module once terr Default is `false`. - - [**`contexts`**](#attr-branch_protections_v4-required_status_checks-contexts): *(Optional `list(string)`)* + - [**`checks`**](#attr-branch_protections_v4-required_status_checks-checks): *(Optional `list(string)`)* The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required. diff --git a/README.tfdoc.hcl b/README.tfdoc.hcl index 652684c..2a70c07 100644 --- a/README.tfdoc.hcl +++ b/README.tfdoc.hcl @@ -701,7 +701,7 @@ section { END } - attribute "contexts" { + attribute "checks" { type = list(string) default = [] description = <<-END @@ -950,6 +950,14 @@ section { If this is specified it must be a number between 0-6. END } + + attribute "require_last_push_approval" { + type = bool + default = false + description = <<-END + Setting this to true enforces that the most recent push must be approved by someone other than the last pusher. + END + } } attribute "required_status_checks" { @@ -967,7 +975,7 @@ section { END } - attribute "contexts" { + attribute "checks" { type = list(string) default = [] description = <<-END diff --git a/examples/public-repository/README.md b/examples/public-repository/README.md index da95991..0ca5017 100644 --- a/examples/public-repository/README.md +++ b/examples/public-repository/README.md @@ -62,7 +62,7 @@ module "repository" { required_status_checks = { strict = true - contexts = ["ci/travis"] + checks = ["ci/travis"] } required_pull_request_reviews = { diff --git a/examples/public-repository/main.tf b/examples/public-repository/main.tf index 03629a2..570d19a 100644 --- a/examples/public-repository/main.tf +++ b/examples/public-repository/main.tf @@ -48,7 +48,7 @@ module "repository" { admin_collaborators = ["terraform-test-user-1"] - branch_protections = [ + branch_protections_v5 = [ { branch = "main" enforce_admins = true diff --git a/main.tf b/main.tf index 26fa2cb..3be2293 100644 --- a/main.tf +++ b/main.tf @@ -56,8 +56,8 @@ locals { for b in local.branch_protections_v3 : length(keys(b.required_status_checks)) > 0 ? [ merge({ - strict = null - contexts = [] + strict = null + checks = [] }, b.required_status_checks)] : [] ] @@ -220,6 +220,7 @@ resource "github_branch_protection" "branch_protection" { pull_request_bypassers = try(required_pull_request_reviews.value.pull_request_bypassers, []) require_code_owner_reviews = try(required_pull_request_reviews.value.require_code_owner_reviews, true) required_approving_review_count = try(required_pull_request_reviews.value.required_approving_review_count, 0) + require_last_push_approval = try(required_pull_request_reviews.value.require_last_push_approval, false) } } @@ -260,8 +261,8 @@ resource "github_branch_protection_v3" "branch_protection" { for_each = local.required_status_checks[count.index] content { - strict = required_status_checks.value.strict - contexts = required_status_checks.value.contexts + strict = required_status_checks.value.strict + checks = required_status_checks.value.checks } } diff --git a/test/unit-complete/main.tf b/test/unit-complete/main.tf index 6fb9298..f01c26f 100644 --- a/test/unit-complete/main.tf +++ b/test/unit-complete/main.tf @@ -102,6 +102,7 @@ module "repository" { required_pull_request_reviews = { dismiss_stale_reviews = true require_code_owner_reviews = true + require_last_push_approval = true required_approving_review_count = 1 } @@ -119,8 +120,8 @@ module "repository" { require_signed_commits = true required_status_checks = { - strict = true - contexts = ["ci/travis"] + strict = true + # checks = ["ci/travis"] } required_pull_request_reviews = { diff --git a/variables.tf b/variables.tf index c5cb3f9..becad72 100644 --- a/variables.tf +++ b/variables.tf @@ -284,8 +284,8 @@ variable "branch_protections_v3" { # enforce_admins = bool # require_signed_commits = bool # required_status_checks = object({ - # strict = bool - # contexts = list(string) + # strict = bool + # checks = list(string) # }) # required_pull_request_reviews = object({ # dismiss_stale_reviews = bool @@ -311,7 +311,7 @@ variable "branch_protections_v3" { # # required_status_checks = { # strict = false - # contexts = ["ci/travis"] + # checks = ["ci/travis"] # } # # required_pull_request_reviews = { @@ -352,6 +352,7 @@ variable "branch_protections_v4" { # pull_request_bypassers = optional(list(string), []) # require_code_owner_reviews = optional(bool, false) # required_approving_review_count = optional(number, 0) + # require_last_push_approval = optional(bool, false) # } # )) # required_status_checks = optional(object(