Repository navigation
Conversation
Co-authored-by: opencode <opencode@noreply.opencode.ai> Co-authored-by: GitHub Copilot <copilot@noreply.github.com> intent(agent-secrets): manage GitHub Agent Secrets with Terraform following the Actions Secrets pattern for upstream issue integrations#3463. decision(agent-secrets): reuse the existing Agents SDK and encryption helper; manage organization repository access separately from secret values. constraint(verification): local checks pass; live acceptance testing is still required to confirm GitHub preserves selected repository access during rotation. Refs integrations#3463
Co-authored-by: opencode <opencode@noreply.opencode.ai> Co-authored-by: GitHub Copilot <copilot@noreply.github.com> learned(agent-secrets): GitHub clears selected repositories when a secret PUT omits the list, and access edits also advance the secret timestamp. decision(agent-secrets): resubmit live repository access during rotation and track observed access to avoid false value drift. constraint(agent-secrets): simultaneous access and value changes cannot be distinguished; document that limitation and concurrent-update risks. Verified with 454 local tests and live creation, rotation, imports, access management, no-op plans, and cleanup in Staffbase/infrastructure. Refs integrations#3463
Co-authored-by: opencode <opencode@noreply.opencode.ai> Co-authored-by: GitHub Copilot <copilot@noreply.github.com> decision(agent-secrets): share create/update callbacks where creation adds no separate behavior, matching existing association resources. decision(agent-secret-tests): remove low-value schema-validation and access-call mocks while retaining lifecycle and regression coverage. Verified: 446 non-acceptance tests passed; strict lint reported 0 issues. Refs integrations#3463
Co-authored-by: opencode <opencode@noreply.opencode.ai> Co-authored-by: GitHub Copilot <copilot@noreply.github.com> learned(agent-secrets): listing access returns an empty list for non-selected secrets, but removing access returns 409. decision(agent-secrets): confirm non-selected visibility before accepting deletion conflicts; preserve unrelated conflicts and lookup failures. decision(agent-secret-tests): colocate tests with resources and data sources, strengthen metadata assertions, and retain a focused empty-array deletion regression. Expand schema fields to match surrounding provider conventions. Verified: 458 local tests, build and lint, docs generation and validation, and live visibility-change cleanup. Refs integrations#3463
|
👋 Hi, and thank you for this contribution! This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can. You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions. 🤖 This is an automated message. |
michikrug
marked this pull request as ready for review
October 29, 2026 16:09
2 of 7 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #3463. Implements Agent Secrets; Agent Variables remain for a follow-up.
Before the change?
The provider cannot manage GitHub Agent Secrets, which use APIs separate from Actions secrets.
After the change?
Adds repository and organization secret resources, individual and complete-set repository access resources, and four public-key/secret-metadata data sources.
Supports plaintext encryption, pre-encrypted values with key IDs, imports, and repository rename handling. Uses the existing
go-githubdependency.Organization updates preserve the live repository allowlist. Timestamp-based drift detection accounts for access changes; simultaneous access/value changes and concurrent-update limitations are documented.
How to review?
Focus on schemas, organization update semantics, and drift detection.
476 local tests and build/lint/docs checks passed. Live GitHub.com testing covered creation, rotation, imports, access management, visibility changes, no-op plans, and cleanup. Full live acceptance testing remains outstanding, including pre-encrypted inputs and rename/replacement.
Pull request checklist
Does this introduce a breaking change?
Substantially AI-assisted; verification above was completed.