|
| 1 | +--- |
| 2 | +layout: "github" |
| 3 | +page_title: "GitHub: github_branch_protection" |
| 4 | +description: |- |
| 5 | + Protects a GitHub branch. |
| 6 | +--- |
| 7 | + |
| 8 | +# github\_branch\_protection |
| 9 | + |
| 10 | +Protects a GitHub branch. |
| 11 | + |
| 12 | +This resource allows you to configure branch protection for repositories in your organization. When applied, the branch will be protected from forced pushes and deletion. Additional constraints, such as required status checks or restrictions on users, teams, and apps, can also be configured. |
| 13 | + |
| 14 | +Note: for the `push_allowances` a given user or team must have specific write access to the repository. If specific write access not provided, github will reject the given actor, which will be the cause of terraform drift. |
| 15 | + |
| 16 | +## Example Usage |
| 17 | + |
| 18 | +```hcl |
| 19 | +# Protect the main branch of the foo repository. Additionally, require that |
| 20 | +# the "ci/travis" context to be passing and only allow the engineers team merge |
| 21 | +# to the branch. |
| 22 | +
|
| 23 | +resource "github_branch_protection" "example" { |
| 24 | + repository_id = github_repository.example.node_id |
| 25 | + # also accepts repository name |
| 26 | + # repository_id = github_repository.example.name |
| 27 | +
|
| 28 | + pattern = "main" |
| 29 | + enforce_admins = true |
| 30 | + allows_deletions = true |
| 31 | +
|
| 32 | + required_status_checks { |
| 33 | + strict = false |
| 34 | + contexts = ["ci/travis"] |
| 35 | + } |
| 36 | +
|
| 37 | + required_pull_request_reviews { |
| 38 | + dismiss_stale_reviews = true |
| 39 | + restrict_dismissals = true |
| 40 | + dismissal_restrictions = [ |
| 41 | + data.github_user.example.node_id, |
| 42 | + github_team.example.node_id, |
| 43 | + "/exampleuser", |
| 44 | + "exampleorganization/exampleteam", |
| 45 | + ] |
| 46 | + } |
| 47 | +
|
| 48 | + restrict_pushes { |
| 49 | + push_allowances = [ |
| 50 | + data.github_user.example.node_id, |
| 51 | + "/exampleuser", |
| 52 | + "exampleorganization/exampleteam", |
| 53 | + # you can have more than one type of restriction (teams + users). If you use |
| 54 | + # more than one type, you must use node_ids of each user and each team. |
| 55 | + # github_team.example.node_id |
| 56 | + # github_user.example-2.node_id |
| 57 | + ] |
| 58 | + } |
| 59 | +
|
| 60 | + force_push_bypassers = [ |
| 61 | + data.github_user.example.node_id, |
| 62 | + "/exampleuser", |
| 63 | + "exampleorganization/exampleteam", |
| 64 | + # you can have more than one type of restriction (teams + users) |
| 65 | + # github_team.example.node_id |
| 66 | + # github_team.example-2.node_id |
| 67 | + ] |
| 68 | +
|
| 69 | +} |
| 70 | +
|
| 71 | +resource "github_repository" "example" { |
| 72 | + name = "test" |
| 73 | +} |
| 74 | +
|
| 75 | +data "github_user" "example" { |
| 76 | + username = "example" |
| 77 | +} |
| 78 | +
|
| 79 | +resource "github_team" "example" { |
| 80 | + name = "Example Name" |
| 81 | +} |
| 82 | +
|
| 83 | +resource "github_team_repository" "example" { |
| 84 | + team_id = github_team.example.id |
| 85 | + repository = github_repository.example.name |
| 86 | + permission = "pull" |
| 87 | +} |
| 88 | +``` |
| 89 | + |
| 90 | +## Argument Reference |
| 91 | + |
| 92 | +The following arguments are supported: |
| 93 | + |
| 94 | +* `repository_id` - (Required) The name or node ID of the repository associated with this branch protection rule. |
| 95 | +* `pattern` - (Required) Identifies the protection rule pattern. |
| 96 | +* `enforce_admins` - (Optional) Boolean, setting this to `true` enforces status checks for repository administrators. |
| 97 | +* `require_signed_commits` - (Optional) Boolean, setting this to `true` requires all commits to be signed with GPG. |
| 98 | +* `required_linear_history` - (Optional) Boolean, setting this to `true` enforces a linear commit Git history, which prevents anyone from pushing merge commits to a branch |
| 99 | +* `require_conversation_resolution` - (Optional) Boolean, setting this to `true` requires all conversations on code must be resolved before a pull request can be merged. |
| 100 | +* `required_status_checks` - (Optional) Enforce restrictions for required status checks. See [Required Status Checks](#required-status-checks) below for details. |
| 101 | +* `required_pull_request_reviews` - (Optional) Enforce restrictions for pull request reviews. See [Required Pull Request Reviews](#required-pull-request-reviews) below for details. |
| 102 | +* `restrict_pushes` - (Optional) Restrict pushes to matching branches. See [Restrict Pushes](#restrict-pushes) below for details. |
| 103 | +* `force_push_bypassers` - (Optional) The list of actor Names/IDs that are allowed to bypass force push restrictions. Actor names must either begin with a "/" for users or the organization name followed by a "/" for teams. If the list is not empty, `allows_force_pushes` should be set to `false`. |
| 104 | +* `allows_deletions` - (Optional) Boolean, setting this to `true` to allow the branch to be deleted. |
| 105 | +* `allows_force_pushes` - (Optional) Boolean, setting this to `true` to allow force pushes on the branch to everyone. Set it to `false` if you specify `force_push_bypassers`. |
| 106 | +* `lock_branch` - (Optional) Boolean, Setting this to `true` will make the branch read-only and preventing any pushes to it. Defaults to `false` |
| 107 | + |
| 108 | +### Required Status Checks |
| 109 | + |
| 110 | +`required_status_checks` supports the following arguments: |
| 111 | + |
| 112 | +* `strict`: (Optional) Require branches to be up to date before merging. Defaults to `false`. |
| 113 | +* `contexts`: (Optional) The list of status checks to require in order to merge into this branch. No status checks are required by default. |
| 114 | + |
| 115 | +~> Note: This attribute can contain multiple string patterns. |
| 116 | +If specified, usual value is the [job name](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idname). Otherwise, the [job id](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idname) is defaulted to. |
| 117 | +For workflows that use matrixes, append the matrix name to the value using the following pattern `(<matrix_value>[, <matrix_value>])`. Matrixes should be specified based on the order of matrix properties in the workflow file. See [GitHub Documentation]("https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs#using-a-matrix-strategy") for more information. |
| 118 | +For workflows that use reusable workflows, the pattern is `<initial_workflow.jobs.job.[name/id]> / <reused-workflow.jobs.job.[name/id]>`. This can extend multiple levels. |
| 119 | + |
| 120 | +### Required Pull Request Reviews |
| 121 | + |
| 122 | +`required_pull_request_reviews` supports the following arguments: |
| 123 | + |
| 124 | +* `dismiss_stale_reviews`: (Optional) Dismiss approved reviews automatically when a new commit is pushed. Defaults to `false`. |
| 125 | +* `restrict_dismissals`: (Optional) Restrict pull request review dismissals. |
| 126 | +* `dismissal_restrictions`: (Optional) The list of actor Names/IDs with dismissal access. If not empty, `restrict_dismissals` is ignored. Actor names must either begin with a "/" for users or the organization name followed by a "/" for teams. |
| 127 | +* `pull_request_bypassers`: (Optional) The list of actor Names/IDs that are allowed to bypass pull request requirements. Actor names must either begin with a "/" for users or the organization name followed by a "/" for teams. |
| 128 | +* `require_code_owner_reviews`: (Optional) Require an approved review in pull requests including files with a designated code owner. Defaults to `false`. |
| 129 | +* `required_approving_review_count`: (Optional) Require x number of approvals to satisfy branch protection requirements. If this is specified it must be a number between 0-6. This requirement matches GitHub's API, see the upstream [documentation](https://developer.github.com/v3/repos/branches/#parameters-1) for more information. |
| 130 | + (https://developer.github.com/v3/repos/branches/#parameters-1) for more information. |
| 131 | +* `require_last_push_approval`: (Optional) Require that The most recent push must be approved by someone other than the last pusher. Defaults to `false` |
| 132 | + |
| 133 | +### Restrict Pushes |
| 134 | + |
| 135 | +`restrict_pushes` supports the following arguments: |
| 136 | + |
| 137 | +* `blocks_creations` - (Optional) Boolean, setting this to `false` allows people, teams, or apps to create new branches matching this rule. Defaults to `true`. |
| 138 | +* `push_allowances` - (Optional) A list of actor Names/IDs that may push to the branch. Actor names must either begin with a "/" for users or the organization name followed by a "/" for teams. Organization administrators, repository administrators, and users with the Maintain role on the repository can always push when all other requirements have passed. |
| 139 | + |
| 140 | +## Import |
| 141 | + |
| 142 | +GitHub Branch Protection can be imported using an ID made up of `repository:pattern`, e.g. |
| 143 | + |
| 144 | +``` |
| 145 | +$ terraform import github_branch_protection.terraform terraform:main |
| 146 | +``` |
0 commit comments