feat: github_repository_ruleset WIP

[felixlut]

Resolves #1777

I'll leave this a a Draft for now because of 2 reasons:

1. I want feedback on the schema structure. It's pretty big and complex. and I want to make it as user friendly as possible. I'll post some comments in the PR where I've some ideas on what could be altered.
2. The google/go-github version needs to be bumped before all the functionality is in place. This requires that they make a new release (v53.2.0 was released 19:th June, which is no longer up to date with the structure of the Rulesets API)
   • Eg, bypass_actors can't be used currently because its API requires all of actor_id, actor_type and bypass_mode to be set, but the library only supports two of them. They fixed it since though, see here
   • There are other examples of this as well (beta level functionality tends to change quite often I guess 😓)

The Terraform would look something like this:

# Used for adding multiple bypass_actors 
locals {
  actors = [
    # I have no idea where these id:s come from, I just created the Rule in the UI, and these where the ones
    { actor_id = 1, actor_type = "OrganizationAdmin" },
    { actor_id = 5, actor_type = "RepositoryRole" },
  ]
}

resource "github_repository_ruleset" "test" {
  repository  = "my-cool-repo"
  owner       = "my-cool-org"
  name        = "tf test rule"
  target      = "branch"
  enforcement = "disabled"
  conditions {
    include = [
      "~DEFAULT_BRANCH",
      "refs/heads/prod-*",
      "~ALL"
    ]
    exclude = ["refs/heads/dev-*"]
  }
  rule_creation = true
  # rule_update  = true # TODO: Currently broken, go-github needs a bump
  rule_deletion                = true
  rule_required_linear_history = true
  rule_required_signatures     = true
  rule_non_fast_forward        = true
  rule_required_deployments    = ["terraform"]
  rule_pull_request {
    dismiss_stale_reviews_on_push     = true
    require_code_owner_review         = true
    require_last_push_approval        = true
    required_approving_review_count   = 5
    required_review_thread_resolution = true
  }
  rule_required_status_checks {
    strict_required_status_checks_policy = true
    required_status_checks               = ["terraform-plan", "SonarQube Code Analysis:95502"]
  }
  # TODO: Currently broken, go-github needs a bump
  # dynamic bypass_actors {
  #   for_each = local.actors
  #   content {
  #     actor_id = bypass_actors.value["actor_id"]
  #     actor_type = bypass_actors.value["actor_type"]
  #   }
  # }
}

---

Before the change?

After the change?

Pull request checklist

• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[felixlut]

I'll leave the implementation of this until the Schema has been accepted

[felixlut]

All of the ForceNew: true, will be removed once Update is implemented, see previous comment

[felixlut]

I could see an argument for having fields for both default_branch and all_branches_and_tags as boolean values to get around users needing to learn that they are referenced as ~DEFAULT_BRANCH and ~ALL.

Changing this would be trivial if anyone strongly feels they should be their own fields (updating this after this PR is merged wouldn't be difficult either, if the functionality is wanted down the line)

[felixlut]

Maybe go-github needs a version bump for this one? It's a weird one though, because both the API docs and go-github expects update_allows_fetch_and_merge, but when I ping the API, I get back a response looking like this (where the update field is the most important, the rest is just there for context):

"rules": [
  {
    "type": "deletion"
  },
  {
    "type": "non_fast_forward"
  },
  {
    "type": "required_status_checks",
    "parameters": {
      "required_status_checks": [
        {
          "context": "SonarQube Code Analysis",
          "integration_id": 95502
        }
      ],
      "strict_required_status_checks_policy": true
    }
  },
  {
    "type": "pull_request",
    "parameters": {
      "require_code_owner_review": true,
      "require_last_push_approval": true,
      "dismiss_stale_reviews_on_push": true,
      "required_approving_review_count": 3,
      "required_review_thread_resolution": true
    }
  },
  {
    "type": "required_signatures"
  },
  {
    "type": "required_deployments",
    "parameters": {
      "required_deployment_environments": [
        "terraform"
      ]
    }
  },
  {
    "type": "required_linear_history"
  },
  {
    "type": "update"
  },
  {
    "type": "creation"
  }
],

I don't know why this is, or if I'm missing something. I'll look into this more later, after a bumo of go-github has been made.

[felixlut]

Relevant discussion thread here: google/go-github#2836

[felixlut]

When I started implementing this, I played around with a nested rules field, which wrapped all the rule_* fields you can see below here. It proved to require a bunch of boilerplate code when implementing the actual Create/Read/Destroy logic, so I instead opted into moving them to the root, and instead using a rule_* naming convention for them.

The rule_* addition might be overkill (and requires a little bit of parsing logic in the actual implementation), but since the schema is quite large, I think it's worth having it just to make it clear that these are the rules (a creation field doesn't really mean much, rule_creation is clearer IMO) .

I'm open for feedback here though. Baking all of them into a nested structure is possible, just somewhat tedious.

[felixlut]

As mentioned in the PR description, this one is broken currently. go-github needs a release bump. As opposed to the rule_update field, I'm confident will be solved by this bump 😓

[felixlut]

It shouldn't be that hard to build on this to also implement Org level Rules. Leaving this until the schema has been finalized and go-github has been bumped

[felixlut]

Or another PR, idk what makes sense. We'll see

[felixlut]

I have seen both fmt.Errorf() and errors.New being used to throw errors across this project. What is the recommended way?

[felixlut]

Relevant discussion regarding the question about the update rule: google/go-github#2836

[felixlut]

Closing this in favor of #1808