fix: avoid 422 when enterprise policy controls org fork setting by andrewesweet · Pull Request #3360 · integrations/terraform-provider-github

andrewesweet · 2026-04-22T14:03:50Z

Resolves #2689
Relates to #1333

Before the change?

members_can_fork_private_repositories has Default: false in the schema, causing the field to always be sent to the GitHub API even when not explicitly set by the user.
When an enterprise-level policy locks this setting, the API returns a 422 validation error.

After the change?

Removed Default: false from the schema so the field is only included in API calls when explicitly configured by the user.
This matches the pattern used by members_can_create_internal_repositories (enterprise-only field with no default).
Updated description and docs to note the enterprise policy interaction.

Users who never set this field see no behavioral change — the API default is false and the Read function still populates state from the API response.

Pull request checklist

Schema migrations have been created if needed
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Yes
No

github-actions · 2026-04-22T14:04:02Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

deiga

I think this won't be as simple as this. Since we use d.GetOk to identify if members_can_fork_private_repositories should be sent to the API it would still continue sending the value.

It would be important to add a test that verify's that members_can_fork_private_repositories isn't actually being set or updated in the Read function

andrewesweet

Thanks for the review, @deiga. I've updated the PR.

The schema now has Computed: true on the field, and the build function uses d.GetOkExists instead of shouldInclude. I followed the same pattern as allow_forking in resource_github_repository.go.

I also added:

Unit tests for buildOrganizationSettings covering nil when omitted, non-nil when explicitly set to true or false, and nil on updates when unchanged.
An acceptance test (TestAccGithubOrganizationSettings_omittedForkFieldProducesCleanPlan) verifying no phantom diff after apply.

andrewesweet · 2026-05-01T13:02:32Z

I also spotted the same problem with members_can_create_internal_repositories and created #3385 and #3386 to fix it separately.

andrewesweet · 2026-06-10T14:58:31Z

Requesting re-review please, @deiga

deiga · 2026-06-15T10:42:50Z

 	})
 }
+
+func TestAccGithubOrganizationSettings_omittedForkFieldProducesCleanPlan(t *testing.T) {


issue: We don't use this pattern, please add the test the the function above

deiga · 2026-06-15T10:43:39Z

-	if shouldInclude("members_can_fork_private_repositories") {
+	if !isUpdate {
+		if _, ok := d.GetOkExists("members_can_fork_private_repositories"); ok { //nolint:staticcheck // SA1019 // GetOkExists needed for Computed+Optional bool fields
+			settings.MembersCanForkPrivateRepos = new(d.Get("members_can_fork_private_repositories").(bool))


issue: you haven't run make lintcheck-new, please do so

deiga · 2026-06-15T10:45:41Z

issue: Please move the unit tests into the existing test file

deiga · 2026-06-15T10:46:21Z

+		if _, ok := d.GetOkExists("members_can_fork_private_repositories"); ok { //nolint:staticcheck // SA1019 // GetOkExists needed for Computed+Optional bool fields
+			settings.MembersCanForkPrivateRepos = new(d.Get("members_can_fork_private_repositories").(bool))
+		}
+	} else if d.HasChange("members_can_fork_private_repositories") {


question: the condition has changed here, is that on purpose?

deiga · 2026-06-15T10:46:57Z

issue: this folder doesn't exist anymore, please rebase and follow the current docs convention

Remove Default: false from members_can_fork_private_repositories schema to prevent the field from being sent to the API when not explicitly set by the user. When an enterprise-level policy locks this setting, sending any value causes a 422 validation error. Without a default, the field is only included in API calls when the user explicitly configures it, matching the behavior of members_can_create_internal_repositories (enterprise-only field). Fixes integrations#2689 Relates to integrations#1333 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Add Computed: true to members_can_fork_private_repositories schema so Terraform accepts API values when users omit the field, preventing phantom diffs that trigger 422 errors under enterprise policy. Replace shouldInclude with d.GetOkExists for this field since GetOk cannot distinguish "set to false" from "not set" on Computed+Optional bools. Follows allow_forking pattern in resource_github_repository.go. Add unit tests for buildOrganizationSettings and acceptance test proving no phantom diff after apply. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deiga · 2026-07-22T18:08:16Z

@andrewesweet please rebase and respond to open questions

Copilot

Pull request overview

These provider review instructions are being used. This PR avoids organization-settings API 422 errors when enterprise policy controls private repository forking.

Changes:

Makes the fork setting optional/computed and conditionally sends it.
Adds unit and acceptance coverage.
Documents the enterprise-policy interaction.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
`github/resource_github_organization_settings.go`	Updates schema and API payload behavior.
`github/resource_github_organization_settings_unit_test.go`	Tests field inclusion and schema properties.
`github/resource_github_organization_settings_test.go`	Adds clean-plan acceptance coverage.
`docs/resources/organization_settings.md`	Updates user guidance.

 - `members_can_create_public_pages` - (Optional) Whether or not organization members can create new public pages. Defaults to `true`.
 - `members_can_create_private_pages` - (Optional) Whether or not organization members can create new private pages. Defaults to `true`.
- `members_can_fork_private_repositories` - (Optional) Whether or not organization members can fork private repositories. Defaults to `false`.
+- `members_can_fork_private_repositories` - (Optional) Whether or not organization members can fork private repositories. When an enterprise policy controls this setting, omit this attribute to avoid API validation errors.


 	})
 }
+
+func TestAccGithubOrganizationSettings_omittedForkFieldProducesCleanPlan(t *testing.T) {


+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(
+						"github_organization_settings.test",
+						"billing_email", "test@example.com",
+					),


github-actions Bot added the Type: Bug Something isn't working as documented label Apr 22, 2026

deiga requested changes Apr 26, 2026

View reviewed changes

andrewesweet force-pushed the fix/org-settings-fork-422 branch from 08b4cec to 21524a1 Compare May 1, 2026 11:36

andrewesweet commented May 1, 2026

View reviewed changes

andrewesweet mentioned this pull request May 1, 2026

[BUG] members_can_create_internal_repositories in github_organization_settings missing Computed: true causing phantom diffs #3385

Open

deiga requested changes Jun 15, 2026

View reviewed changes

andrewesweet and others added 2 commits June 16, 2026 16:23

andrewesweet force-pushed the fix/org-settings-fork-422 branch from 73dfb5d to d2a46a4 Compare June 16, 2026 15:25

deiga requested a review from Copilot July 22, 2026 18:07

Copilot started reviewing on behalf of deiga July 22, 2026 18:08 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

lloydmcl mentioned this pull request Aug 30, 2026

fix: include configured false booleans on organization_settings create #3570

Open

3 of 5 tasks

Navigation Menu

fix: avoid 422 when enterprise policy controls org fork setting - #3360

fix: avoid 422 when enterprise policy controls org fork setting#3360
andrewesweet wants to merge 2 commits into
integrations:mainfrom
andrewesweet:fix/org-settings-fork-422

andrewesweet commented Apr 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 22, 2026

Uh oh!

deiga left a comment

Uh oh!

andrewesweet left a comment

Uh oh!

andrewesweet commented May 1, 2026

Uh oh!

andrewesweet commented Jun 10, 2026

Uh oh!

deiga Jun 15, 2026

Uh oh!

deiga Jun 15, 2026

Uh oh!

deiga Jun 15, 2026

Uh oh!

deiga Jun 15, 2026

Uh oh!

deiga Jun 15, 2026

Uh oh!

deiga commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

andrewesweet commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Uh oh!

github-actions Bot commented Apr 22, 2026

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

andrewesweet left a comment

Choose a reason for hiding this comment

Uh oh!

andrewesweet commented May 1, 2026

Uh oh!

andrewesweet commented Jun 10, 2026

Uh oh!

deiga Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

deiga Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

deiga commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andrewesweet commented Apr 22, 2026 •

edited

Loading