feat: Add github_enterprise_app_installation resource by slang25 · Pull Request #3535 · integrations/terraform-provider-github

slang25 · 2026-07-13T22:35:13Z

Resolves #3460

Before the change?

There is no way to install a GitHub App on an organization with access to all repositories via Terraform. github_app_installation_repositories only manages individual repositories on an existing installation, which is impractical for organizations with many repositories and doesn't model the "all repositories" desired state.

After the change?

A new github_enterprise_app_installation resource manages GitHub App installations on enterprise-owned organizations via the enterprise organization-installations API, available on GitHub Enterprise Cloud and GitHub Enterprise Server 3.19+ (verified against the GHES 3.19/3.20 OpenAPI descriptions). The APIs are already present in go-github v89, so no new dependencies.

resource "github_enterprise_app_installation" "example" {
  enterprise_slug      = "my-enterprise"
  organization         = "my-org"
  client_id            = "Iv1.abc123"
  repository_selection = "all" # or "selected" / "none"
}

Implementation notes:

Resource ID is <enterprise_slug>:<organization>:<client_id>, so imports need no installation ID lookup; installation_id and app_slug are computed.
all ↔ selected changes update in place via the toggle endpoint; repository set changes while staying selected use the grant/revoke endpoints (adding before removing so the selection is never empty). Transitions involving none force recreation, since the toggle endpoint only accepts all/selected.
Repository lists are chunked to respect the API's 50-repositories-per-request limit.
Plan-time validation requires selected_repositories exactly when repository_selection = "selected".
Acceptance tests are gated on a new GH_TEST_ENTERPRISE_APP_CLIENT_ID env var (the client ID of an installable app) alongside the existing enterprise test mode, so they skip cleanly where not configured.

I don't have access to an enterprise environment, so the CRUD paths have not been exercised against a live API — I'd appreciate a run of the enterprise acceptance tests. Happy to adjust naming/semantics if maintainers prefer a different shape; I noted #3460 is currently labeled blocked pending enterprise-scope work, but this follows the same enterprise_slug pattern as existing enterprise resources (e.g. github_enterprise_organization).

This PR was developed with AI assistance (Claude); I have reviewed the changes.

Pull request checklist

Schema migrations have been created if needed (example) — not needed, new resource
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Yes
No

🤖 Generated with Claude Code

github-actions · 2026-07-13T22:35:22Z

👋 Hi, and thank you for this contribution!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions.

_{🤖 This is an automated message.}

zry98 · 2026-07-31T21:29:23Z

Hi @slang25, I just found this PR after opening my #3591 yesterday, and it seems better than my implementation in several places!

I noticed these are not covered currently:

It predates the max per page to owner struct refactor merged on July 21, so it references the removed global.
data sources like github_enterprise_app_installations, github_enterprise_app_installable_organizations and github_enterprise_app_accessible_organization_repositories.

Would you update it?

Adds a new resource for installing a GitHub App on an enterprise-owned organization via the enterprise organization-installations API, including support for repository_selection = "all". Available on GitHub Enterprise Cloud and GitHub Enterprise Server 3.19+. Resolves integrations#3460 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Record the enterprise app installation in state as soon as the app is installed, so a failure while granting the remaining (>50) repositories leaves a recoverable resource rather than an orphaned installation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The global maxPerPage constant was moved to the Owner struct in integrations#3555. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds github_enterprise_app_installations, github_enterprise_app_installable_organizations and github_enterprise_app_accessible_organization_repositories. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deiga · 2026-08-09T17:34:06Z

Please remove the docs template files and use the default template.
Your PR description talks about installing a GitHub App to an Organization, yet you only created a resource for enterprise level installations. That seems out-of-place

…late Drop the hand-written per-resource templates in favour of the default tfplugindocs template, so the docs stay in sync with the schema. Move the resource example to the path tfplugindocs discovers (examples/resources/github_enterprise_app_installation/resource.tf) and add import.sh so the import section still renders; the previous path only worked because the hand-written template referenced it by name. Nested attribute descriptions on the data sources' computed lists are lost in the process: SDKv2 collapses computed-only Elem resources to a plain object type, so tfplugindocs renders them as "List of Object". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

These provider review instructions are being used.

Findings

HIGH: Create can clear state or orphan an installation due to read-after-write and delayed installation_id persistence.
MEDIUM: Diff validation mishandles unknown values; update may persist stale state.
MEDIUM: Batching and selected-to-selected updates lack coverage; new resource tests use legacy assertion APIs.

Adds enterprise-level GitHub App installation management and related discovery data sources.

Changes:

Adds CRUD, import, repository-selection updates, and request chunking.
Adds three enterprise App discovery data sources.
Registers and documents the new APIs with examples and acceptance tests.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`RESOURCES.md`	Lists new resource and data sources.
`github/resource_github_enterprise_app_installation.go`	Implements installation lifecycle.
`github/resource_github_enterprise_app_installation_test.go`	Adds resource acceptance tests.
`github/provider.go`	Registers new provider APIs.
`github/data_source_github_enterprise_app_installations.go`	Lists App installations.
`github/data_source_github_enterprise_app_installations_test.go`	Tests installation lookup.
`github/data_source_github_enterprise_app_installable_organizations.go`	Lists installable organizations.
`github/data_source_github_enterprise_app_installable_organizations_test.go`	Tests organization lookup.
`github/data_source_github_enterprise_app_accessible_organization_repositories.go`	Lists accessible repositories.
`github/data_source_github_enterprise_app_accessible_organization_repositories_test.go`	Tests repository lookup.
`examples/resources/github_enterprise_app_installation/resource.tf`	Demonstrates installation configurations.
`examples/resources/github_enterprise_app_installation/import.sh`	Demonstrates import syntax.
`examples/data-sources/github_enterprise_app_installations/data-source_1.tf`	Adds installations example.
`examples/data-sources/github_enterprise_app_installable_organizations/data-source_1.tf`	Adds organizations example.
`examples/data-sources/github_enterprise_app_accessible_organization_repositories/data-source_1.tf`	Adds repositories example.
`docs/resources/enterprise_app_installation.md`	Documents the resource.
`docs/data-sources/enterprise_app_installations.md`	Documents installations data source.
`docs/data-sources/enterprise_app_installable_organizations.md`	Documents organizations data source.
`docs/data-sources/enterprise_app_accessible_organization_repositories.md`	Documents repositories data source.

Suppressed comments (2)

github/resource_github_enterprise_app_installation_test.go:111

This new TestStep also uses the legacy Check/TestCheckResourceAttr API. Convert it to ConfigStateChecks with statecheck/knownvalue to follow the repository's required convention for new tests.

					Check: resource.ComposeTestCheckFunc(
						resource.TestCheckResourceAttr("github_enterprise_app_installation.test", "repository_selection", "all"),
						resource.TestCheckResourceAttr("github_enterprise_app_installation.test", "selected_repositories.#", "0"),
					),

github/resource_github_enterprise_app_installation_test.go:104

This new TestStep uses legacy Check and TestCheckResourceAttr assertions. Replace them with equivalent ConfigStateChecks using statecheck/knownvalue, as required for newly added tests in this repository.

					Check: resource.ComposeTestCheckFunc(
						resource.TestCheckResourceAttr("github_enterprise_app_installation.test", "repository_selection", "selected"),
						resource.TestCheckResourceAttr("github_enterprise_app_installation.test", "selected_repositories.#", "1"),
					),

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+	installation, _, err := client.Enterprise.InstallApp(ctx, enterpriseSlug, org, req)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	// Record the resource in state as soon as the app is installed, so a
+	// failure while granting the remaining repositories leaves a recoverable
+	// resource rather than an orphaned installation.
+	id, err := buildID(enterpriseSlug, org, clientID)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+	d.SetId(id)
+
+	if err := addEnterpriseAppInstallationRepositories(ctx, client, enterpriseSlug, org, installation.GetID(), remainder); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return resourceGithubEnterpriseAppInstallationRead(ctx, d, meta)


+			func(ctx context.Context, d *schema.ResourceDiff, meta any) error {
+				selection := d.Get("repository_selection").(string)
+				repoCount := d.Get("selected_repositories").(*schema.Set).Len()


+		}
+	}
+
+	return resourceGithubEnterpriseAppInstallationRead(ctx, d, meta)


+	if len(repositories) > maxInstallationRepositoriesPerRequest {
+		initial = repositories[:maxInstallationRepositoriesPerRequest]
+		remainder = repositories[maxInstallationRepositoriesPerRequest:]


+	} else if d.HasChange("selected_repositories") {
+		oldRepos, newRepos := d.GetChange("selected_repositories")
+		oldSet := oldRepos.(*schema.Set)
+		newSet := newRepos.(*schema.Set)


+			Steps: []resource.TestStep{
+				{
+					Config: config,
+					Check:  check,


Create ended by calling the read function, which resolves the installation through a list endpoint. An eventually consistent list that does not yet include the new installation would clear the resource ID, leaving the installation orphaned outside state. Update had the same problem in reverse, writing a stale repository selection back over the value that was just applied. Both endpoints return the installation, so set the computed fields from the install response and return without a read, in line with the provider's no-read-after-write convention (integrations#2892). 'installation_id' is now written before the remaining repositories are granted, so a failure there still leaves a resource that Delete can uninstall. Also skip the repository selection diff validation while either value is unknown; unknown values read back as their zero value, so a valid 'selected_repositories' computed from another resource failed planning with "must be set". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

New tests are expected to assert with ConfigStateChecks rather than the legacy Check and TestCheckResourceAttr pattern. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deiga · 2026-08-10T14:31:37Z

I still think there needs to be a distinction for "installation of an enterprise app to an Organisation" and "installation of an enterprise app to an Enterprise" and both of those should be covered in this PR.

zry98 · 2026-08-10T15:20:28Z

I still think there needs to be a distinction for "installation of an enterprise app to an Organisation" and "installation of an enterprise app to an Enterprise" and both of those should be covered in this PR.

@deiga As far as I know, GitHub's current API doesn't have "installation of an enterprise app to an Enterprise"-related endpoints. Only installation to organizations owned by an enterprise.

'github_enterprise_app_installation' reads as though it installs an app on an enterprise account. It does not: every endpoint behind it is scoped to an organization the enterprise owns, and GitHub has no API for installing an app on the enterprise account itself. The only enterprise-level operation GitHub exposes is 'GET /enterprises/{enterprise}/installation', which lets an app find its own installation, so the distinction cannot be resolved by adding a second resource. Name the target instead: github_enterprise_app_installation -> github_enterprise_organization_app_installation github_enterprise_app_installations -> github_enterprise_organization_app_installations github_enterprise_app_accessible_organization_repositories -> github_enterprise_organization_app_accessible_repositories 'github_enterprise_app_installable_organizations' keeps its name; it is the one API here that is genuinely enterprise-scoped. The resource description now states that the app is installed on the organization rather than the enterprise account. Nothing here has been released, so no state migration or 'moved' block is required. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deiga · 2026-08-10T15:43:56Z

That is a fair point! 🤦‍♂️

slang25 · 2026-08-10T16:13:35Z

I've renamed the resources to avoid confusion, but happy to revert if we prefer terser names

marcelosinhorini-jet approved these changes Jul 14, 2026

View reviewed changes

zry98 mentioned this pull request Jul 31, 2026

feat: Add resources and data sources for enterprise-owned organization app installations #3591

Closed

5 tasks

slang25 and others added 3 commits July 31, 2026 23:39

chore: Use Owner maxPerPage after per-page refactor

4708b77

The global maxPerPage constant was moved to the Owner struct in integrations#3555. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

slang25 force-pushed the slang25/github-issue-3460-feature branch from 79ef8dc to 4708b77 Compare July 31, 2026 21:42

zry98 approved these changes Jul 31, 2026

View reviewed changes

feat: Add enterprise app installation data sources

2f3d5f1

Adds github_enterprise_app_installations, github_enterprise_app_installable_organizations and github_enterprise_app_accessible_organization_repositories. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deiga requested a balanced review from Copilot August 9, 2026 20:33

Copilot started reviewing on behalf of deiga August 9, 2026 20:33 View session

Copilot AI reviewed Aug 9, 2026

View reviewed changes

slang25 and others added 2 commits August 10, 2026 13:38

test: Use ConfigStateChecks for app installation assertions

f2c0cab

New tests are expected to assert with ConfigStateChecks rather than the legacy Check and TestCheckResourceAttr pattern. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Navigation Menu

Uh oh!

feat: Add github_enterprise_app_installation resource - #3535

feat: Add github_enterprise_app_installation resource#3535
slang25 wants to merge 8 commits into
integrations:mainfrom
slang25:slang25/github-issue-3460-feature

slang25 commented Jul 13, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

zry98 commented Jul 31, 2026 •

edited

Loading

Uh oh!

deiga commented Aug 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

deiga commented Aug 10, 2026

Uh oh!

zry98 commented Aug 10, 2026

Uh oh!

deiga commented Aug 10, 2026

Uh oh!

slang25 commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

slang25 commented Jul 13, 2026

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

zry98 commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deiga commented Aug 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Findings

Reviewed changes

Uh oh!

deiga commented Aug 10, 2026

Uh oh!

zry98 commented Aug 10, 2026

Uh oh!

deiga commented Aug 10, 2026

Uh oh!

slang25 commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zry98 commented Jul 31, 2026 •

edited

Loading