complete

Complete example

The full surface: repository, environment and (gated) organization scopes, literal values, and the (gated) Key Vault sync. Set enable_org_scope and enable_key_vault_sync to exercise those paths.

Example configuration

# The full surface: repository, environment and (gated) organization scopes, literal values, and
# the Key Vault sync (gated). Gated entries ride through a for/if merge so the types stay unified.
resource "github_repository_environment" "demo" {
  repository  = var.repository
  environment = "demo"
}

locals {
  base_secrets = {
    # Repository scope, literal value.
    "DEMO_REPO_SECRET" = {
      repository = var.repository
      value      = "repo-secret-value"
    }
    # Environment scope, literal value.
    "DEMO_ENV_SECRET" = {
      scope       = "environment"
      repository  = var.repository
      environment = github_repository_environment.demo.environment
      value       = "env-secret-value"
    }
  }

  org_secrets = {
    "DEMO_ORG_SECRET" = {
      scope      = "organization"
      visibility = "private"
      value      = "org-secret-value"
    }
  }

  kv_secrets = {
    "DEMO_SYNCED_SECRET" = {
      repository            = var.repository
      key_vault_id          = var.key_vault_id
      key_vault_secret_name = var.kv_secret_name
    }
  }
}

module "github_actions_secrets" {
  source = "../../"

  secrets = merge(
    local.base_secrets,
    { for k, v in local.org_secrets : k => v if var.enable_org_scope },
    { for k, v in local.kv_secrets : k => v if var.enable_key_vault_sync },
  )

  variables = {
    "DEMO_REPO_VARIABLE" = {
      repository = var.repository
      value      = "repo-variable-value"
    }
    "DEMO_ENV_VARIABLE" = {
      scope       = "environment"
      repository  = var.repository
      environment = github_repository_environment.demo.environment
      value       = "env-variable-value"
    }
  }
}

Requirements

Name	Version
terraform	>= 1.9.0, < 2.0.0
azurerm	>= 4.0.0, < 5.0.0
github	>= 6.0.0, < 7.0.0

Providers

Name	Version
github	>= 6.0.0, < 7.0.0

Modules

Name	Source	Version
github_actions_secrets	../../	n/a

Resources

Name	Type
github_repository_environment.demo	resource

Inputs

Name	Description	Type	Default	Required
enable_key_vault_sync	Also sync a secret from Key Vault (needs key_vault_id and kv_secret_name).	bool	false	no
enable_org_scope	Also manage an organization-scoped secret (needs org admin).	bool	false	no
github_owner	GitHub owner (org or user).	string	"libre-devops"	no
github_token	GitHub token with rights to set the repo (and, for the org scope, org) Actions config.	string	""	no
key_vault_id	Key Vault id to sync a secret from (when enable_key_vault_sync).	string	""	no
kv_secret_name	Key Vault secret name to sync (when enable_key_vault_sync).	string	""	no
repository	Repository to manage secrets and variables on.	string	"terraform-github-actions-secrets"	no

Outputs

Name	Description
secret_names	Managed secret names by scope.
synced_from_key_vault	Logical keys synced from Key Vault.
variable_names	Managed variable names by scope.