github_team is created with the Terraform user added as an extra member

[morancj]

Terraform Version

Terraform v0.12.24

• provider.aws v2.59.0
• provider.github v2.8.1

Affected Resource(s)

• github_team
• (optionally) github_team_membership

Terraform Configuration Files

resource "github_team" "tftest" {
  name        = "tftest"
  description = "Test team"
  privacy     = "closed"
}

Debug Output

Not relevant: trivial to reproduce. Let me know otherwise, because redacting will take some effort.

Expected Behavior

Team created with no members

Actual Behavior

The user under which terraform is run is silently added as a member to the new team. This membership does not appear in the output or state file.

Steps to Reproduce

Create a new team with or without any github_team_membership entries.
Team will be created with members + terraform_user, if terraform_user is not a member.

Important Factoids

Creating the team through GitHub's Web UI (BUI) automatically adds the user creating the team as a member.

References

Presumably, this is because of:
https://github.com/google/go-github/blob/954e7c82b2994a9f418f300c3f1e147f6a51bd29/github/teams.go#L172:24
and
https://developer.github.com/v3/teams/#create-a-team
The latter states:

When you create a new team, you automatically become a team maintainer without explicitly adding yourself to the optional array of maintainers. For more information, see "About teams" in the GitHub Help documentation.

[sfdc-afraley]

This is especially confusing when you're testing with your account and creating teams where you yourself are a member. It adds you as a maintainer, but then a second terraform run will want to change your role. For example:

resource "github_team" "teams" {
  name        = "team1"
  privacy     = "closed"
}

resource "github_team_membership" "some_team_membership" {
  team_id  = github_team.teams.id
  username = "myuser"
  role     = "member"
}

Second TF apply:

# module.main.github_team_membership.membership["myuser:team1"] will be updated in-place
  ~ resource "github_team_membership" "some_team_membership" {
        id       = "1234567:myuser"
      ~ role     = "maintainer" -> "member"
        team_id  = "1234567"
        username = "myuser"
    }

[thekbb]

Still relevant with
Terraform 0.13.5
provider.github 2.9.2

For context: This would simplify things for me as we're using teams and CODEOWNERS for some approval workflows, and the service account that creates the team shouldn't be able to approve things.

[ghost]

It would be great if we could pass a map of members/role to the resource. It could then diff what we define and what's there, thus removing that auto-added creator.

[jcudit]

Ah, that's a good idea! Read it too late though and merged the workaround instead 🙃 . Seems like the right fix though and we can aim to get that option added in a future release.

[github-actions]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!

[github-actions]

👋 Hey Friends, this issue has been automatically marked as stale because it has no recent activity. It will be closed if no further activity occurs. Please add the Status: Pinned label if you feel that this issue needs to remain open/active. Thank you for your contributions and help in keeping things tidy!