Unable to import installation repository using GH App credentials

[gmile]

Terraform Version

$ terraform --version
Terraform v1.0.0
on darwin_amd64
$

Affected Resource

• github_app_installation_repository

Terraform Configuration Files

provider "github" {
  owner = "our_org_name"

  app_auth {
    id              = var.github_app_id
    installation_id = var.github_app_installation_id
    pem_file        = file(var.github_app_pem_file)
  }
}

resource "github_app_installation_repository" "file_service" {}

Debug Output

None.

Panic Output

None.

Expected Behavior

Repository installation is imported. Or docs specify that importing installations using app credentials is not possible.

Actual Behavior

An authentication error:

$ terraform import github_app_installation_repository.file_service 12345678:file_service
github_app_installation_repository.file_service: Importing from ID "12345678:file_service"...
github_app_installation_repository.file_service: Import prepared!
  Prepared github_app_installation_repository for import
github_app_installation_repository.file_service: Refreshing state... [id=12345678:file_service]
╷
│ Error: GET https://api.github.com/user/installations/12345678/repositories?per_page=100: 403 Resource not accessible by integration []
$

Steps to Reproduce

1. Configure GitHub App with the following permissions:

   • Read access to metadata
   • Read and write access to actions and secrets

2. Configure application ID and installation ID for terraform (see .hcl sample block above),

3. Attempt to import the resource:

   terraform import github_app_installation_repository.file_service 12345678:file_service
   

Important Factoids

I am unable to locate the API endpoint corresponding to the error on the "Permissions required for GitHub Apps" page. Is it even possible that the App itself can regulate repos it is installed to?

References

• Add github_app_installation_repository resource #690

[loozhengyuan]

It seems that the endpoint in the error cannot be used with GitHub Apps credentials.

You must use a user-to-server OAuth access token, created for a user who has authorized your GitHub App, to access this endpoint.

I've opened #817 separately to track the documentation of incompatibility on the specific data sources or resources.

[gmile]

@loozhengyuan thank you! I'm closing this in favor of the one you've opened.