feat: add enterprise network configuration support by austenstone · Pull Request #3274 · integrations/terraform-provider-github

austenstone · 2026-03-15T15:58:19Z

Overview

This PR adds enterprise-scoped hosted compute network configuration support for GitHub-hosted private networking.

It introduces a new github_enterprise_network_configuration resource and adds network_configuration_id support to github_enterprise_actions_runner_group so enterprise runner groups can be associated with hosted compute network configurations.

This work is closely related to the organization-scoped implementation in #2895, and follows the same review-driven cleanup patterns to stay aligned with current project conventions.

What this PR adds

New resource: github_enterprise_network_configuration
Full CRUD support for enterprise network configurations
Import support for enterprise network configurations
network_configuration_id support in github_enterprise_actions_runner_group
Acceptance coverage for enterprise network configuration create/update/import flows
Acceptance coverage for enterprise runner group private networking association flows
Documentation updates for enterprise network configuration and enterprise runner groups

Notes

GitHub-hosted private networking is attached through the runner group via network_configuration_id.
The runner group create endpoint does not accept network_configuration_id, so the provider applies the networking association with a follow-up PATCH after creation.
This branch was cleaned up to mirror the review feedback already applied on the organization-scoped work in #2895: direct state setting in Create, safer GitHub error response checks, and ConfigStateChecks for the newer acceptance assertions.
This PR also includes a small correctness fix in the touched runner group read path: getOrganizationRunnerGroup now only swallows 304 Not Modified instead of treating arbitrary ErrorResponse values as cache hits.
Runner group Create now sets Terraform state directly from the create response and only falls back to a follow-up Read when the private networking association requires the extra PATCH.

Validation

make testacc
make test

…entation

…etwork configurations

… groups

…groups

…tation for network settings

…date related documentation

github-actions · 2026-03-15T15:58:28Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

deiga · 2026-03-15T16:14:54Z

Your validation commands would not actually run the tests. You should use make testacc and make test

…d unit tests for normalization

…proved readability

…tate management

…n documentation

…ement

…ions

tag-assistant

Re-review ✅

All previous feedback addressed, plus some nice extras:

Addressed:

✅ Shared runnerGroupNetworking struct + helpers in resource_github_actions_runner_group_networking.go — clean dedup
✅ getRunnerGroupNetworking now takes a path string, works for both org and enterprise scopes
✅ Trailing newline fixed on enterprise docs
✅ StatusNotModified handling added to getRunnerGroupNetworking — consistent with the rest of the codebase

Bonus improvements (not requested):

🧪 173-line unit test file for all three shared helpers (get, update, setState) — including 304 handling and null payload for removal. Solid.
🔧 normalizeEtag() in util.go to handle weak vs strong ETag drift between create and read paths — nice catch, prevents state churn.
🧪 Unit tests for normalizeEtag covering empty, strong, weak, and whitespace cases.

LGTM. Ship it 🚢

deiga

Partial review

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T20:16:35Z

github/resource_github_actions_runner_group_helpers.go

+		"network_configuration_id": networkConfigurationID,
+	}
+
+	req, err := client.NewRequest("PATCH", path, payload)


issue: use only go-github provided functions

I checked go-github v83 locally before changing this — there isn’t a first-class runner-group networking method for this endpoint yet, so this still has to stay as a thin NewRequest/Do shim for now.

With google/go-github#4099, UpdateOrganizationRunnerGroup now accepts NetworkConfigurationID in the request struct, and GetOrganizationRunnerGroup returns it on the response. So yes — once that merges, this raw call can be replaced with the native go-github UpdateOrganizationRunnerGroup/UpdateEnterpriseRunnerGroup functions and the separate getRunnerGroupNetworking GET becomes unnecessary too.

github/resource_github_enterprise_actions_runner_group.go

github/resource_github_enterprise_actions_runner_group_test.go

… improve error handling

deiga

Partial review

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T21:09:06Z

github/resource_github_actions_runner_group.go

+		networkConfigurationIDValue := networkConfigurationID.(string)
+		// The create endpoint does not accept network_configuration_id, so private networking
+		// must be attached with a follow-up PATCH after the runner group has been created.
+		if _, err = updateRunnerGroupNetworking(client, ctx, fmt.Sprintf("orgs/%s/actions/runner-groups/%d", orgName, runnerGroup.GetID()), &networkConfigurationIDValue); err != nil {


Isn't this UpdateOrganizationRunnerGroup what you're looking for?

Yes — once google/go-github#4099 merges, UpdateOrganizationRunnerGroup will carry NetworkConfigurationID natively and this raw call goes away.

That doesn't make sense. The function already exists

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T21:14:07Z

github/resource_github_actions_runner_group.go

+	if runnerGroup != nil {
+		if err = setGithubActionsRunnerGroupState(d, runnerGroup, runnerGroupEtag, selectedRepositoryIDs); err != nil {
+			return diag.FromErr(err)
+		}
+	} else {


Please explain this branching logic? Why aren't we setting the state values to nil if api returned nil?

The nil case happens on a 304 Not Modified — the API returned no body, so runnerGroup is nil but resp is valid. In that case we can't call setGithubActionsRunnerGroupState (it'd nil-pointer on the getter methods), but we still need to update selected_repository_ids and etag since those came from separate API calls that did succeed. The rest of state stays untouched from the previous read, which is correct for a not-modified response.

If the GET returned nil, then we need to exit early, instead of doing conditional setting

deiga · 2026-03-16T21:15:00Z

github/resource_github_actions_runner_group.go

+			networkConfigurationIDValue = &value
+		}
+
+		if _, err := updateRunnerGroupNetworking(client, ctx, fmt.Sprintf("orgs/%s/actions/runner-groups/%d", orgName, runnerGroupID), networkConfigurationIDValue); err != nil {


What about UpdateOrganizationRunnerGroup in go-github?

deiga · 2026-03-16T21:16:27Z

github/resource_github_actions_runner_group_helpers.go

+}
+
+func getRunnerGroupNetworking(client *github.Client, ctx context.Context, path string) (*runnerGroupNetworking, *github.Response, error) {
+	req, err := client.NewRequest("GET", path, nil)


If the functions don't exist in go-github, then you should open a PR in there to add them. We don't accept direct API endpoint interactions

github/resource_github_actions_runner_group_helpers_test.go

…unner group types Add NetworkConfigurationID and HostedRunnersURL fields to EnterpriseRunnerGroup, and NetworkConfigurationID to CreateEnterpriseRunnerGroupRequest and UpdateEnterpriseRunnerGroupRequest to match the GitHub API response schema. These fields already exist on the organization-scoped RunnerGroup type but were missing from the enterprise equivalents. The GitHub API returns both fields on enterprise runner group endpoints (List, Get, Create, Update). Fixes: integrations/terraform-provider-github#3274

The response is always non-nil on the success path — if the API call errors we return early, and even the 304 Not Modified path returns a valid response object. The fallback to the stored ETag was unreachable.

…ming confusion

austenstone · 2026-03-16T21:56:16Z

All review feedback addressed except the raw NewRequest/Do calls — those are blocked on google/go-github#4099 which adds NetworkConfigurationID to the runner group structs. Once that merges and we bump the dependency, the helpers file goes away and networking flows through the native UpdateOrganizationRunnerGroup/UpdateEnterpriseRunnerGroup functions.

austenstone · 2026-03-17T03:54:47Z

Friendly bump — any chance this could get a review? Happy to address feedback. Thanks!

austenstone added 15 commits March 15, 2026 03:01

feat: add organization network configuration resource

eebea06

refactor: clean up network configuration resource

f562c9b

test: align network configuration resource with repo patterns

290b604

docs: polish organization network configuration resource

6d6b598

refactor: use RFC3339 constant for network configuration timestamps

4f00048

refactor: address network configuration review comments

e487e35

refactor: align network configuration with project patterns

e8b240b

feat: add link for github_organization_network_configuration in docum…

4d3ceb3

…entation

refactor: enhance error handling and documentation for organization n…

7d1303d

…etwork configurations

feat: add support for network configurations in GitHub Actions runner…

44bdafc

… groups

feat: add network configuration validation for GitHub Actions runner …

3aebd44

…groups

feat: update advanced hosted runner configuration and enhance documen…

6127464

…tation for network settings

feat: add support for GitHub enterprise network configurations and up…

c195eac

…date related documentation

refactor: align runner group networking with review feedback

bbb82ab

refactor: align enterprise runner group networking with review feedback

c9651c4

github-actions bot added the Type: Feature New feature or request label Mar 15, 2026

This comment was marked as resolved.

Sign in to view

austenstone added 6 commits March 15, 2026 20:14

feat: normalize ETag handling in runner group state management and ad…

c1d1171

…d unit tests for normalization

fix: use context directly in runner group networking functions for im…

10aed4c

…proved readability

refactor: consolidate runner group networking functions and improve s…

5a7765e

…tate management

fix: ensure newline at end of file in enterprise network configuratio…

31d1327

…n documentation

feat: add tests for runner group networking functions and state manag…

6e4df39

…ement

Merge branch 'main' into feature/github-enterprise-network-configurat…

b9dbd10

…ions

austenstone mentioned this pull request Mar 16, 2026

feat: Add github_organization_network_configuration resource #2895

Closed

austenstone requested a review from tag-assistant March 16, 2026 16:42

tag-assistant approved these changes Mar 16, 2026

View reviewed changes

deiga suggested changes Mar 16, 2026

View reviewed changes

feat: update GitHub Actions runner group functions to use context and…

7746933

… improve error handling

deiga suggested changes Mar 16, 2026

View reviewed changes

austenstone mentioned this pull request Mar 16, 2026

feat: Add NetworkConfigurationID and HostedRunnersURL to enterprise runner group types google/go-github#4099

Merged

austenstone added 3 commits March 16, 2026 17:46

fix: remove unnecessary resp nil guards in runner group Read/Update

539a55e

The response is always non-nil on the success path — if the API call errors we return early, and even the 304 Not Modified path returns a valid response object. The fallback to the stored ETag was unreachable.

refactor: rename runner group networking helpers to avoid resource na…

f50bb6b

…ming confusion

refactor: remove unnecessary ctx and blank lines per review

b035f6f

Conversation

austenstone commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

What this PR adds

Notes

Validation

Uh oh!

github-actions bot commented Mar 15, 2026

Uh oh!

deiga commented Mar 15, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

tag-assistant left a comment

Choose a reason for hiding this comment

Re-review ✅

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

austenstone commented Mar 16, 2026

Uh oh!

austenstone commented Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

austenstone commented Mar 15, 2026 •

edited

Loading