Skip to content

fix: omit repo-level web_commit_signoff_required when org-enforced #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NWarila merged 1 commit into from
Jul 21, 2026
Merged

fix: omit repo-level web_commit_signoff_required when org-enforced #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions terraform/30-locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,11 @@ locals {
delete_branch_on_merge = true
squash_merge_commit_title = "PR_TITLE"
squash_merge_commit_message = "PR_BODY"
web_commit_signoff_required = true
# Omit at the repo level: web_commit_signoff is ORG-ENFORCED (org_settings), and
# GitHub 422s any repo-level write of it once enforced ("cannot be disabled").
# null => the attribute is omitted, so the org setting is the single source of
# truth. A repo's YAML may still explicitly set it to override.
web_commit_signoff_required = null
auto_init = true
license_template = null
archived = false
Expand Down Expand Up @@ -551,9 +555,18 @@ locals {
local.repo_setting_defaults.squash_merge_commit_title
)

web_commit_signoff_required = coalesce(
try(repository.web_commit_signoff_required, null),
local.repo_setting_defaults.web_commit_signoff_required
# web_commit_signoff is ORG-ENFORCED when org_settings sets it true: GitHub
# then 422s ANY repo-level write of the attribute ("cannot be disabled"), so
# when the org enforces it the repo value MUST be null (omit) regardless of
# YAML. When the org does NOT enforce it, respect the repo level: the repo's
# YAML value if set, else the null default (still omit). try (not coalesce)
# because the default is null and coalesce rejects an all-null argument list.
# try(...) on the org read: local.organization_settings is null in personal
# mode (no org enforcement), in which case we respect the repo level.
web_commit_signoff_required = (
try(local.organization_settings.web_commit_signoff_required, false)
? null
: try(repository.web_commit_signoff_required, local.repo_setting_defaults.web_commit_signoff_required)
)

#endregion --- [ Merge Behavior ] ------------------------------------------------------ #
Expand Down
4 changes: 2 additions & 2 deletions terraform/tests/normalization.tftest.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,8 +440,8 @@ run "good_minimal_carries_expected_defaults" {

# Commit signoff
assert {
condition = output.all_repositories["example-public-repo"].web_commit_signoff_required == true
error_message = "web_commit_signoff_required default must be true"
condition = output.all_repositories["example-public-repo"].web_commit_signoff_required == null
error_message = "web_commit_signoff_required must default to null (omit) at the repo level — org enforcement is the source of truth"
}

# Init / licensing
Expand Down
Loading