fix: Add destroy-on-drift property to the GitHub Action Secret resource schema

[nickfloyd]

Resolves #964
Resolves #2804

NOTE: Intended to be patched into v2.7.1 and merged into main.

---

Before the change?

• Prior to this change there was no way to control actions secrets from either being or not being destroyed and created

After the change?

• We can now use the destroy_on_drift property to indicate if we should recreate if the secret was modified outside of the context of the provider.
• Fixes the a bug where destroyOnDrift=true (which is the default) and drift is detected, the code sets d.SetId("") but does NOT update the timestamp. This means on the next Terraform run, the old timestamp is still in state, so it will detect drift again, causing an infinite loop of "Provider produced inconsistent result" errors.

Pull request checklist

• Schema migrations have been created if needed (example)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[nickfloyd]

cc: @grimm26

[pickgr]

When upgrading the provider from 6.7.1 to 6.7.2, I'm seeing the following error:

╷
│ Error: InternalValidate
│
│   with module.github.provider["registry.terraform.io/integrations/github"],
│   on ../../modules/github/provider-github.tf line 3, in provider "github":
│    3: provider "github" {
│
│ Internal validation of the provider failed! This is always a bug
│ with the provider itself, and not a user issue. Please report
│ this bug:
│
│ resource github_actions_secret: No Update defined, must set ForceNew on: []string{"destroy_on_drift"}
╵

Is there a work-around for this?

[jkstpierre]

Running into the same issue as @pickgr here...

[nickfloyd]

@pickgr @jkstpierre Closing this PR - let me see if I can track down the issue or come up with a workaround. Apologies for the trouble - it looks like I might've left off the Update function but I need to verify - even though the resource does not have one the interface requires it.

Update:

It appears that I missed it in my cherry pick into the patch. The change is present in this branch but not in the patch.

Org update has the correct fix in the patch here.

[pickgr]

@pickgr @jkstpierre Closing this PR - let me see if I can track down the issue or come up with a workaround. Apologies for the trouble - it looks like I might've left off the Update function but I need to verify - even though the resource does not have one the interface requires it.

Update:

It appears that I missed it in my cherry pick into the patch. The change is present in this branch but not in the patch.

Org update has the correct fix in the patch here.

Thanks @nickfloyd ! I just confirmed this is fixed in version 6.7.3

[nnellanspdl]

Is this a user-configurable setting? If yes, do the docs need updated? https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_secret

[oskarsword]

Too bad it was not implemented for github_environment_secrets that are facing the exact same issue.
It even says the resoruce supports ignore_change lifecycle parameter but it still replaces it due to "drift".