jfrog / terraform-provider-xray

Terraform provider to manage JFrog Xray
https://jfrog.com/xray/
Apache License 2.0
151 stars 12 forks source link

Allow disabling specific risks in `xray_operational_risk_policy`'s `rule.criteria.op_risk_custom` block #138

Closed eval-on-point closed 1 year ago

eval-on-point commented 1 year ago

I want to create an xray_operational_risk_policy that does not check the newer_versions_greater_than condition. Removing the condition from my rule.criteria.op_risk_custom block seems to just default the condition check to its default value rather than disable the condition check.

For example:

resource "xray_operational_risk_policy" "min_risk" {
  name        = "example"
  type        = "operational_risk"
  project_key = "test-project"

  rule {
    name     = "high-op-risk-alert"
    priority = 1

    criteria {
      op_risk_custom {
        use_and_condition                  = true
        is_eol                             = false
        #newer_versions_greater_than        = false
        committers_less_than               = 1
        risk                               = "medium"
      }
    }

    actions {
      mails                              = ["example@example.invalid"]
      block_release_bundle_distribution  = false
      notify_watch_recipients            = true
      notify_deployer                    = false
      create_ticket_enabled              = false // set to true only if Jira integration is enabled
      build_failure_grace_period_in_days = 5     // use only if fail_build is enabled
      fail_build                         = true

      block_download {
        unscanned = false
        active    = false
      }
    }
  }
}

Creates a policy with rules that look like this: image

I want to be able to define this resource such that the box to the left of "Number of releases since greater than" is unchecked.

alexhung commented 1 year ago

@eval-on-point This issue stems from the combination of:

  1. The provider has a default value of 1 set for this attribute, and
  2. shortcoming of Terraform SDK: https://discuss.hashicorp.com/t/is-it-possible-to-differentiate-between-a-zero-value-and-a-removed-property-in-the-terraform-provider-sdk/43131/2.

To fix this issue, this is what I'm changing for this resource:

These do mean that when you upgrade the provider, there may be state drifts for these policy resources as the provide code can't distinguish between default values vs configuration values so it can't automatically upgrade the TF state for you.