Terraform GitHub Provider v6.13.0: New API Client, Ruleset Bypass Actors, and Key Bugfixes

Introduction

The integrations/terraform-provider-github provider has released v6.13.0 (release notes). This release is mostly about internal plumbing — a rewritten GitHub API client — plus two new ruleset bypass actor types and a batch of reliability fixes for teams, repository collaborators, and environments. This is the first article on terraformpilot.com covering this provider, so version history before v6.13.0 is not compared.

What Is New

Rewritten GitHub API client

The provider ships a new GitHub API client implementation (#3448), built on go-github v88 (#3441), with explicit concurrency control (#3491) and a refactored base-URL handling path (#3510). This is internal groundwork aimed at more predictable behavior against the GitHub API — no HCL changes are required to pick it up, but it's worth noting in case you see slightly different retry/throttling behavior during apply.

New ruleset bypass actor types

Repository and organization rulesets now accept two additional bypass_actors types:

• EnterpriseOwner (#3487)
• User (#3438)

Example using a User bypass actor on a repository ruleset:

resource "github_repository_ruleset" "main" {
  name        = "protect-main"
  repository  = github_repository.example.name
  target      = "branch"
  enforcement = "active"
 
  conditions {
    ref_name {
      include = ["~DEFAULT_BRANCH"]
      exclude = []
    }
  }
 
  bypass_actors {
    actor_id    = 123456 # user ID
    actor_type  = "User"
    bypass_mode = "always"
  }
 
  bypass_actors {
    actor_id    = 1
    actor_type  = "EnterpriseOwner"
    bypass_mode = "always"
  }
 
  rules {
    deletion = true
  }
}

If you previously worked around the lack of User/EnterpriseOwner bypass actor support (e.g., by modeling bypass only at the OrganizationAdmin/RepositoryRole/Team level), you can now simplify those rulesets.

Reliability fixes worth knowing about

• github_team_repository: fixed a nil-pointer panic on delete (#3518). If you've seen crashes during terraform destroy or terraform apply with removed team-repository associations, this is addressed.
• github_team_members: refactored (#3499) to read only immediate team members instead of pulling in child-team members (#3498), and to skip deletion gracefully when the parent team is already gone (#3461, originally filed as #3176/#3461). If your state previously drifted because child-team membership was being read into a parent team's github_team_members resource, expect a plan diff on upgrade as the provider now reports membership correctly.
• Repository collaborators: stopped drifting on the repository owner (#3471) — a perpetual diff some users saw on every plan should disappear.
• Repository environments: corrected the diff logic for github_repository_environment (#3469), reducing spurious plan changes.
• github_repository_file: fixed ID escaping (#3415).
• github_default_branch: improved import behavior (#3216).
• Autolink references: added plan-time validation to key_prefix on the autolink reference resource (#3176/#3277).

CI/process changes

Acceptance-test automation is now enabled in CI (#3502) and stricter linting applies to new code (#3430). These don't affect consumers directly but should mean fewer regressions in future releases.

Upgrade Steps

Pin the provider to v6.13.0 (or an appropriate ~> constraint) in your Terraform configuration:

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "~> 6.13.0"
    }
  }
}

Then upgrade the provider and refresh the lock file:

terraform init -upgrade

If you manage multiple workspaces/modules, re-run terraform providers lock for all required platforms before committing .terraform.lock.hcl:

terraform providers lock \
  -platform=linux_amd64 \
  -platform=darwin_amd64 \
  -platform=darwin_arm64

Because of the github_team_members read-behavior fix (#3498/#3499), run a plan before applying anywhere you use that resource with nested/child teams — expect a one-time diff as state reconciles to the corrected membership list. Review it carefully rather than blindly accepting.

Verify

Confirm the installed provider version and check for unexpected diffs:

terraform providers
terraform plan

For github_repository_ruleset resources, confirm that any newly added User or EnterpriseOwner bypass actors show up correctly:

terraform state show github_repository_ruleset.main

If you rely on github_repository_environment, github_team_members, or repository collaborators, run terraform plan on those resources specifically and confirm the diff count has dropped compared to pre-upgrade runs.

Conclusion

v6.13.0 is primarily a stability and internals release: a rewritten API client on go-github v88, two new ruleset bypass actor types (User, EnterpriseOwner), and fixes for long-standing drift issues in github_team_members, repository collaborators, and repository environments. No HCL schema changes are required for most users, but plan carefully around github_team_members before applying, since the corrected read logic can surface a one-time state diff. Full details are in the v6.13.0 release notes.