Skip to content

[FEAT]: Support write-only (ephemeral) values for GitHub environment secrets in Terraform #3202

@amitkumar2283

Description

@amitkumar2283

Describe the need

Summary

We need to create GitHub environment secrets via Terraform without persisting sensitive values in state.

Problem

Terraform now supports ephemeral values, which allows generating secrets without statefile persistence. However, the GitHub provider does not support write-only (_wo) arguments for secrets, so any secret value passed to github_actions_environment_secret is stored in the Terraform state.

Why this matters

This prevents using Terraform to manage GitHub environment secrets in a secure, state-free way, even when the secret is generated ephemerally.

Expected behavior

Allow write-only (or equivalent) secret inputs for GitHub environment secrets so sensitive values are never written to state.

SDK Version

No response

API Version

No response

Relevant log output

Code of Conduct

  • I agree to follow this project's Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions