Expected Behavior
Reading/refreshing a github_repository_environment whose required reviewers include a GitHub Enterprise Team should succeed — either representing that reviewer in state, or ignoring it gracefully.
Actual Behavior
Any plan/apply that refreshes the resource fails:
Error: reviewer.Type is *string, not a string of 'User' or 'Team', unable to unmarshal
with github_repository_environment.notify_gate["<repo>"],
on main.repos.tf line 232, in resource "github_repository_environment" "notify_gate":
232: resource "github_repository_environment" "notify_gate" {
Because Terraform refreshes the whole state, a single environment with an Enterprise Team reviewer blocks every plan/apply in the workspace, including for completely unrelated resources. The resource becomes unmanageable until the Enterprise Team reviewer is removed out-of-band via the REST API or UI.
Terraform Version
Terraform v1.15.8
on windows_amd64
+ provider registry.terraform.io/integrations/github v6.13.0
GitHub Installation Type
Affected Resource(s)
github_repository_environment (read/refresh path)
- Likely anything else decoding required reviewers from the environments API (e.g. the corresponding data source)
Terraform Configuration Files
resource "github_repository_environment" "notify_gate" {
for_each = var.repositories
environment = "notify-gate"
repository = github_repository.iac[each.key].name
reviewers {
users = [2363016, 1317356] # two named users
}
}
The Enterprise Team reviewer is **not** declared in Terraform — it was added out-of-band, which is enough to break refresh permanently. There is also no way to express an Enterprise Team in the `reviewers` block (`users`/`teams` only), so it cannot be adopted into config as a workaround.
Steps to Reproduce
- On GitHub Enterprise Cloud with data residency + Enterprise Managed Users, create an environment with required reviewers via Terraform (users and/or org teams).
- Add an Enterprise Team as an additional required reviewer via the UI or
PUT /repos/{owner}/{repo}/environments/{environment_name}.
- Run
terraform plan → the error above. It persists until the Enterprise Team reviewer is removed.
Debug Output
GET /repos/{owner}/{repo}/environments/{environment_name} returns a reviewer whose top-level type is BusinessTeam, with a nested reviewer object of type: "enterprise":
{
"type": "BusinessTeam",
"reviewer": {
"name": "<enterprise team name>",
"id": 2418211,
"slug": "ent:<enterprise-team-slug>",
"privacy": "closed",
"type": "enterprise",
"enterprise_id": 23181,
"permission": "pull",
"parent": null
}
}
For contrast, a normal user reviewer in the same response is "type": "User".
Code of Conduct
Expected Behavior
Reading/refreshing a
github_repository_environmentwhose required reviewers include a GitHub Enterprise Team should succeed — either representing that reviewer in state, or ignoring it gracefully.Actual Behavior
Any
plan/applythat refreshes the resource fails:Because Terraform refreshes the whole state, a single environment with an Enterprise Team reviewer blocks every
plan/applyin the workspace, including for completely unrelated resources. The resource becomes unmanageable until the Enterprise Team reviewer is removed out-of-band via the REST API or UI.Terraform Version
GitHub Installation Type
Affected Resource(s)
github_repository_environment(read/refresh path)Terraform Configuration Files
Steps to Reproduce
PUT /repos/{owner}/{repo}/environments/{environment_name}.terraform plan→ the error above. It persists until the Enterprise Team reviewer is removed.Debug Output
GET /repos/{owner}/{repo}/environments/{environment_name}returns a reviewer whose top-leveltypeisBusinessTeam, with a nested reviewer object oftype: "enterprise":{ "type": "BusinessTeam", "reviewer": { "name": "<enterprise team name>", "id": 2418211, "slug": "ent:<enterprise-team-slug>", "privacy": "closed", "type": "enterprise", "enterprise_id": 23181, "permission": "pull", "parent": null } }For contrast, a normal user reviewer in the same response is
"type": "User".Code of Conduct