Add Support for require_last_push_approval

CHANGELOG.md

@@ -15,6 +15,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - BREAKING CHANGE: Bump minimum supported version of the GitHub provider to `v5.16`
   as it contains a [critical fix](https://github.com/integrations/terraform-provider-github/pull/1415) for branch protections.
+- BREAKING CHANGE: Rename `required_status_checks.contexts` to `required_status_checks.checks` as contexts is
+  depcrecated in v3 branch protections
 
 ## [0.18.0]
 

README.md

@@ -543,7 +543,7 @@ This is due to some terraform limitation and we will update the module once terr
 
       Default is `false`.
 
-    - [**`contexts`**](#attr-branch_protections_v3-required_status_checks-contexts): *(Optional `list(string)`)*<a name="attr-branch_protections_v3-required_status_checks-contexts"></a>
+    - [**`checks`**](#attr-branch_protections_v3-required_status_checks-checks): *(Optional `list(string)`)*<a name="attr-branch_protections_v3-required_status_checks-checks"></a>
 
       The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required.
 
@@ -736,6 +736,12 @@ This is due to some terraform limitation and we will update the module once terr
 
       Default is `0`.
 
+    - [**`require_last_push_approval`**](#attr-branch_protections_v4-required_pull_request_reviews-require_last_push_approval): *(Optional `bool`)*<a name="attr-branch_protections_v4-required_pull_request_reviews-require_last_push_approval"></a>
+
+      Setting this to true enforces that the most recent push must be approved by someone other than the last pusher.
+
+      Default is `false`.
+
   - [**`required_status_checks`**](#attr-branch_protections_v4-required_status_checks): *(Optional `object(required_status_checks)`)*<a name="attr-branch_protections_v4-required_status_checks"></a>
 
     Enforce restrictions for required status checks.
@@ -749,7 +755,7 @@ This is due to some terraform limitation and we will update the module once terr
 
       Default is `false`.
 
-    - [**`contexts`**](#attr-branch_protections_v4-required_status_checks-contexts): *(Optional `list(string)`)*<a name="attr-branch_protections_v4-required_status_checks-contexts"></a>
+    - [**`checks`**](#attr-branch_protections_v4-required_status_checks-checks): *(Optional `list(string)`)*<a name="attr-branch_protections_v4-required_status_checks-checks"></a>
 
       The list of status checks to require in order to merge into this branch. If default is `[]` no status checks are required.
 

README.tfdoc.hcl

@@ -701,7 +701,7 @@ section {
               END
             }
 
-            attribute "contexts" {
+            attribute "checks" {
               type        = list(string)
               default     = []
               description = <<-END
@@ -950,6 +950,14 @@ section {
                 If this is specified it must be a number between 0-6.
               END
             }
+
+            attribute "require_last_push_approval" {
+              type        = bool
+              default     = false
+              description = <<-END
+                Setting this to true enforces that the most recent push must be approved by someone other than the last pusher.
+              END
+            }
           }
 
           attribute "required_status_checks" {
@@ -967,7 +975,7 @@ section {
               END
             }
 
-            attribute "contexts" {
+            attribute "checks" {
               type        = list(string)
               default     = []
               description = <<-END

examples/public-repository/README.md

@@ -62,7 +62,7 @@ module "repository" {
 
       required_status_checks = {
         strict   = true
-        contexts = ["ci/travis"]
+        checks   = ["ci/travis"]
       }
 
       required_pull_request_reviews = {

examples/public-repository/main.tf

@@ -48,7 +48,7 @@ module "repository" {
 
   admin_collaborators = ["terraform-test-user-1"]
 
-  branch_protections = [
+  branch_protections_v5 = [
     {
       branch                          = "main"
       enforce_admins                  = true

main.tf

@@ -56,8 +56,8 @@ locals {
     for b in local.branch_protections_v3 :
     length(keys(b.required_status_checks)) > 0 ? [
       merge({
-        strict   = null
-        contexts = []
+        strict = null
+        checks = []
     }, b.required_status_checks)] : []
   ]
 
@@ -220,6 +220,7 @@ resource "github_branch_protection" "branch_protection" {
       pull_request_bypassers          = try(required_pull_request_reviews.value.pull_request_bypassers, [])
       require_code_owner_reviews      = try(required_pull_request_reviews.value.require_code_owner_reviews, true)
       required_approving_review_count = try(required_pull_request_reviews.value.required_approving_review_count, 0)
+      require_last_push_approval      = try(required_pull_request_reviews.value.require_last_push_approval, false)
     }
   }
 
@@ -260,8 +261,8 @@ resource "github_branch_protection_v3" "branch_protection" {
     for_each = local.required_status_checks[count.index]
 
     content {
-      strict   = required_status_checks.value.strict
-      contexts = required_status_checks.value.contexts
+      strict = required_status_checks.value.strict
+      checks = required_status_checks.value.checks
     }
   }
 

test/unit-complete/main.tf

@@ -102,6 +102,7 @@ module "repository" {
       required_pull_request_reviews = {
         dismiss_stale_reviews           = true
         require_code_owner_reviews      = true
+        require_last_push_approval      = true
         required_approving_review_count = 1
       }
 
@@ -119,8 +120,8 @@ module "repository" {
       require_signed_commits          = true
 
       required_status_checks = {
-        strict   = true
-        contexts = ["ci/travis"]
+        strict = true
+        # checks = ["ci/travis"]
       }
 
       required_pull_request_reviews = {

variables.tf

@@ -284,8 +284,8 @@ variable "branch_protections_v3" {
   #   enforce_admins         = bool
   #   require_signed_commits = bool
   #   required_status_checks = object({
-  #     strict   = bool
-  #     contexts = list(string)
+  #     strict = bool
+  #     checks = list(string)
   #   })
   #   required_pull_request_reviews = object({
   #     dismiss_stale_reviews           = bool
@@ -311,7 +311,7 @@ variable "branch_protections_v3" {
   #
   #     required_status_checks = {
   #       strict   = false
-  #       contexts = ["ci/travis"]
+  #       checks   = ["ci/travis"]
   #     }
   #
   #     required_pull_request_reviews = {
@@ -352,6 +352,7 @@ variable "branch_protections_v4" {
   #           pull_request_bypassers          = optional(list(string), [])
   #           require_code_owner_reviews      = optional(bool, false)
   #           required_approving_review_count = optional(number, 0)
+  #           require_last_push_approval      = optional(bool, false)
   #         }
   #       ))
   #       required_status_checks = optional(object(