pulumi-github

@pulumi/github is the Node.js SDK for Pulumi’s GitHub resource provider, generated by bridging the official Terraform provider for GitHub into the Pulumi ecosystem. It exposes GitHub’s organization- and repository-management surface — repositories, teams and membership, branch protection and rulesets, Actions secrets/variables, Dependabot and Codespaces secrets, webhooks, and GitHub Enterprise Cloud settings — as typed Pulumi resources and data sources that participate in the same declarative up/preview/destroy lifecycle as any other cloud resource in a Pulumi program.

Because it is a thin, auto-generated layer over the Terraform provider (via pulumi-terraform-bridge’s SDKv2 shim), the package inherits the semantics and enormous API surface of terraform-provider-github almost one-to-one — over 60 resources and 60+ read-only data sources — while giving Pulumi users native language bindings instead of HCL.

It’s aimed at platform and security teams who already provision cloud infrastructure with Pulumi and want their GitHub organization configuration — repo scaffolding, branch protection, CI secrets, team access — version-controlled and applied through the same pipeline, rather than managed by hand in the GitHub UI or a separate Terraform workspace.

What You Get

• Typed resources for repository lifecycle (Repository, RepositoryCollaborator, RepositoryTopics, RepositoryFile) and access control (BranchProtection, RepositoryRuleset, OrganizationRuleset)
• Actions CI/CD configuration at repo, environment, and organization scope (ActionsSecret, ActionsVariable, ActionsEnvironmentSecret, ActionsOrganizationSecret, ActionsRunnerGroup, and OIDC subject-claim customization templates)
• Team and membership resources (Team, TeamMembership, TeamRepository, Membership, OrganizationRole, OrganizationCustomRole) for repository and organization RBAC as code
• Dependabot and Codespaces secret management (DependabotSecret, DependabotOrganizationSecret, CodespacesSecret, CodespacesOrganizationSecret) alongside the repos they configure
• Enterprise-scope resources (EnterpriseOrganization, EnterpriseActionsPermissions, EnterpriseIpAllowListEntry, EnterpriseSecurityAnalysisSettings) for GitHub Enterprise Cloud accounts
• Over 60 read-only data sources (getRepository, getOrganization, getTeam, getBranchProtectionRules, getRepositoryPullRequests, getActionsSecrets, etc.) for reading existing GitHub state into a Pulumi program
• Generated SDKs across five languages (Node.js/TypeScript, Python, Go, .NET, Java) from a single Terraform-bridge schema, so behavior stays consistent regardless of which language a team uses

Common Use Cases

• Provisioning new repositories at organization scale with consistent branch protection, topics, and default settings via a shared Pulumi component wrapping Repository and BranchProtection
• Rotating Actions CI/CD secrets (ActionsOrganizationSecret, ActionsEnvironmentSecret) through a reviewed Pulumi pipeline instead of manual dashboard edits
• Codifying team access and custom repository roles (OrganizationCustomRole, Team, TeamMembership) so permission changes go through the same PR/preview/apply flow as other infrastructure
• Enforcing an Enterprise Cloud security baseline (EnterpriseSecurityAnalysisSettings, EnterpriseIpAllowListEntry) from one Pulumi program across many organizations
• Keeping Dependabot and Codespaces secrets in sync with repository-level Actions secrets, using data sources to detect drift before it becomes a CI failure

Under The Hood

Architecture The package is one of five generated SDKs (Node.js, Python, Go, .NET, Java) produced from a single Go-based bridge provider in provider/. provider/resources.go wraps terraform-provider-github’s SDKv2-based provider with pulumi-terraform-bridge/v3’s shimv2 adapter, mapping each Terraform resource/data-source schema into Pulumi tfbridge.ResourceInfo/DataSourceInfo entries (67 resources plus a similarly large set of data sources) via makeResource/makeDataSource helpers, all under a single index module token. pulumi-tfgen-github consumes this mapping to emit a schema.json, which per-language code generators turn into the generated, do-not-edit-by-hand files under each sdk/<lang>/ directory — every one of the 166 files in sdk/nodejs/ opens with an explicit warning banner. Changing this package’s actual behavior means changing the upstream Terraform provider (vendored as a git submodule under upstream/ and referenced via a Go replace directive) or the bridge mapping, not the generated TypeScript directly.

Tech Stack The bridge provider is Go (module github.com/pulumi/pulumi-github/provider/v6), depending on pulumi-terraform-bridge/v3 v3.139.0 and integrations/terraform-provider-github/v6, with pulumi/sdk/v3 v3.259.0 underneath. The Node.js SDK itself has a minimal runtime footprint — its only dependency is @pulumi/pulumi (^3.142.0) — with TypeScript ^4.7, @types/node, and @types/mime as dev-only build dependencies; tsc is the entire build step. The repo also builds Python (setuptools), Go, .NET, and Java SDKs from the same schema, and uses devbox/mise for reproducible local toolchain pinning, with the whole Makefile itself marked as autogenerated from pulumi/ci-mgmt.

Code Quality Testing lives in the Go provider layer rather than the generated SDKs (which, being generated, aren’t unit-tested themselves): provider/provider_test.go exercises the bridged provider directly, while examples/examples_test.go and per-language variants (examples_nodejs_test.go, examples_py_test.go, examples_go_test.go, examples_dotnet_test.go) run example Pulumi programs (examples/repo/ts, examples/repo/python) through create/preview/destroy cycles. CI is extensive: separate build_provider.yml, build_sdk.yml, test.yml, run-acceptance-tests.yml, and lint.yml workflows, plus a .golangci.yml for Go static analysis. There is no traditional unit-test suite for business logic in the generated SDK — quality is enforced via generated-schema correctness and full-program acceptance tests against real or recorded GitHub API interactions instead.

API Design Because the API surface is generated from Terraform’s schema, naming and shape follow Terraform’s resource/data-source conventions translated into idiomatic Pulumi classes (RepositoryRuleset, ActionsOrganizationSecret, getBranchProtectionRules) rather than a hand-designed SDK — this gives strong consistency across the five language SDKs at the cost of a very large, feature-domain-organized surface (actions, dependabot, codespaces, enterprise, organization, repository) that a newcomer has to navigate. Every generated resource file carries an inline ## Example Usage block and import instructions in its TSDoc, so onboarding for a user already familiar with Pulumi is mostly about locating the right resource among many rather than learning unfamiliar patterns.