test: add coverage for bypass_modes in rulesets (#2802)

Add test coverage for all three bypass_modes (always, pull_request,
exempt) for both repository and organization rulesets.

Repository Ruleset Tests (resource_github_repository_ruleset_test.go):
- Add test for all three bypass_modes with Team actors
- Add test for updating bypass_mode (always → exempt)
- Add test for different actor types with different bypass_modes
  (Team/always, RepositoryRole/pull_request, OrganizationAdmin/exempt)

Organization Ruleset Tests (resource_github_organization_ruleset_test.go):
- Fix existing "Creates and updates organization using bypasses" test:
  * Move bypass_actors from incorrect location (inside rules) to correct
    location (at ruleset level)
  * Add missing bypass_mode assertions
  * Fix incorrect actor_type assertions (was checking for "0", "5" instead
    of actual actor type strings)
  * Correct OrganizationAdmin actor_id from 0 to 1
- Add test for all three bypass_modes
- Add test for updating bypass_mode

All tests now verify:
- actor_id (both dynamic Team IDs and static role IDs)
- actor_type (Team, RepositoryRole, OrganizationAdmin, DeployKey)
- bypass_mode (always, pull_request, exempt)

This addresses the review comment from PR #2764 requesting test coverage
for bypass_modes, including the newly added "exempt" mode.

Fixes: #2764 (review)

Co-authored-by: Nick Floyd <[email protected]>

Author: oikarinen

github/resource_github_organization_ruleset_test.go

@@ -303,6 +303,23 @@ func TestGithubOrganizationRulesets(t *testing.T) {
 				target      = "branch"
 				enforcement = "active"
 
+				bypass_actors {
+					actor_type = "DeployKey"
+					bypass_mode = "always"
+				}
+
+				bypass_actors {
+					actor_id    = 5
+					actor_type  = "RepositoryRole"
+					bypass_mode = "always"
+				}
+
+				bypass_actors {
+					actor_id    = 1
+					actor_type  = "OrganizationAdmin"
+					bypass_mode = "always"
+				}
+
 				conditions {
 					ref_name {
 						include = ["~ALL"]
@@ -323,39 +340,147 @@ func TestGithubOrganizationRulesets(t *testing.T) {
 						dismiss_stale_reviews_on_push     = true
 						require_last_push_approval        = true
 					}
+				}
+			}
+		`, randomID)
 
-					bypass_actors {
-						actor_type = "DeployKey"
-						bypass_mode = "always"
-					}
+		check := resource.ComposeTestCheckFunc(
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.#",
+				"3",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.0.actor_type",
+				"DeployKey",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.0.bypass_mode",
+				"always",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.actor_id",
+				"5",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.actor_type",
+				"RepositoryRole",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.bypass_mode",
+				"always",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.2.actor_id",
+				"1",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.2.actor_type",
+				"OrganizationAdmin",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.2.bypass_mode",
+				"always",
+			),
+		)
 
-					bypass_actors {
-						actor_id    = 5
-						actor_type  = "RepositoryRole"
-						bypass_mode = "always"
-					}
+		testCase := func(t *testing.T, mode string) {
+			resource.Test(t, resource.TestCase{
+				PreCheck:  func() { skipUnlessMode(t, mode) },
+				Providers: testAccProviders,
+				Steps: []resource.TestStep{
+					{
+						Config: config,
+						Check:  check,
+					},
+				},
+			})
+		}
+
+		t.Run("with an enterprise account", func(t *testing.T) {
+			testCase(t, enterprise)
+		})
+
+	})
+
+	t.Run("Creates organization ruleset with all bypass_modes", func(t *testing.T) {
 
-					bypass_actors {
-						actor_id    = 0
-						actor_type  = "OrganizationAdmin"
-						bypass_mode = "always"
+		config := fmt.Sprintf(`
+			resource "github_organization_ruleset" "test" {
+				name        = "test-bypass-modes-%s"
+				target      = "branch"
+				enforcement = "active"
+
+				bypass_actors {
+					actor_id    = 1
+					actor_type  = "OrganizationAdmin"
+					bypass_mode = "always"
+				}
+
+				bypass_actors {
+					actor_id    = 5
+					actor_type  = "RepositoryRole"
+					bypass_mode = "pull_request"
+				}
+
+				bypass_actors {
+					actor_id    = 2
+					actor_type  = "RepositoryRole"
+					bypass_mode = "exempt"
+				}
+
+				conditions {
+					ref_name {
+						include = ["~ALL"]
+						exclude = []
 					}
 				}
+
+				rules {
+					creation = true
+				}
 			}
 		`, randomID)
 
 		check := resource.ComposeTestCheckFunc(
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.#",
+				"3",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.0.actor_id",
+				"1",
+			),
 			resource.TestCheckResourceAttr(
 				"github_organization_ruleset.test", "bypass_actors.0.actor_type",
-				"0",
+				"OrganizationAdmin",
 			),
 			resource.TestCheckResourceAttr(
-				"github_organization_ruleset.test", "bypass_actors.1.actor_type",
+				"github_organization_ruleset.test", "bypass_actors.0.bypass_mode",
+				"always",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.actor_id",
 				"5",
 			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.actor_type",
+				"RepositoryRole",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.1.bypass_mode",
+				"pull_request",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.2.actor_id",
+				"2",
+			),
 			resource.TestCheckResourceAttr(
 				"github_organization_ruleset.test", "bypass_actors.2.actor_type",
-				"0",
+				"RepositoryRole",
+			),
+			resource.TestCheckResourceAttr(
+				"github_organization_ruleset.test", "bypass_actors.2.bypass_mode",
+				"exempt",
 			),
 		)
 
@@ -378,4 +503,76 @@ func TestGithubOrganizationRulesets(t *testing.T) {
 
 	})
 
+	t.Run("Updates organization ruleset bypass_mode without error", func(t *testing.T) {
+
+		config := fmt.Sprintf(`
+			resource "github_organization_ruleset" "test" {
+				name        = "test-bypass-update-%s"
+				target      = "branch"
+				enforcement = "active"
+
+				bypass_actors {
+					actor_id    = 1
+					actor_type  = "OrganizationAdmin"
+					bypass_mode = "always"
+				}
+
+				conditions {
+					ref_name {
+						include = ["~ALL"]
+						exclude = []
+					}
+				}
+
+				rules {
+					creation = true
+				}
+			}
+		`, randomID)
+
+		configUpdated := strings.Replace(
+			config,
+			`bypass_mode = "always"`,
+			`bypass_mode = "exempt"`,
+			1,
+		)
+
+		checks := map[string]resource.TestCheckFunc{
+			"before": resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr(
+					"github_organization_ruleset.test", "bypass_actors.0.bypass_mode",
+					"always",
+				),
+			),
+			"after": resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr(
+					"github_organization_ruleset.test", "bypass_actors.0.bypass_mode",
+					"exempt",
+				),
+			),
+		}
+
+		testCase := func(t *testing.T, mode string) {
+			resource.Test(t, resource.TestCase{
+				PreCheck:  func() { skipUnlessMode(t, mode) },
+				Providers: testAccProviders,
+				Steps: []resource.TestStep{
+					{
+						Config: config,
+						Check:  checks["before"],
+					},
+					{
+						Config: configUpdated,
+						Check:  checks["after"],
+					},
+				},
+			})
+		}
+
+		t.Run("with an enterprise account", func(t *testing.T) {
+			testCase(t, enterprise)
+		})
+
+	})
+
 }