GitHubInstallation

Adopts an installation of the Vulnetix GitHub App on github.com, so that configuration as code can name it and depend on it. The App itself is installed on GitHub, in a browser, by someone who administers the account; this document cannot install it. Apply only links an installation the tenant already has: a plan for an installation id the tenant does not have is refused, with the link to install the App. Which repositories the installation reaches, and its permissions, are chosen on GitHub and reported read-only in the object’s status (account, repository selection, repository count). Deleting the document lets go of the installation; it does not uninstall the App, which stays installed and in use until it is removed on GitHub.

apiVersion	vulnetix.com/v1
kind	GitHubInstallation
Group	Integrations
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists GitHubInstallation in its kinds. See Management tokens.
Terraform resource	vulnetix_git_hub_installation, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/GitHubInstallation.schema.json
Newest schema	latest/GitHubInstallation.schema.json
First released in	v1.5.0
Print the built-in copy	vulnetix config schema GitHubInstallation

Minimal

Only the fields the kind requires. From examples/GitHubInstallation/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/GitHubInstallation.schema.json
apiVersion: vulnetix.com/v1
kind: GitHubInstallation
metadata:
  name: acme
spec:
  installationId: 51234567

HCL (resource vulnetix_git_hub_installation)

# Only the arguments the kind requires. From config-schemas examples/GitHubInstallation/minimal.yaml.

resource "vulnetix_git_hub_installation" "acme" {
  name            = "acme"
  installation_id = 51234567
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/GitHubInstallation.schema.json
apiVersion: vulnetix.com/v1
kind: GitHubInstallation
metadata:
  name: acme
spec:
  installationId: 51234567
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/GitHubInstallation/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/GitHubInstallation.schema.json
# Install the Vulnetix GitHub App on the acme organisation first; this
# document adopts that installation.
apiVersion: vulnetix.com/v1
kind: GitHubInstallation
metadata:
  name: acme
  labels:
    owner: platform
  annotations:
    note: Repository selection is managed on GitHub.
spec:
  installationId: 51234567

HCL (resource vulnetix_git_hub_installation)

# Every argument the kind supports. From config-schemas examples/GitHubInstallation/advanced.yaml.

resource "vulnetix_git_hub_installation" "acme" {
  name            = "acme"
  installation_id = 51234567
  labels = {
    owner = "platform"
  }
  annotations = {
    note = "Repository selection is managed on GitHub."
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/GitHubInstallation.schema.json
# Install the Vulnetix GitHub App on the acme organisation first; this
# document adopts that installation.
apiVersion: vulnetix.com/v1
kind: GitHubInstallation
metadata:
  name: acme
  labels:
    owner: platform
  annotations:
    note: Repository selection is managed on GitHub.
spec:
  installationId: 51234567
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly GitHubInstallation	Always GitHubInstallation.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.installationId	integer	yes		>= 1	The GitHub App installation id, the number at the end of the installation’s settings URL (github.com/organizations//settings/installations/). The installation must already be recorded for the tenant, by installing the App from Integrations or claiming an installation started on GitHub.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Read only: the installation’s state, account and repository selection, as GitHub reports them. The phases the engine reports are explained under status phases.

How apply treats it

Adopt only, by spec.installationId. The Vulnetix GitHub App is installed on GitHub, not by this kind. Plan blocks an installation the tenant does not have, and names the App’s install URL. Status reports the account and repository selection, read only. Delete lets go and never uninstalls the App.

Terraform and OpenTofu

The resource is vulnetix_git_hub_installation in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_git_hub_installation.

Import an object that already exists by its name:

# Import an existing GitHubInstallation by its name (metadata.name).
terraform import vulnetix_git_hub_installation.acme acme

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.