@pulumi/azuredevops

import * as pulumi from "@pulumi/pulumi"; /** * Manages permissions for Git repositories. * * > **Note** Permissions can be assigned to group principals and not to single user principals. * * ## Permission levels * * Permission for Git Repositories within Azure DevOps can be applied on three different levels. * Those levels are reflected by specifying (or omitting) values for the arguments `projectId`, `repositoryId` and `branchName`. * * ### Project level * * Permissions for all Git Repositories inside a project (existing or newly created ones) are specified, if only the argument `projectId` has a value. * * #### Example usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as azuredevops from "@pulumi/azuredevops"; * * const example = new azuredevops.Project("example", { * name: "Example Project", * workItemTemplate: "Agile", * versionControl: "Git", * visibility: "private", * description: "Managed by Pulumi", * }); * const example_readers = azuredevops.getGroupOutput({ * projectId: example.id, * name: "Readers", * }); * const example_permissions = new azuredevops.GitPermissions("example-permissions", { * projectId: example.id, * principal: example_readers.apply(example_readers => example_readers.id), * permissions: { * CreateRepository: "Deny", * DeleteRepository: "Deny", * RenameRepository: "NotSet", * }, * }); * ``` * * ### Repository level * * Permissions for a specific Git Repository and all existing or newly created branches are specified if the arguments `projectId` and `repositoryId` are set. * * #### Example usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as azuredevops from "@pulumi/azuredevops"; * * const example = new azuredevops.Project("example", { * name: "Example Project", * workItemTemplate: "Agile", * versionControl: "Git", * visibility: "private", * description: "Managed by Pulumi", * }); * const example_group = azuredevops.getGroup({ * name: "Project Collection Administrators", * }); * const exampleGit = new azuredevops.Git("example", { * projectId: example.id, * name: "Example Empty Git Repository", * initialization: { * initType: "Clean", * }, * }); * const example_permissions = new azuredevops.GitPermissions("example-permissions", { * projectId: exampleGit.projectId, * repositoryId: exampleGit.id, * principal: example_group.then(example_group => example_group.id), * permissions: { * RemoveOthersLocks: "Allow", * ManagePermissions: "Deny", * CreateTag: "Deny", * CreateBranch: "NotSet", * }, * }); * ``` * * ### Branch level * * Permissions for a specific branch inside a Git Repository are specified if all above mentioned the arguments are set. * * #### Example usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as azuredevops from "@pulumi/azuredevops"; * * const example = new azuredevops.Project("example", { * name: "Example Project", * workItemTemplate: "Agile", * versionControl: "Git", * visibility: "private", * description: "Managed by Pulumi", * }); * const exampleGit = new azuredevops.Git("example", { * projectId: example.id, * name: "Example Empty Git Repository", * initialization: { * initType: "Clean", * }, * }); * const example_group = azuredevops.getGroup({ * name: "Project Collection Administrators", * }); * const example_permissions = new azuredevops.GitPermissions("example-permissions", { * projectId: exampleGit.projectId, * repositoryId: exampleGit.id, * branchName: "refs/heads/master", * principal: example_group.then(example_group => example_group.id), * permissions: { * RemoveOthersLocks: "Allow", * ForcePush: "Deny", * }, * }); * ``` * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as azuredevops from "@pulumi/azuredevops"; * * const example = new azuredevops.Project("example", { * name: "Example Project", * visibility: "private", * versionControl: "Git", * workItemTemplate: "Agile", * description: "Managed by Pulumi", * }); * const example_project_readers = azuredevops.getGroupOutput({ * projectId: example.id, * name: "Readers", * }); * const example_project_contributors = azuredevops.getGroupOutput({ * projectId: example.id, * name: "Contributors", * }); * const example_project_administrators = azuredevops.getGroupOutput({ * projectId: example.id, * name: "Project administrators", * }); * const example_permissions = new azuredevops.GitPermissions("example-permissions", { * projectId: example.id, * principal: example_project_readers.apply(example_project_readers => example_project_readers.id), * permissions: { * CreateRepository: "Deny", * DeleteRepository: "Deny", * RenameRepository: "NotSet", * }, * }); * const exampleGit = new azuredevops.Git("example", { * projectId: example.id, * name: "TestRepo", * defaultBranch: "refs/heads/master", * initialization: { * initType: "Clean", * }, * }); * const example_repo_permissions = new azuredevops.GitPermissions("example-repo-permissions", { * projectId: exampleGit.projectId, * repositoryId: exampleGit.id, * principal: example_project_administrators.apply(example_project_administrators => example_project_administrators.id), * permissions: { * RemoveOthersLocks: "Allow", * ManagePermissions: "Deny", * CreateTag: "Deny", * CreateBranch: "NotSet", * }, * }); * const example_branch_permissions = new azuredevops.GitPermissions("example-branch-permissions", { * projectId: exampleGit.projectId, * repositoryId: exampleGit.id, * branchName: "master", * principal: example_project_contributors.apply(example_project_contributors => example_project_contributors.id), * permissions: { * RemoveOthersLocks: "Allow", * ForcePush: "Deny", * }, * }); * ``` * * ## Relevant Links * * * [Azure DevOps Service REST API 7.0 - Security](https://docs.microsoft.com/en-us/rest/api/azure/devops/security/?view=azure-devops-rest-7.0) * * ## PAT Permissions Required * * - **Project & Team**: vso.security_manage - Grants the ability to read, write, and manage security permissions. * * ## Import * * The resource does not support import. */ export declare class GitPermissions extends pulumi.CustomResource { /** * Get an existing GitPermissions resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input<pulumi.ID>, state?: GitPermissionsState, opts?: pulumi.CustomResourceOptions): GitPermissions; /** * Returns true if the given object is an instance of GitPermissions. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is GitPermissions; /** * The name of the branch to assign the permissions. * * > **Note** To assign permissions to a branch, the `repositoryId` must be set as well. */ readonly branchName: pulumi.Output<string | undefined>; /** * the permissions to assign. The following permissions are available * * | Permissions | Description | * |-------------------------|--------------------------------------------------------| * | Administer | Administer | * | GenericRead | Read | * | GenericContribute | Contribute | * | ForcePush | Force push (rewrite history, delete branches and tags) | * | CreateBranch | Create branch | * | CreateTag | Create tag | * | ManageNote | Manage notes | * | PolicyExempt | Bypass policies when pushing | * | CreateRepository | Create repository | * | DeleteRepository | Delete repository | * | RenameRepository | Rename repository | * | EditPolicies | Edit policies | * | RemoveOthersLocks | Remove others' locks | * | ManagePermissions | Manage permissions | * | PullRequestContribute | Contribute to pull requests | * | PullRequestBypassPolicy | Bypass policies when completing pull requests | */ readonly permissions: pulumi.Output<{ [key: string]: string; }>; /** * The **group** principal to assign the permissions. * * > **Note** The `descriptor` of the user/group not the `ID`. Some resources in this provider use the `descriptor` * as resource ID. It is recommended to check before use. */ readonly principal: pulumi.Output<string>; /** * The ID of the project to assign the permissions. */ readonly projectId: pulumi.Output<string>; /** * Replace (`true`) or merge (`false`) the permissions. Default: `true` */ readonly replace: pulumi.Output<boolean | undefined>; /** * The ID of the GIT repository to assign the permissions */ readonly repositoryId: pulumi.Output<string | undefined>; /** * Create a GitPermissions resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: GitPermissionsArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering GitPermissions resources. */ export interface GitPermissionsState { /** * The name of the branch to assign the permissions. * * > **Note** To assign permissions to a branch, the `repositoryId` must be set as well. */ branchName?: pulumi.Input<string>; /** * the permissions to assign. The following permissions are available * * | Permissions | Description | * |-------------------------|--------------------------------------------------------| * | Administer | Administer | * | GenericRead | Read | * | GenericContribute | Contribute | * | ForcePush | Force push (rewrite history, delete branches and tags) | * | CreateBranch | Create branch | * | CreateTag | Create tag | * | ManageNote | Manage notes | * | PolicyExempt | Bypass policies when pushing | * | CreateRepository | Create repository | * | DeleteRepository | Delete repository | * | RenameRepository | Rename repository | * | EditPolicies | Edit policies | * | RemoveOthersLocks | Remove others' locks | * | ManagePermissions | Manage permissions | * | PullRequestContribute | Contribute to pull requests | * | PullRequestBypassPolicy | Bypass policies when completing pull requests | */ permissions?: pulumi.Input<{ [key: string]: pulumi.Input<string>; }>; /** * The **group** principal to assign the permissions. * * > **Note** The `descriptor` of the user/group not the `ID`. Some resources in this provider use the `descriptor` * as resource ID. It is recommended to check before use. */ principal?: pulumi.Input<string>; /** * The ID of the project to assign the permissions. */ projectId?: pulumi.Input<string>; /** * Replace (`true`) or merge (`false`) the permissions. Default: `true` */ replace?: pulumi.Input<boolean>; /** * The ID of the GIT repository to assign the permissions */ repositoryId?: pulumi.Input<string>; } /** * The set of arguments for constructing a GitPermissions resource. */ export interface GitPermissionsArgs { /** * The name of the branch to assign the permissions. * * > **Note** To assign permissions to a branch, the `repositoryId` must be set as well. */ branchName?: pulumi.Input<string>; /** * the permissions to assign. The following permissions are available * * | Permissions | Description | * |-------------------------|--------------------------------------------------------| * | Administer | Administer | * | GenericRead | Read | * | GenericContribute | Contribute | * | ForcePush | Force push (rewrite history, delete branches and tags) | * | CreateBranch | Create branch | * | CreateTag | Create tag | * | ManageNote | Manage notes | * | PolicyExempt | Bypass policies when pushing | * | CreateRepository | Create repository | * | DeleteRepository | Delete repository | * | RenameRepository | Rename repository | * | EditPolicies | Edit policies | * | RemoveOthersLocks | Remove others' locks | * | ManagePermissions | Manage permissions | * | PullRequestContribute | Contribute to pull requests | * | PullRequestBypassPolicy | Bypass policies when completing pull requests | */ permissions: pulumi.Input<{ [key: string]: pulumi.Input<string>; }>; /** * The **group** principal to assign the permissions. * * > **Note** The `descriptor` of the user/group not the `ID`. Some resources in this provider use the `descriptor` * as resource ID. It is recommended to check before use. */ principal: pulumi.Input<string>; /** * The ID of the project to assign the permissions. */ projectId: pulumi.Input<string>; /** * Replace (`true`) or merge (`false`) the permissions. Default: `true` */ replace?: pulumi.Input<boolean>; /** * The ID of the GIT repository to assign the permissions */ repositoryId?: pulumi.Input<string>; }