---
page_title: "ona_scm_integration Resource - ona"
subcategory: "Runners"
description: |-
  Ona runner SCM integration. Use this to configure how a runner authenticates to source control systems for projects assigned to that runner. For pat mode, use ona_git_authentication to associate a service account and personal access token with the integration.
---

# ona_scm_integration (Resource)

Ona runner SCM integration. Use this to configure how a runner authenticates to source control systems for projects assigned to that runner. For `pat` mode, use `ona_git_authentication` to associate a service account and personal access token with the integration.

For product context, see [Configuring repository access](https://ona.com/docs/ona/runners/configuring-repository-access) and [Git providers](https://ona.com/docs/ona/source-control/overview).

## Example Usage

```terraform
resource "ona_scm_integration" "github_oauth" {
  runner_id = ona_runner.aws_primary.runner_id

  kind = "github"
  host = "github.com"

  auth_mode                   = "oauth"
  oauth_client_id             = var.github_oauth_client_id
  oauth_client_secret         = var.github_oauth_client_secret
  oauth_client_secret_version = "2026-06-24"
}

resource "ona_scm_integration" "github_pat" {
  runner_id = ona_runner.aws_primary.runner_id

  kind      = "github"
  host      = "github.com"
  auth_mode = "pat"
}

resource "ona_scm_integration" "azure_devops_entra" {
  runner_id = ona_runner.aws_primary.runner_id

  kind = "azuredevops_entra"
  host = "dev.azure.com/acme"

  auth_mode                   = "oauth"
  oauth_client_id             = var.azure_devops_oauth_client_id
  oauth_client_secret         = var.azure_devops_oauth_client_secret
  oauth_client_secret_version = "2026-06-24"
  issuer_url                  = "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0"
}

resource "ona_scm_integration" "azure_devops_server" {
  runner_id = ona_runner.aws_primary.runner_id

  kind              = "azuredevops_server"
  host              = "ado.example.com"
  auth_mode         = "pat"
  virtual_directory = "/tfs"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `auth_mode` (String) Authentication mode. Supported values are `oauth` and `pat`. Azure DevOps Server currently requires `pat`.
- `host` (String) SCM host name, for example `github.com` or an Azure DevOps Server host. Changing this value replaces the integration.
- `kind` (String) SCM integration kind. Use values such as `github`, `azuredevops_entra`, or `azuredevops_server`. Changing this value replaces the integration.
- `runner_id` (String) Runner ID this SCM integration belongs to. Changing this value replaces the integration.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `issuer_url` (String) Issuer URL for Azure DevOps Entra ID OAuth integrations. Required when `kind` is `azuredevops_entra` and `auth_mode` is `oauth`.
- `oauth_client_id` (String) OAuth app client ID. Required when `auth_mode` is `oauth`; omit when `auth_mode` is `pat`.
- `oauth_client_secret` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) OAuth app client secret. This write-only value is sent to Ona but is not stored in Terraform plan or state. Required when creating an OAuth integration or rotating the OAuth secret.
- `oauth_client_secret_version` (String) User-managed version marker for resubmitting `oauth_client_secret` during rotation. Increment or otherwise change this value when supplying a new secret.
- `virtual_directory` (String) Virtual directory path for Azure DevOps Server integrations, such as `/tfs`. Required only when `kind` is `azuredevops_server`.

### Read-Only

- `id` (String) SCM integration ID.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_scm_integration.github_oauth 01980ed3-a090-7b5b-a74c-9bf5d8cfe53c
```