refactor(actions-org-secret): migrate to context-aware CRUD functions

Migrate resource_github_actions_organization_secret.go from legacy
CRUD to context-aware CRUD functions (CreateContext, ReadContext,
DeleteContext) per Terraform Plugin SDK v2 best practices.

Ref: #2996

Author: deiga

github/resource_github_actions_organization_secret.go

@@ -4,22 +4,22 @@ import (
 	"context"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"log"
 	"net/http"
 
 	"github.com/google/go-github/v81/github"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 func resourceGithubActionsOrganizationSecret() *schema.Resource {
 	return &schema.Resource{
-		Create: resourceGithubActionsOrganizationSecretCreateOrUpdate,
-		Read:   resourceGithubActionsOrganizationSecretRead,
-		Delete: resourceGithubActionsOrganizationSecretDelete,
+		CreateContext: resourceGithubActionsOrganizationSecretCreateOrUpdate,
+		ReadContext:   resourceGithubActionsOrganizationSecretRead,
+		DeleteContext: resourceGithubActionsOrganizationSecretDelete,
 		Importer: &schema.ResourceImporter{
-			State: func(d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) {
+			StateContext: func(ctx context.Context, d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) {
 				if err := d.Set("secret_name", d.Id()); err != nil {
 					return nil, err
 				}
@@ -104,10 +104,9 @@ func resourceGithubActionsOrganizationSecret() *schema.Resource {
 	}
 }
 
-func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceData, meta any) error {
+func resourceGithubActionsOrganizationSecretCreateOrUpdate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	client := meta.(*Owner).v3client
 	owner := meta.(*Owner).name
-	ctx := context.Background()
 
 	secretName := d.Get("secret_name").(string)
 	plaintextValue := d.Get("plaintext_value").(string)
@@ -117,7 +116,7 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
 	selectedRepositories, hasSelectedRepositories := d.GetOk("selected_repository_ids")
 
 	if visibility != "selected" && hasSelectedRepositories {
-		return fmt.Errorf("cannot use selected_repository_ids without visibility being set to selected")
+		return diag.Errorf("cannot use selected_repository_ids without visibility being set to selected")
 	}
 
 	selectedRepositoryIDs := []int64{}
@@ -132,15 +131,15 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
 
 	keyId, publicKey, err := getOrganizationPublicKeyDetails(owner, meta)
 	if err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	if encryptedText, ok := d.GetOk("encrypted_value"); ok {
 		encryptedValue = encryptedText.(string)
 	} else {
 		encryptedBytes, err := encryptPlaintext(plaintextValue, publicKey)
 		if err != nil {
-			return err
+			return diag.FromErr(err)
 		}
 		encryptedValue = base64.StdEncoding.EncodeToString(encryptedBytes)
 	}
@@ -156,17 +155,16 @@ func resourceGithubActionsOrganizationSecretCreateOrUpdate(d *schema.ResourceDat
 
 	_, err = client.Actions.CreateOrUpdateOrgSecret(ctx, owner, eSecret)
 	if err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	d.SetId(secretName)
-	return resourceGithubActionsOrganizationSecretRead(d, meta)
+	return resourceGithubActionsOrganizationSecretRead(ctx, d, meta)
 }
 
-func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta any) error {
+func resourceGithubActionsOrganizationSecretRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	client := meta.(*Owner).v3client
 	owner := meta.(*Owner).name
-	ctx := context.Background()
 
 	secret, _, err := client.Actions.GetOrgSecret(ctx, owner, d.Id())
 	if err != nil {
@@ -179,14 +177,14 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta an
 				return nil
 			}
 		}
-		return err
+		return diag.FromErr(err)
 	}
 
 	if err = d.Set("created_at", secret.CreatedAt.String()); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 	if err = d.Set("visibility", secret.Visibility); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	selectedRepositoryIDs := []int64{}
@@ -198,7 +196,7 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta an
 		for {
 			results, resp, err := client.Actions.ListSelectedReposForOrgSecret(ctx, owner, d.Id(), opt)
 			if err != nil {
-				return err
+				return diag.FromErr(err)
 			}
 
 			for _, repo := range results.Repositories {
@@ -213,7 +211,7 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta an
 	}
 
 	if err = d.Set("selected_repository_ids", selectedRepositoryIDs); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	// This is a drift detection mechanism based on timestamps.
@@ -241,39 +239,39 @@ func resourceGithubActionsOrganizationSecretRead(d *schema.ResourceData, meta an
 			// Alternative approach: set sensitive values to empty to trigger update plan
 			// This tells Terraform that the current state is unknown and needs reconciliation
 			if err = d.Set("encrypted_value", ""); err != nil {
-				return err
+				return diag.FromErr(err)
 			}
 			if err = d.Set("plaintext_value", ""); err != nil {
-				return err
+				return diag.FromErr(err)
 			}
 			log.Printf("[INFO] Detected drift but destroy_on_drift=false, clearing sensitive values to trigger update")
 		}
 	} else {
 		// No drift detected, preserve the configured values in state
 		if err = d.Set("encrypted_value", d.Get("encrypted_value")); err != nil {
-			return err
+			return diag.FromErr(err)
 		}
 		if err = d.Set("plaintext_value", d.Get("plaintext_value")); err != nil {
-			return err
+			return diag.FromErr(err)
 		}
 	}
 
 	// Always update the timestamp to prevent repeated drift detection
 	if err = d.Set("updated_at", secret.UpdatedAt.String()); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	return nil
 }
 
-func resourceGithubActionsOrganizationSecretDelete(d *schema.ResourceData, meta any) error {
+func resourceGithubActionsOrganizationSecretDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
 	client := meta.(*Owner).v3client
 	orgName := meta.(*Owner).name
-	ctx := context.WithValue(context.Background(), ctxId, d.Id())
+	ctx = context.WithValue(ctx, ctxId, d.Id())
 
 	log.Printf("[INFO] Deleting secret: %s", d.Id())
 	_, err := client.Actions.DeleteOrgSecret(ctx, orgName, d.Id())
-	return err
+	return diag.FromErr(err)
 }
 
 func getOrganizationPublicKeyDetails(owner string, meta any) (keyId, pkValue string, err error) {