Merge branch 'main' into feat/enterprise-ip-allow-list

Author: ErikElkins

.gitattributes

@@ -0,0 +1,5 @@
+# https://git-scm.com/docs/gitattributes
+# https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github
+
+# Ignore vendor directory in language statistics
+vendor/** linguist-generated=true

.github/workflows/codeql.yaml

@@ -49,7 +49,7 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
+        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -60,6 +60,6 @@ jobs:
         run: go build ./...
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
+        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/release.yaml

@@ -41,7 +41,7 @@ jobs:
           cache: true
 
       - name: Install Syft
-        uses: anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56 # v0.22.1
+        uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

CONTRIBUTING.md

@@ -33,9 +33,9 @@ This section describes a typical sequence performed when developing locally. Ful
 Once you have the repository cloned, there's a couple of additional steps you'll need to take. Since most of the testing is acceptance or integration testing, we need to manipulate real GitHub resources in order to run it. Useful setup steps are listed below:
 
 - If you haven't already, [create a GitHub organization you can use for testing](#github-organization).
-  - Optional: you may find it beneficial to create a test user as well in order to avoid potential rate-limiting issues on your main account.
-  - Your organization _must_ have a repository called `terraform-template-module`. The [terraformtesting/terraform-template-module](https://github.com/terraformtesting/terraform-template-module) repo is a good, re-usable example.
-    - You _must_ make sure that the "Template Repository" item in Settings is checked for this repo.
+    - Optional: you may find it beneficial to create a test user as well in order to avoid potential rate-limiting issues on your main account.
+    - Your organization _must_ have a repository called `terraform-template-module`. The [terraformtesting/terraform-template-module](https://github.com/terraformtesting/terraform-template-module) repo is a good, re-usable example.
+        - You _must_ make sure that the "Template Repository" item in Settings is checked for this repo.
 - If you haven't already, generate a Personal Access Token (PAT) for authenticating your test runs.
 - Export the necessary configuration for authenticating your provider with GitHub
 
@@ -52,7 +52,7 @@ Once you have the repository cloned, there's a couple of additional steps you'll
 ### Local Development Iteration
 
 1. Write a test describing what you will fix. See [`github_label`](./github/resource_github_issue_label_test.go) for an example format.
-1. Run your test and observe it fail. Enabling debug output allows for observing the underlying requests and responses made as well as viewing state (search `STATE:`) generated during the acceptance test run.
+2. Run your test and observe it fail. Enabling debug output allows for observing the underlying requests and responses made as well as viewing state (search `STATE:`) generated during the acceptance test run.
 
 ```sh
 TF_LOG=DEBUG TF_ACC=1 go test -v ./... -run ^TestAccGithubIssueLabel
@@ -182,6 +182,9 @@ export GH_TEST_ENTERPRISE_EMU_GROUP_ID=
 
 # Configure test options
 export GH_TEST_ADVANCED_SECURITY=
+
+# Configure if the enterprise is an EMU enterprise
+export GH_TEST_ENTERPRISE_IS_EMU=
 ```
 
 There are also a small amount of unit tests in the provider. Due to the nature of the provider, such tests are currently only recommended for exercising functionality completely internal to the provider. These may be executed by running `make test`.

github/acc_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 
 	"github.com/google/go-github/v82/github"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 type testMode string
@@ -43,7 +43,8 @@ type testAccConfig struct {
 	token    string
 
 	// Enterprise configuration
-	enterpriseSlug string
+	enterpriseSlug  string
+	enterpriseIsEMU bool
 
 	// Global test configuration
 	testPublicRepository              string
@@ -76,6 +77,9 @@ type testAccConfig struct {
 
 	// Test options
 	testAdvancedSecurity bool
+
+	// Test repository configuration
+	testRepositoryVisibility string
 }
 
 var testAccConf *testAccConfig
@@ -130,6 +134,8 @@ func TestMain(m *testing.M) {
 		testExternalUserToken:             os.Getenv("GH_TEST_EXTERNAL_USER_TOKEN"),
 		testExternalUser2:                 os.Getenv("GH_TEST_EXTERNAL_USER2"),
 		testAdvancedSecurity:              os.Getenv("GH_TEST_ADVANCED_SECURITY") == "true",
+		testRepositoryVisibility:          "public",
+		enterpriseIsEMU:                   authMode == enterprise && os.Getenv("GH_TEST_ENTERPRISE_IS_EMU") == "true",
 	}
 
 	if config.authMode != anonymous {
@@ -165,6 +171,10 @@ func TestMain(m *testing.M) {
 		if err == nil {
 			config.testEnterpriseEMUGroupId = i
 		}
+
+		if config.enterpriseIsEMU {
+			config.testRepositoryVisibility = "private"
+		}
 	}
 
 	i, err := strconv.Atoi(os.Getenv("GH_TEST_ORG_APP_INSTALLATION_ID"))
@@ -300,6 +310,36 @@ func skipUnlessEnterprise(t *testing.T) {
 	}
 }
 
+func skipUnlessHasAppInstallations(t *testing.T) {
+	t.Helper()
+
+	meta, err := getTestMeta()
+	if err != nil {
+		t.Fatalf("failed to get test meta: %s", err)
+	}
+
+	installations, _, err := meta.v3client.Organizations.ListInstallations(context.Background(), meta.name, nil)
+	if err != nil {
+		t.Fatalf("failed to list app installations: %s", err)
+	}
+
+	if len(installations.Installations) == 0 {
+		t.Skip("Skipping because no GitHub App installations found in the test organization")
+	}
+}
+
+func skipUnlessEMUEnterprise(t *testing.T) {
+	if !testAccConf.enterpriseIsEMU {
+		t.Skip("Skipping as test mode is not EMU enterprise")
+	}
+}
+
+func skipIfEMUEnterprise(t *testing.T) {
+	if testAccConf.enterpriseIsEMU {
+		t.Skip("Skipping as this test is not supported for EMU enterprise")
+	}
+}
+
 func skipUnlessMode(t *testing.T, testModes ...testMode) {
 	if !slices.Contains(testModes, testAccConf.authMode) {
 		t.Skip("Skipping as not supported test mode")

github/data_source_github_actions_environment_public_key_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 func TestAccGithubActionsEnvironmentPublicKeyDataSource(t *testing.T) {

github/data_source_github_actions_environment_secrets_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 func TestAccGithubActionsEnvironmentSecretsDataSource(t *testing.T) {

github/data_source_github_actions_environment_variables_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 func TestAccGithubActionsEnvironmentVariablesDataSource(t *testing.T) {

github/data_source_github_actions_organization_oidc_subject_claim_customization_template_test.go

@@ -3,7 +3,7 @@ package github
 import (
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 func TestAccGithubActionsOrganizationOIDCSubjectClaimCustomizationTemplateDataSource(t *testing.T) {

github/data_source_github_actions_organization_public_key_test.go

@@ -3,7 +3,7 @@ package github
 import (
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
 func TestAccGithubActionsOrganizationPublicKeyDataSource(t *testing.T) {