Merge branch 'main' into main

Author: atilsensalduz

.github/workflows/codeql.yaml

@@ -49,7 +49,7 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -60,6 +60,6 @@ jobs:
         run: go build ./...
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           category: "/language:${{matrix.language}}"

github/data_source_github_organization_app_installations_test.go

@@ -1,29 +1,51 @@
 package github
 
 import (
+	"context"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 )
 
-// TestAccGithubOrganizationAppInstallations requires at least one GitHub App
-// to be installed in the test organization (GITHUB_OWNER). If no apps are
-// installed, the attribute checks below will fail.
 func TestAccGithubOrganizationAppInstallations(t *testing.T) {
-	config := `data "github_organization_app_installations" "test" {}`
-
-	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { skipUnlessHasOrgs(t) },
-		ProviderFactories: providerFactories,
-		Steps: []resource.TestStep{
-			{
-				Config: config,
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.id"),
-					resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.app_slug"),
-					resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.app_id"),
-				),
+
+	t.Run("basic", func(t *testing.T) {
+		config := `data "github_organization_app_installations" "test" {}`
+
+		resource.Test(t, resource.TestCase{
+			PreCheck: func() {
+				skipUnlessHasOrgs(t)
+				skipUnlessHasAppInstallations(t)
 			},
-		},
+			ProviderFactories: providerFactories,
+			Steps: []resource.TestStep{
+				{
+					Config: config,
+					Check: resource.ComposeAggregateTestCheckFunc(
+						resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.id"),
+						resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.app_slug"),
+						resource.TestCheckResourceAttrSet("data.github_organization_app_installations.test", "installations.0.app_id"),
+					),
+				},
+			},
+		})
 	})
 }
+
+func skipUnlessHasAppInstallations(t *testing.T) {
+	t.Helper()
+
+	meta, err := getTestMeta()
+	if err != nil {
+		t.Fatalf("failed to get test meta: %s", err)
+	}
+
+	installations, _, err := meta.v3client.Organizations.ListInstallations(context.Background(), meta.name, nil)
+	if err != nil {
+		t.Fatalf("failed to list app installations: %s", err)
+	}
+
+	if len(installations.Installations) == 0 {
+		t.Skip("Skipping because no GitHub App installations found in the test organization")
+	}
+}

website/docs/r/actions_organization_permissions.html.markdown

@@ -39,6 +39,7 @@ The following arguments are supported:
 * `enabled_repositories`        - (Required) The policy that controls the repositories in the organization that are allowed to run GitHub Actions. Can be one of: `all`, `none`, or `selected`.
 * `allowed_actions_config`      - (Optional) Sets the actions that are allowed in an organization. Only available when `allowed_actions` = `selected`. See [Allowed Actions Config](#allowed-actions-config) below for details.
 * `enabled_repositories_config` - (Optional) Sets the list of selected repositories that are enabled for GitHub Actions in an organization. Only available when `enabled_repositories` = `selected`. See [Enabled Repositories Config](#enabled-repositories-config) below for details.
+* `sha_pinning_required`        - (Optional) Whether pinning to a specific SHA is required for all actions and reusable workflows in the organization.
 
 ### Allowed Actions Config
 

website/docs/r/actions_repository_permissions.html.markdown

@@ -36,6 +36,7 @@ The following arguments are supported:
 * `allowed_actions`        - (Optional) The permissions policy that controls the actions that are allowed to run. Can be one of: `all`, `local_only`, or `selected`.
 * `enabled`                - (Optional) Should GitHub actions be enabled on this repository?
 * `allowed_actions_config` - (Optional) Sets the actions that are allowed in an repository. Only available when `allowed_actions` = `selected`. See [Allowed Actions Config](#allowed-actions-config) below for details.
+* `sha_pinning_required`   - (Optional) Whether pinning to a specific SHA is required for all actions and reusable workflows in the repository.
 
 ### Allowed Actions Config