Fix: prevent unexpected status check contexts deletion for archived repositories

github/resource_github_branch_protection.go

@@ -133,6 +133,8 @@ func resourceGithubBranchProtection() *schema.Resource {
 						PROTECTION_REQUIRED_STATUS_CHECK_CONTEXTS: {
 							Type:        schema.TypeSet,
 							Optional:    true,
+							Computed:    true,
+							Deprecated:  "GitHub is deprecating the use of `contexts`. Use a `checks` array instead.",
 							Description: "The list of status checks to require in order to merge into this branch. No status checks are required by default.",
 							Elem:        &schema.Schema{Type: schema.TypeString},
 						},
@@ -293,6 +295,12 @@ func resourceGithubBranchProtectionRead(d *schema.ResourceData, meta any) error
 	}
 	protection := query.Node.Node
 
+	if protection.Repository.IsArchived {
+		log.Printf("[INFO] Removing branch protection (%s) from state because the repository (%s) is archived", d.Id(), protection.Repository.Name)
+		d.SetId("")
+		return nil
+	}
+
 	err = d.Set(PROTECTION_PATTERN, protection.Pattern)
 	if err != nil {
 		log.Printf("[DEBUG] Problem setting '%s' in %s %s branch protection (%s)", PROTECTION_PATTERN, protection.Repository.Name, protection.Pattern, d.Id())
@@ -366,6 +374,25 @@ func resourceGithubBranchProtectionRead(d *schema.ResourceData, meta any) error
 }
 
 func resourceGithubBranchProtectionUpdate(d *schema.ResourceData, meta any) error {
+	var query struct {
+		Node struct {
+			Node BranchProtectionRule `graphql:"... on BranchProtectionRule"`
+		} `graphql:"node(id: $id)"`
+	}
+	variables := map[string]any{
+		"id": d.Id(),
+	}
+	ctx := context.WithValue(context.Background(), ctxId, d.Id())
+	client := meta.(*Owner).v4client
+	err := client.Query(ctx, &query, variables)
+	if err == nil {
+		protection := query.Node.Node
+		if protection.Repository.IsArchived {
+			log.Printf("[INFO] Skipping update of branch protection (%s) because the repository (%s) is archived", d.Id(), protection.Repository.Name)
+			return nil
+		}
+	}
+
 	var mutate struct {
 		UpdateBranchProtectionRule struct {
 			BranchProtectionRule struct {
@@ -444,6 +471,25 @@ func resourceGithubBranchProtectionUpdate(d *schema.ResourceData, meta any) erro
 }
 
 func resourceGithubBranchProtectionDelete(d *schema.ResourceData, meta any) error {
+	var query struct {
+		Node struct {
+			Node BranchProtectionRule `graphql:"... on BranchProtectionRule"`
+		} `graphql:"node(id: $id)"`
+	}
+	variables := map[string]any{
+		"id": d.Id(),
+	}
+	ctx := context.WithValue(context.Background(), ctxId, d.Id())
+	client := meta.(*Owner).v4client
+	err := client.Query(ctx, &query, variables)
+	if err == nil {
+		protection := query.Node.Node
+		if protection.Repository.IsArchived {
+			log.Printf("[INFO] Skipping deletion of branch protection (%s) because the repository (%s) is archived", d.Id(), protection.Repository.Name)
+			return nil
+		}
+	}
+
 	var mutate struct {
 		DeleteBranchProtectionRule struct { // Empty struct does not work
 			ClientMutationId githubv4.ID

github/resource_github_branch_protection_v3.go

@@ -275,6 +275,26 @@ func resourceGithubBranchProtectionV3Read(d *schema.ResourceData, meta any) erro
 	orgName := meta.(*Owner).name
 
 	ctx := context.WithValue(context.Background(), ctxId, d.Id())
+
+	repo, _, err := client.Repositories.Get(ctx, orgName, repoName)
+	if err != nil {
+		var ghErr *github.ErrorResponse
+		if errors.As(err, &ghErr) {
+			if ghErr.Response.StatusCode == http.StatusNotFound {
+				log.Printf("[INFO] Removing branch protection %s/%s (%s) from state because the repository no longer exists",
+					orgName, repoName, branch)
+				d.SetId("")
+				return nil
+			}
+		}
+		return err
+	}
+	if repo.GetArchived() {
+		log.Printf("[INFO] Removing branch protection %s/%s (%s) from state because the repository is archived", orgName, repoName, branch)
+		d.SetId("")
+		return nil
+	}
+
 	if !d.IsNewResource() {
 		ctx = context.WithValue(ctx, ctxEtag, d.Get("etag").(string))
 	}
@@ -349,6 +369,16 @@ func resourceGithubBranchProtectionV3Update(d *schema.ResourceData, meta any) er
 	if err != nil {
 		return err
 	}
+	orgName := meta.(*Owner).name
+	ctx := context.WithValue(context.Background(), ctxId, d.Id())
+
+	repo, _, err := client.Repositories.Get(ctx, orgName, repoName)
+	if err == nil {
+		if repo.GetArchived() {
+			log.Printf("[INFO] Skipping update of branch protection %s/%s (%s) because the repository is archived", orgName, repoName, branch)
+			return nil
+		}
+	}
 
 	protectionRequest, err := buildProtectionRequest(d)
 	if err != nil {
@@ -407,6 +437,14 @@ func resourceGithubBranchProtectionV3Delete(d *schema.ResourceData, meta any) er
 	orgName := meta.(*Owner).name
 	ctx := context.WithValue(context.Background(), ctxId, d.Id())
 
+	repo, _, err := client.Repositories.Get(ctx, orgName, repoName)
+	if err == nil {
+		if repo.GetArchived() {
+			log.Printf("[INFO] Skipping deletion of branch protection %s/%s (%s) because the repository is archived", orgName, repoName, branch)
+			return nil
+		}
+	}
+
 	_, err = client.Repositories.RemoveBranchProtection(ctx,
 		orgName, repoName, branch)
 	return err

github/resource_github_branch_protection_v3_utils.go

@@ -50,18 +50,29 @@ func flattenAndSetRequiredStatusChecks(d *schema.ResourceData, protection *githu
 
 		// TODO: Remove once contexts is fully deprecated.
 		// Flatten contexts
-		for _, c := range *rsc.Contexts {
-			// Parse into contexts
-			contexts = append(contexts, c)
+		if rsc.Contexts != nil {
+			for _, c := range *rsc.Contexts {
+				// Parse into contexts
+				contexts = append(contexts, c)
+			}
+		}
+
+		// Fallback to populating contexts from checks if it's empty (e.g. archived repo)
+		if len(contexts) == 0 && rsc.Checks != nil {
+			for _, chk := range *rsc.Checks {
+				contexts = append(contexts, chk.Context)
+			}
 		}
 
 		// Flatten checks
-		for _, chk := range *rsc.Checks {
-			// Parse into checks
-			if chk.AppID != nil {
-				checks = append(checks, fmt.Sprintf("%s:%d", chk.Context, *chk.AppID))
-			} else {
-				checks = append(checks, chk.Context)
+		if rsc.Checks != nil {
+			for _, chk := range *rsc.Checks {
+				// Parse into checks
+				if chk.AppID != nil {
+					checks = append(checks, fmt.Sprintf("%s:%d", chk.Context, *chk.AppID))
+				} else {
+					checks = append(checks, chk.Context)
+				}
 			}
 		}
 

github/util_v4_branch_protection.go

@@ -56,8 +56,9 @@ type PushActorTypes struct {
 
 type BranchProtectionRule struct {
 	Repository struct {
-		ID   githubv4.String
-		Name githubv4.String
+		ID         githubv4.String
+		Name       githubv4.String
+		IsArchived githubv4.Boolean
 	}
 	PushAllowances struct {
 		Nodes []PushActorTypes