From c8e6c3fac1ed1beb0176db2f13a9ef4bcdef6c65 Mon Sep 17 00:00:00 2001 From: Andrew Sweet Date: Wed, 22 Apr 2026 15:02:54 +0100 Subject: [PATCH 1/4] feat: add github_enterprise_private_repository_forking_setting resource Add a new resource to manage the enterprise-level policy that controls whether and where members can fork private and internal repositories. This uses the GraphQL mutation updateEnterpriseAllowPrivateRepositoryForkingSetting to set: - setting_value: ENABLED, DISABLED, or NO_POLICY - policy_value: controls fork destinations (e.g. SAME_ORGANIZATION, ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS, EVERYWHERE, etc.) The resource includes CustomizeDiff validation ensuring policy_value is required when enabled and forbidden otherwise. Delete resets to NO_POLICY, returning control to individual organizations. Relates to #2851, #1844 Co-Authored-By: Claude Opus 4.7 (1M context) --- github/provider.go | 1 + ...rise_private_repository_forking_setting.go | 192 +++++++++++++ ...private_repository_forking_setting_test.go | 254 ++++++++++++++++++ ...e_repository_forking_setting.html.markdown | 82 ++++++ 4 files changed, 529 insertions(+) create mode 100644 github/resource_github_enterprise_private_repository_forking_setting.go create mode 100644 github/resource_github_enterprise_private_repository_forking_setting_test.go create mode 100644 website/docs/r/enterprise_private_repository_forking_setting.html.markdown diff --git a/github/provider.go b/github/provider.go index cf044eee66..b843f503a9 100644 --- a/github/provider.go +++ b/github/provider.go @@ -219,6 +219,7 @@ func Provider() *schema.Provider { "github_enterprise_ip_allow_list_entry": resourceGithubEnterpriseIpAllowListEntry(), "github_enterprise_actions_workflow_permissions": resourceGithubEnterpriseActionsWorkflowPermissions(), "github_actions_organization_workflow_permissions": resourceGithubActionsOrganizationWorkflowPermissions(), + "github_enterprise_private_repository_forking_setting": resourceGithubEnterprisePrivateRepositoryForkingSetting(), "github_enterprise_security_analysis_settings": resourceGithubEnterpriseSecurityAnalysisSettings(), "github_workflow_repository_permissions": resourceGithubWorkflowRepositoryPermissions(), }, diff --git a/github/resource_github_enterprise_private_repository_forking_setting.go b/github/resource_github_enterprise_private_repository_forking_setting.go new file mode 100644 index 0000000000..94021263b0 --- /dev/null +++ b/github/resource_github_enterprise_private_repository_forking_setting.go @@ -0,0 +1,192 @@ +package github + +import ( + "context" + "fmt" + "log" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" + "github.com/shurcooL/githubv4" +) + +func resourceGithubEnterprisePrivateRepositoryForkingSetting() *schema.Resource { + return &schema.Resource{ + Description: "Manages the private repository forking policy for a GitHub Enterprise.", + Create: resourceGithubEnterprisePrivateRepositoryForkingSettingCreateOrUpdate, + Read: resourceGithubEnterprisePrivateRepositoryForkingSettingRead, + Update: resourceGithubEnterprisePrivateRepositoryForkingSettingCreateOrUpdate, + Delete: resourceGithubEnterprisePrivateRepositoryForkingSettingDelete, + Importer: &schema.ResourceImporter{ + StateContext: schema.ImportStatePassthroughContext, + }, + + CustomizeDiff: func(_ context.Context, diff *schema.ResourceDiff, _ any) error { + settingValue := diff.Get("setting_value").(string) + policyValue := diff.Get("policy_value").(string) + + if settingValue == "ENABLED" && policyValue == "" { + return fmt.Errorf("policy_value is required when setting_value is ENABLED") + } + if settingValue != "ENABLED" && policyValue != "" { + return fmt.Errorf("policy_value must not be set when setting_value is %s", settingValue) + } + return nil + }, + + Schema: map[string]*schema.Schema{ + "enterprise_slug": { + Type: schema.TypeString, + Required: true, + ForceNew: true, + Description: "The slug of the enterprise.", + }, + "setting_value": { + Type: schema.TypeString, + Required: true, + ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice([]string{ + "ENABLED", + "DISABLED", + "NO_POLICY", + }, false)), + Description: "Whether private repository forking is enabled for the enterprise. Must be one of: ENABLED, DISABLED, NO_POLICY.", + }, + "policy_value": { + Type: schema.TypeString, + Optional: true, + ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice([]string{ + "ENTERPRISE_ORGANIZATIONS", + "SAME_ORGANIZATION", + "SAME_ORGANIZATION_USER_ACCOUNTS", + "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS", + "USER_ACCOUNTS", + "EVERYWHERE", + }, false)), + Description: "Where members can fork private repositories. Required when setting_value is ENABLED. Must be one of: ENTERPRISE_ORGANIZATIONS, SAME_ORGANIZATION, SAME_ORGANIZATION_USER_ACCOUNTS, ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS, USER_ACCOUNTS, EVERYWHERE.", + }, + }, + } +} + +func resourceGithubEnterprisePrivateRepositoryForkingSettingCreateOrUpdate(d *schema.ResourceData, meta any) error { + client := meta.(*Owner).v4client + ctx := context.Background() + + enterpriseSlug := d.Get("enterprise_slug").(string) + + enterpriseID, err := getEnterpriseID(ctx, client, enterpriseSlug) + if err != nil { + return fmt.Errorf("error resolving enterprise ID for slug %q: %w", enterpriseSlug, err) + } + + settingValue := githubv4.EnterpriseEnabledDisabledSettingValue(d.Get("setting_value").(string)) + + input := githubv4.UpdateEnterpriseAllowPrivateRepositoryForkingSettingInput{ + EnterpriseID: enterpriseID, + SettingValue: settingValue, + } + + if v, ok := d.GetOk("policy_value"); ok { + pv := githubv4.EnterpriseAllowPrivateRepositoryForkingPolicyValue(v.(string)) + input.PolicyValue = &pv + } + + var mutate struct { + UpdateEnterpriseAllowPrivateRepositoryForkingSetting struct { + Enterprise struct { + ID githubv4.ID + } + Message githubv4.String + } `graphql:"updateEnterpriseAllowPrivateRepositoryForkingSetting(input: $input)"` + } + + log.Printf("[DEBUG] Updating private repository forking setting for enterprise: %s", enterpriseSlug) + err = client.Mutate(ctx, &mutate, input, nil) + if err != nil { + return fmt.Errorf("error updating private repository forking setting for enterprise %q: %w", enterpriseSlug, err) + } + + d.SetId(enterpriseSlug) + + return resourceGithubEnterprisePrivateRepositoryForkingSettingRead(d, meta) +} + +func resourceGithubEnterprisePrivateRepositoryForkingSettingRead(d *schema.ResourceData, meta any) error { + client := meta.(*Owner).v4client + ctx := context.Background() + + enterpriseSlug := d.Id() + + var query struct { + Enterprise struct { + OwnerInfo struct { + AllowPrivateRepositoryForkingSetting githubv4.EnterpriseEnabledDisabledSettingValue + AllowPrivateRepositoryForkingSettingPolicyValue githubv4.EnterpriseAllowPrivateRepositoryForkingPolicyValue + } + } `graphql:"enterprise(slug: $slug)"` + } + + variables := map[string]any{ + "slug": githubv4.String(enterpriseSlug), + } + + log.Printf("[DEBUG] Reading private repository forking setting for enterprise: %s", enterpriseSlug) + err := client.Query(ctx, &query, variables) + if err != nil { + return fmt.Errorf("error reading private repository forking setting for enterprise %q: %w", enterpriseSlug, err) + } + + if err := d.Set("enterprise_slug", enterpriseSlug); err != nil { + return err + } + + settingValue := string(query.Enterprise.OwnerInfo.AllowPrivateRepositoryForkingSetting) + if err := d.Set("setting_value", settingValue); err != nil { + return err + } + + if settingValue == "ENABLED" { + if err := d.Set("policy_value", string(query.Enterprise.OwnerInfo.AllowPrivateRepositoryForkingSettingPolicyValue)); err != nil { + return err + } + } else { + if err := d.Set("policy_value", ""); err != nil { + return err + } + } + + return nil +} + +func resourceGithubEnterprisePrivateRepositoryForkingSettingDelete(d *schema.ResourceData, meta any) error { + client := meta.(*Owner).v4client + ctx := context.Background() + + enterpriseSlug := d.Id() + + enterpriseID, err := getEnterpriseID(ctx, client, enterpriseSlug) + if err != nil { + return fmt.Errorf("error resolving enterprise ID for slug %q: %w", enterpriseSlug, err) + } + + input := githubv4.UpdateEnterpriseAllowPrivateRepositoryForkingSettingInput{ + EnterpriseID: enterpriseID, + SettingValue: githubv4.EnterpriseEnabledDisabledSettingValueNoPolicy, + } + + var mutate struct { + UpdateEnterpriseAllowPrivateRepositoryForkingSetting struct { + Enterprise struct { + ID githubv4.ID + } + } `graphql:"updateEnterpriseAllowPrivateRepositoryForkingSetting(input: $input)"` + } + + log.Printf("[DEBUG] Resetting private repository forking setting to NO_POLICY for enterprise: %s", enterpriseSlug) + err = client.Mutate(ctx, &mutate, input, nil) + if err != nil { + return fmt.Errorf("error resetting private repository forking setting for enterprise %q: %w", enterpriseSlug, err) + } + + return nil +} diff --git a/github/resource_github_enterprise_private_repository_forking_setting_test.go b/github/resource_github_enterprise_private_repository_forking_setting_test.go new file mode 100644 index 0000000000..877df23d76 --- /dev/null +++ b/github/resource_github_enterprise_private_repository_forking_setting_test.go @@ -0,0 +1,254 @@ +package github + +import ( + "fmt" + "regexp" + "testing" + + "github.com/hashicorp/terraform-plugin-testing/helper/resource" +) + +func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { + t.Run("enables private repository forking with policy", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + policy_value = "SAME_ORGANIZATION" + } + `, testAccConf.enterpriseSlug) + + check := resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), + ) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + Check: check, + }, + }, + }) + }) + + t.Run("updates policy value", func(t *testing.T) { + configs := map[string]string{ + "before": fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + policy_value = "SAME_ORGANIZATION" + } + `, testAccConf.enterpriseSlug), + + "after": fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" + } + `, testAccConf.enterpriseSlug), + } + + checks := map[string]resource.TestCheckFunc{ + "before": resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), + ), + "after": resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), + ), + } + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: configs["before"], + Check: checks["before"], + }, + { + Config: configs["after"], + Check: checks["after"], + }, + }, + }) + }) + + t.Run("disables private repository forking", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "DISABLED" + } + `, testAccConf.enterpriseSlug) + + check := resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "DISABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), + ) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + Check: check, + }, + }, + }) + }) + + t.Run("sets no policy", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "NO_POLICY" + } + `, testAccConf.enterpriseSlug) + + check := resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "NO_POLICY"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), + ) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + Check: check, + }, + }, + }) + }) + + t.Run("transitions from enabled to disabled", func(t *testing.T) { + configs := map[string]string{ + "enabled": fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + policy_value = "SAME_ORGANIZATION" + } + `, testAccConf.enterpriseSlug), + + "disabled": fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "DISABLED" + } + `, testAccConf.enterpriseSlug), + } + + checks := map[string]resource.TestCheckFunc{ + "enabled": resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), + ), + "disabled": resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "DISABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), + ), + } + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: configs["enabled"], + Check: checks["enabled"], + }, + { + Config: configs["disabled"], + Check: checks["disabled"], + }, + }, + }) + }) + + t.Run("rejects policy_value when disabled", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "DISABLED" + policy_value = "SAME_ORGANIZATION" + } + `, testAccConf.enterpriseSlug) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + ExpectError: regexp.MustCompile(`policy_value must not be set when setting_value is DISABLED`), + }, + }, + }) + }) + + t.Run("requires policy_value when enabled", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + } + `, testAccConf.enterpriseSlug) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + ExpectError: regexp.MustCompile(`policy_value is required when setting_value is ENABLED`), + }, + }, + }) + }) + + t.Run("imports without error", func(t *testing.T) { + config := fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "ENABLED" + policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" + } + `, testAccConf.enterpriseSlug) + + check := resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), + resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), + ) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { skipUnlessEnterprise(t) }, + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + Check: check, + }, + { + ResourceName: "github_enterprise_private_repository_forking_setting.test", + ImportState: true, + ImportStateVerify: true, + }, + }, + }) + }) +} diff --git a/website/docs/r/enterprise_private_repository_forking_setting.html.markdown b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown new file mode 100644 index 0000000000..4ba3a6166f --- /dev/null +++ b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown @@ -0,0 +1,82 @@ +--- +layout: "github" +page_title: "GitHub: github_enterprise_private_repository_forking_setting" +description: |- + Manages the private repository forking policy for a GitHub Enterprise. +--- + +# github_enterprise_private_repository_forking_setting + +This resource manages the enterprise-level policy that controls whether and where +members can fork private and internal repositories within a GitHub Enterprise. + +When `setting_value` is `ENABLED`, the `policy_value` attribute controls where forks +can be created. When `DISABLED`, forking of private repositories is not allowed. +When `NO_POLICY`, individual organizations within the enterprise control their own +forking settings. + +~> **Note:** You must have enterprise admin access to use this resource. + +## Example Usage + +### Restrict forking to same organization only + +```hcl +resource "github_enterprise_private_repository_forking_setting" "example" { + enterprise_slug = "my-enterprise" + setting_value = "ENABLED" + policy_value = "SAME_ORGANIZATION" +} +``` + +### Allow forking to enterprise-managed user accounts or enterprise organizations + +```hcl +resource "github_enterprise_private_repository_forking_setting" "example" { + enterprise_slug = "my-enterprise" + setting_value = "ENABLED" + policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" +} +``` + +### Disable private repository forking entirely + +```hcl +resource "github_enterprise_private_repository_forking_setting" "example" { + enterprise_slug = "my-enterprise" + setting_value = "DISABLED" +} +``` + +### Allow organizations to set their own policy + +```hcl +resource "github_enterprise_private_repository_forking_setting" "example" { + enterprise_slug = "my-enterprise" + setting_value = "NO_POLICY" +} +``` + +## Argument Reference + +The following arguments are supported: + +* `enterprise_slug` - (Required) The slug of the enterprise. +* `setting_value` - (Required) Whether private repository forking is enabled for the enterprise. Must be one of `ENABLED`, `DISABLED`, or `NO_POLICY`. +* `policy_value` - (Optional) Where members can fork private repositories. Required when `setting_value` is `ENABLED`. Must be one of: + * `ENTERPRISE_ORGANIZATIONS` - Members can fork to an organization within this enterprise. + * `SAME_ORGANIZATION` - Members can fork only within the same organization (intra-org). + * `SAME_ORGANIZATION_USER_ACCOUNTS` - Members can fork to their user account or within the same organization. + * `ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS` - Members can fork to their enterprise-managed user account or an organization inside this enterprise. + * `USER_ACCOUNTS` - Members can fork to their user account. + * `EVERYWHERE` - Members can fork to their user account or an organization, either inside or outside of this enterprise. + +~> **Note:** Destroying this resource sets the enterprise policy to `NO_POLICY`, which allows individual organizations to control their own forking settings. It does not set the policy to `DISABLED`. + +## Import + +Enterprise private repository forking settings can be imported using the enterprise slug: + +``` +$ terraform import github_enterprise_private_repository_forking_setting.example my-enterprise +``` From 1042f0fc9e68e5e840f976afcf6aa4402fece5be Mon Sep 17 00:00:00 2001 From: Andrew Sweet Date: Wed, 22 Apr 2026 15:34:23 +0100 Subject: [PATCH 2/4] refactor: extract test helpers to reduce duplication in forking setting tests Add testAccEnterpriseForkingSettingConfig() and testAccEnterpriseForkingSettingCheck() helpers plus a const for the resource address. Reduces test file by ~40% while preserving all 8 test cases and their readability. Co-Authored-By: Claude Opus 4.7 (1M context) --- ...private_repository_forking_setting_test.go | 186 +++++------------- 1 file changed, 44 insertions(+), 142 deletions(-) diff --git a/github/resource_github_enterprise_private_repository_forking_setting_test.go b/github/resource_github_enterprise_private_repository_forking_setting_test.go index 877df23d76..75dbeec97b 100644 --- a/github/resource_github_enterprise_private_repository_forking_setting_test.go +++ b/github/resource_github_enterprise_private_repository_forking_setting_test.go @@ -8,192 +8,115 @@ import ( "github.com/hashicorp/terraform-plugin-testing/helper/resource" ) -func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { - t.Run("enables private repository forking with policy", func(t *testing.T) { - config := fmt.Sprintf(` +const testAccEnterpriseForkingSettingResource = "github_enterprise_private_repository_forking_setting.test" + +func testAccEnterpriseForkingSettingConfig(settingValue, policyValue string) string { + if policyValue != "" { + return fmt.Sprintf(` resource "github_enterprise_private_repository_forking_setting" "test" { enterprise_slug = "%s" - setting_value = "ENABLED" - policy_value = "SAME_ORGANIZATION" + setting_value = "%s" + policy_value = "%s" } - `, testAccConf.enterpriseSlug) + `, testAccConf.enterpriseSlug, settingValue, policyValue) + } + return fmt.Sprintf(` + resource "github_enterprise_private_repository_forking_setting" "test" { + enterprise_slug = "%s" + setting_value = "%s" + } + `, testAccConf.enterpriseSlug, settingValue) +} - check := resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), - ) +func testAccEnterpriseForkingSettingCheck(settingValue, policyValue string) resource.TestCheckFunc { + return resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "enterprise_slug", testAccConf.enterpriseSlug), + resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "setting_value", settingValue), + resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "policy_value", policyValue), + ) +} +func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { + t.Run("enables private repository forking with policy", func(t *testing.T) { resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, - Check: check, + Config: testAccEnterpriseForkingSettingConfig("ENABLED", "SAME_ORGANIZATION"), + Check: testAccEnterpriseForkingSettingCheck("ENABLED", "SAME_ORGANIZATION"), }, }, }) }) t.Run("updates policy value", func(t *testing.T) { - configs := map[string]string{ - "before": fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "ENABLED" - policy_value = "SAME_ORGANIZATION" - } - `, testAccConf.enterpriseSlug), - - "after": fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "ENABLED" - policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" - } - `, testAccConf.enterpriseSlug), - } - - checks := map[string]resource.TestCheckFunc{ - "before": resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), - ), - "after": resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), - ), - } - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: configs["before"], - Check: checks["before"], + Config: testAccEnterpriseForkingSettingConfig("ENABLED", "SAME_ORGANIZATION"), + Check: testAccEnterpriseForkingSettingCheck("ENABLED", "SAME_ORGANIZATION"), }, { - Config: configs["after"], - Check: checks["after"], + Config: testAccEnterpriseForkingSettingConfig("ENABLED", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), + Check: testAccEnterpriseForkingSettingCheck("ENABLED", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), }, }, }) }) t.Run("disables private repository forking", func(t *testing.T) { - config := fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "DISABLED" - } - `, testAccConf.enterpriseSlug) - - check := resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "DISABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), - ) - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, - Check: check, + Config: testAccEnterpriseForkingSettingConfig("DISABLED", ""), + Check: testAccEnterpriseForkingSettingCheck("DISABLED", ""), }, }, }) }) t.Run("sets no policy", func(t *testing.T) { - config := fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "NO_POLICY" - } - `, testAccConf.enterpriseSlug) - - check := resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "NO_POLICY"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), - ) - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, - Check: check, + Config: testAccEnterpriseForkingSettingConfig("NO_POLICY", ""), + Check: testAccEnterpriseForkingSettingCheck("NO_POLICY", ""), }, }, }) }) t.Run("transitions from enabled to disabled", func(t *testing.T) { - configs := map[string]string{ - "enabled": fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "ENABLED" - policy_value = "SAME_ORGANIZATION" - } - `, testAccConf.enterpriseSlug), - - "disabled": fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "DISABLED" - } - `, testAccConf.enterpriseSlug), - } - - checks := map[string]resource.TestCheckFunc{ - "enabled": resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "SAME_ORGANIZATION"), - ), - "disabled": resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "DISABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", ""), - ), - } - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: configs["enabled"], - Check: checks["enabled"], + Config: testAccEnterpriseForkingSettingConfig("ENABLED", "SAME_ORGANIZATION"), + Check: testAccEnterpriseForkingSettingCheck("ENABLED", "SAME_ORGANIZATION"), }, { - Config: configs["disabled"], - Check: checks["disabled"], + Config: testAccEnterpriseForkingSettingConfig("DISABLED", ""), + Check: testAccEnterpriseForkingSettingCheck("DISABLED", ""), }, }, }) }) t.Run("rejects policy_value when disabled", func(t *testing.T) { - config := fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "DISABLED" - policy_value = "SAME_ORGANIZATION" - } - `, testAccConf.enterpriseSlug) - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, + Config: testAccEnterpriseForkingSettingConfig("DISABLED", "SAME_ORGANIZATION"), ExpectError: regexp.MustCompile(`policy_value must not be set when setting_value is DISABLED`), }, }, @@ -201,19 +124,12 @@ func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { }) t.Run("requires policy_value when enabled", func(t *testing.T) { - config := fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "ENABLED" - } - `, testAccConf.enterpriseSlug) - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, + Config: testAccEnterpriseForkingSettingConfig("ENABLED", ""), ExpectError: regexp.MustCompile(`policy_value is required when setting_value is ENABLED`), }, }, @@ -221,30 +137,16 @@ func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { }) t.Run("imports without error", func(t *testing.T) { - config := fmt.Sprintf(` - resource "github_enterprise_private_repository_forking_setting" "test" { - enterprise_slug = "%s" - setting_value = "ENABLED" - policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" - } - `, testAccConf.enterpriseSlug) - - check := resource.ComposeTestCheckFunc( - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "enterprise_slug", testAccConf.enterpriseSlug), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "setting_value", "ENABLED"), - resource.TestCheckResourceAttr("github_enterprise_private_repository_forking_setting.test", "policy_value", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), - ) - resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { - Config: config, - Check: check, + Config: testAccEnterpriseForkingSettingConfig("ENABLED", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), + Check: testAccEnterpriseForkingSettingCheck("ENABLED", "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS"), }, { - ResourceName: "github_enterprise_private_repository_forking_setting.test", + ResourceName: testAccEnterpriseForkingSettingResource, ImportState: true, ImportStateVerify: true, }, From 6bf4ff64561052875bf39b06278dda6023dfce5f Mon Sep 17 00:00:00 2001 From: Andrew Sweet Date: Wed, 22 Apr 2026 16:25:28 +0100 Subject: [PATCH 3/4] docs: align documentation style with codebase conventions - Use "This resource allows you to..." voice (matches all enterprise resources) - Use "Creates and manages" in frontmatter description - Move admin access note to inline text (matches enterprise_actions_permissions) - Add empty "Attributes Reference" section (matches enterprise_security_analysis_settings) - Remove ~> callout for destroy note (no precedent in enterprise resource docs) Co-Authored-By: Claude Opus 4.7 (1M context) --- ...rivate_repository_forking_setting.html.markdown | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/website/docs/r/enterprise_private_repository_forking_setting.html.markdown b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown index 4ba3a6166f..b50166c42e 100644 --- a/website/docs/r/enterprise_private_repository_forking_setting.html.markdown +++ b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown @@ -2,21 +2,19 @@ layout: "github" page_title: "GitHub: github_enterprise_private_repository_forking_setting" description: |- - Manages the private repository forking policy for a GitHub Enterprise. + Creates and manages the private repository forking policy for a GitHub Enterprise. --- # github_enterprise_private_repository_forking_setting -This resource manages the enterprise-level policy that controls whether and where -members can fork private and internal repositories within a GitHub Enterprise. +This resource allows you to create and manage the private repository forking policy for a GitHub Enterprise. +You must have enterprise admin access to use this resource. When `setting_value` is `ENABLED`, the `policy_value` attribute controls where forks can be created. When `DISABLED`, forking of private repositories is not allowed. When `NO_POLICY`, individual organizations within the enterprise control their own forking settings. -~> **Note:** You must have enterprise admin access to use this resource. - ## Example Usage ### Restrict forking to same organization only @@ -71,7 +69,11 @@ The following arguments are supported: * `USER_ACCOUNTS` - Members can fork to their user account. * `EVERYWHERE` - Members can fork to their user account or an organization, either inside or outside of this enterprise. -~> **Note:** Destroying this resource sets the enterprise policy to `NO_POLICY`, which allows individual organizations to control their own forking settings. It does not set the policy to `DISABLED`. +**Note:** Destroying this resource sets the enterprise policy to `NO_POLICY`, which allows individual organizations to control their own forking settings. It does not set the policy to `DISABLED`. + +## Attributes Reference + +No additional attributes are exported. ## Import From ba2594982bda2d4be6753283c15e4f3b89318dd2 Mon Sep 17 00:00:00 2001 From: Andrew Sweet Date: Wed, 22 Apr 2026 17:45:35 +0100 Subject: [PATCH 4/4] refactor: rename setting_value/policy_value to setting/policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The _value suffix is redundant — every attribute is a value. Shorter names improve readability without losing clarity. Co-Authored-By: Claude Opus 4.7 (1M context) --- ...rise_private_repository_forking_setting.go | 24 +++++++++---------- ...private_repository_forking_setting_test.go | 18 +++++++------- ...e_repository_forking_setting.html.markdown | 18 +++++++------- 3 files changed, 30 insertions(+), 30 deletions(-) diff --git a/github/resource_github_enterprise_private_repository_forking_setting.go b/github/resource_github_enterprise_private_repository_forking_setting.go index 94021263b0..3be3427c57 100644 --- a/github/resource_github_enterprise_private_repository_forking_setting.go +++ b/github/resource_github_enterprise_private_repository_forking_setting.go @@ -22,14 +22,14 @@ func resourceGithubEnterprisePrivateRepositoryForkingSetting() *schema.Resource }, CustomizeDiff: func(_ context.Context, diff *schema.ResourceDiff, _ any) error { - settingValue := diff.Get("setting_value").(string) - policyValue := diff.Get("policy_value").(string) + settingValue := diff.Get("setting").(string) + policyValue := diff.Get("policy").(string) if settingValue == "ENABLED" && policyValue == "" { - return fmt.Errorf("policy_value is required when setting_value is ENABLED") + return fmt.Errorf("policy is required when setting is ENABLED") } if settingValue != "ENABLED" && policyValue != "" { - return fmt.Errorf("policy_value must not be set when setting_value is %s", settingValue) + return fmt.Errorf("policy must not be set when setting is %s", settingValue) } return nil }, @@ -41,7 +41,7 @@ func resourceGithubEnterprisePrivateRepositoryForkingSetting() *schema.Resource ForceNew: true, Description: "The slug of the enterprise.", }, - "setting_value": { + "setting": { Type: schema.TypeString, Required: true, ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice([]string{ @@ -51,7 +51,7 @@ func resourceGithubEnterprisePrivateRepositoryForkingSetting() *schema.Resource }, false)), Description: "Whether private repository forking is enabled for the enterprise. Must be one of: ENABLED, DISABLED, NO_POLICY.", }, - "policy_value": { + "policy": { Type: schema.TypeString, Optional: true, ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice([]string{ @@ -62,7 +62,7 @@ func resourceGithubEnterprisePrivateRepositoryForkingSetting() *schema.Resource "USER_ACCOUNTS", "EVERYWHERE", }, false)), - Description: "Where members can fork private repositories. Required when setting_value is ENABLED. Must be one of: ENTERPRISE_ORGANIZATIONS, SAME_ORGANIZATION, SAME_ORGANIZATION_USER_ACCOUNTS, ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS, USER_ACCOUNTS, EVERYWHERE.", + Description: "Where members can fork private repositories. Required when setting is ENABLED. Must be one of: ENTERPRISE_ORGANIZATIONS, SAME_ORGANIZATION, SAME_ORGANIZATION_USER_ACCOUNTS, ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS, USER_ACCOUNTS, EVERYWHERE.", }, }, } @@ -79,14 +79,14 @@ func resourceGithubEnterprisePrivateRepositoryForkingSettingCreateOrUpdate(d *sc return fmt.Errorf("error resolving enterprise ID for slug %q: %w", enterpriseSlug, err) } - settingValue := githubv4.EnterpriseEnabledDisabledSettingValue(d.Get("setting_value").(string)) + settingValue := githubv4.EnterpriseEnabledDisabledSettingValue(d.Get("setting").(string)) input := githubv4.UpdateEnterpriseAllowPrivateRepositoryForkingSettingInput{ EnterpriseID: enterpriseID, SettingValue: settingValue, } - if v, ok := d.GetOk("policy_value"); ok { + if v, ok := d.GetOk("policy"); ok { pv := githubv4.EnterpriseAllowPrivateRepositoryForkingPolicyValue(v.(string)) input.PolicyValue = &pv } @@ -141,16 +141,16 @@ func resourceGithubEnterprisePrivateRepositoryForkingSettingRead(d *schema.Resou } settingValue := string(query.Enterprise.OwnerInfo.AllowPrivateRepositoryForkingSetting) - if err := d.Set("setting_value", settingValue); err != nil { + if err := d.Set("setting", settingValue); err != nil { return err } if settingValue == "ENABLED" { - if err := d.Set("policy_value", string(query.Enterprise.OwnerInfo.AllowPrivateRepositoryForkingSettingPolicyValue)); err != nil { + if err := d.Set("policy", string(query.Enterprise.OwnerInfo.AllowPrivateRepositoryForkingSettingPolicyValue)); err != nil { return err } } else { - if err := d.Set("policy_value", ""); err != nil { + if err := d.Set("policy", ""); err != nil { return err } } diff --git a/github/resource_github_enterprise_private_repository_forking_setting_test.go b/github/resource_github_enterprise_private_repository_forking_setting_test.go index 75dbeec97b..d9d68ad8e3 100644 --- a/github/resource_github_enterprise_private_repository_forking_setting_test.go +++ b/github/resource_github_enterprise_private_repository_forking_setting_test.go @@ -15,15 +15,15 @@ func testAccEnterpriseForkingSettingConfig(settingValue, policyValue string) str return fmt.Sprintf(` resource "github_enterprise_private_repository_forking_setting" "test" { enterprise_slug = "%s" - setting_value = "%s" - policy_value = "%s" + setting = "%s" + policy = "%s" } `, testAccConf.enterpriseSlug, settingValue, policyValue) } return fmt.Sprintf(` resource "github_enterprise_private_repository_forking_setting" "test" { enterprise_slug = "%s" - setting_value = "%s" + setting = "%s" } `, testAccConf.enterpriseSlug, settingValue) } @@ -31,8 +31,8 @@ func testAccEnterpriseForkingSettingConfig(settingValue, policyValue string) str func testAccEnterpriseForkingSettingCheck(settingValue, policyValue string) resource.TestCheckFunc { return resource.ComposeTestCheckFunc( resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "enterprise_slug", testAccConf.enterpriseSlug), - resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "setting_value", settingValue), - resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "policy_value", policyValue), + resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "setting", settingValue), + resource.TestCheckResourceAttr(testAccEnterpriseForkingSettingResource, "policy", policyValue), ) } @@ -110,27 +110,27 @@ func TestAccGithubEnterprisePrivateRepositoryForkingSetting(t *testing.T) { }) }) - t.Run("rejects policy_value when disabled", func(t *testing.T) { + t.Run("rejects policy when disabled", func(t *testing.T) { resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { Config: testAccEnterpriseForkingSettingConfig("DISABLED", "SAME_ORGANIZATION"), - ExpectError: regexp.MustCompile(`policy_value must not be set when setting_value is DISABLED`), + ExpectError: regexp.MustCompile(`policy must not be set when setting is DISABLED`), }, }, }) }) - t.Run("requires policy_value when enabled", func(t *testing.T) { + t.Run("requires policy when enabled", func(t *testing.T) { resource.Test(t, resource.TestCase{ PreCheck: func() { skipUnlessEnterprise(t) }, ProviderFactories: providerFactories, Steps: []resource.TestStep{ { Config: testAccEnterpriseForkingSettingConfig("ENABLED", ""), - ExpectError: regexp.MustCompile(`policy_value is required when setting_value is ENABLED`), + ExpectError: regexp.MustCompile(`policy is required when setting is ENABLED`), }, }, }) diff --git a/website/docs/r/enterprise_private_repository_forking_setting.html.markdown b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown index b50166c42e..3b79631417 100644 --- a/website/docs/r/enterprise_private_repository_forking_setting.html.markdown +++ b/website/docs/r/enterprise_private_repository_forking_setting.html.markdown @@ -10,7 +10,7 @@ description: |- This resource allows you to create and manage the private repository forking policy for a GitHub Enterprise. You must have enterprise admin access to use this resource. -When `setting_value` is `ENABLED`, the `policy_value` attribute controls where forks +When `setting` is `ENABLED`, the `policy` attribute controls where forks can be created. When `DISABLED`, forking of private repositories is not allowed. When `NO_POLICY`, individual organizations within the enterprise control their own forking settings. @@ -22,8 +22,8 @@ forking settings. ```hcl resource "github_enterprise_private_repository_forking_setting" "example" { enterprise_slug = "my-enterprise" - setting_value = "ENABLED" - policy_value = "SAME_ORGANIZATION" + setting = "ENABLED" + policy = "SAME_ORGANIZATION" } ``` @@ -32,8 +32,8 @@ resource "github_enterprise_private_repository_forking_setting" "example" { ```hcl resource "github_enterprise_private_repository_forking_setting" "example" { enterprise_slug = "my-enterprise" - setting_value = "ENABLED" - policy_value = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" + setting = "ENABLED" + policy = "ENTERPRISE_ORGANIZATIONS_USER_ACCOUNTS" } ``` @@ -42,7 +42,7 @@ resource "github_enterprise_private_repository_forking_setting" "example" { ```hcl resource "github_enterprise_private_repository_forking_setting" "example" { enterprise_slug = "my-enterprise" - setting_value = "DISABLED" + setting = "DISABLED" } ``` @@ -51,7 +51,7 @@ resource "github_enterprise_private_repository_forking_setting" "example" { ```hcl resource "github_enterprise_private_repository_forking_setting" "example" { enterprise_slug = "my-enterprise" - setting_value = "NO_POLICY" + setting = "NO_POLICY" } ``` @@ -60,8 +60,8 @@ resource "github_enterprise_private_repository_forking_setting" "example" { The following arguments are supported: * `enterprise_slug` - (Required) The slug of the enterprise. -* `setting_value` - (Required) Whether private repository forking is enabled for the enterprise. Must be one of `ENABLED`, `DISABLED`, or `NO_POLICY`. -* `policy_value` - (Optional) Where members can fork private repositories. Required when `setting_value` is `ENABLED`. Must be one of: +* `setting` - (Required) Whether private repository forking is enabled for the enterprise. Must be one of `ENABLED`, `DISABLED`, or `NO_POLICY`. +* `policy` - (Optional) Where members can fork private repositories. Required when `setting` is `ENABLED`. Must be one of: * `ENTERPRISE_ORGANIZATIONS` - Members can fork to an organization within this enterprise. * `SAME_ORGANIZATION` - Members can fork only within the same organization (intra-org). * `SAME_ORGANIZATION_USER_ACCOUNTS` - Members can fork to their user account or within the same organization.