resource_github_repository.go

package github

import (
	"context"
	"errors"
	"fmt"
	"log"
	"net/http"
	"regexp"
	"strings"

	"github.com/google/go-github/v82/github"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
)

func resourceGithubRepository() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceGithubRepositoryCreate,
		ReadContext:   resourceGithubRepositoryRead,
		UpdateContext: resourceGithubRepositoryUpdate,
		DeleteContext: resourceGithubRepositoryDelete,
		Importer: &schema.ResourceImporter{
			StateContext: resourceGithubRepositoryImport,
		},

		SchemaVersion: 1,
		StateUpgraders: []schema.StateUpgrader{
			{
				Type:    resourceGithubRepositoryResourceV0().CoreConfigSchema().ImpliedType(),
				Upgrade: resourceGithubRepositoryInstanceStateUpgradeV0,
				Version: 0,
			},
		},

		Schema: map[string]*schema.Schema{
			"name": {
				Type:             schema.TypeString,
				Required:         true,
				ValidateDiagFunc: toDiagFunc(validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9_.]{1,100}$`), "must include only alphanumeric characters, underscores or hyphens and consist of 100 characters or less"), "name"),
				Description:      "The name of the repository.",
			},
			"description": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "A description of the repository.",
			},
			"homepage_url": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "URL of a page describing the project.",
			},
			"private": {
				Type:          schema.TypeBool,
				Computed:      true, // is affected by "visibility"
				Optional:      true,
				ConflictsWith: []string{"visibility"},
				Deprecated:    "use visibility instead",
			},
			"visibility": {
				Type:             schema.TypeString,
				Optional:         true,
				Computed:         true, // is affected by "private"
				ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"public", "private", "internal"}, false), "visibility"),
				Description:      "Can be 'public' or 'private'. If your organization is associated with an enterprise account using GitHub Enterprise Cloud or GitHub Enterprise Server 2.20+, visibility can also be 'internal'.",
			},
			// terraform-sdk-provider doesn't properly support tristate booleans: https://github.com/hashicorp/terraform-plugin-sdk/issues/817
			// Using TypeString as the best alternative for now.
			"fork": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "Set to 'true' to fork an existing repository.",
			},
			"source_owner": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "The owner of the source repository to fork from.",
			},
			"source_repo": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "The name of the source repository to fork from.",
			},
			"security_and_analysis": {
				Type:        schema.TypeList,
				Optional:    true,
				Computed:    true,
				MaxItems:    1,
				Description: "Security and analysis settings for the repository. To use this parameter you must have admin permissions for the repository or be an owner or security manager for the organization that owns the repository.",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"advanced_security": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The advanced security configuration for the repository. If a repository's visibility is 'public', advanced security is always enabled and cannot be changed, so this setting cannot be supplied.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "status"),
										Description:      "Set to 'enabled' to enable advanced security features on the repository. Can be 'enabled' or 'disabled', This value being present when split licensing is enabled will error out.",
									},
								},
							},
						},
						"code_security": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The code security configuration for the repository.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "code_security"),
										Description:      "Set to 'enabled' to enable code security on the repository. Can be 'enabled' or 'disabled'. If set to 'enabled', the repository's visibility must be 'public', 'security_and_analysis[0].advanced_security[0].status' must also be set to 'enabled', or your Organization must have split licensing for Advanced security.",
									},
								},
							},
						},
						"secret_scanning": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The secret scanning configuration for the repository.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "secret_scanning"),
										Description:      "Set to 'enabled' to enable secret scanning on the repository. Can be 'enabled' or 'disabled'. If set to 'enabled', the repository's visibility must be 'public', 'security_and_analysis[0].advanced_security[0].status' must also be set to 'enabled', or your Organization must have split licensing for Advanced security.",
									},
								},
							},
						},
						"secret_scanning_push_protection": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The secret scanning push protection configuration for the repository.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "secret_scanning_push_protection"),
										Description:      "Set to 'enabled' to enable secret scanning push protection on the repository. Can be 'enabled' or 'disabled'. If set to 'enabled', the repository's visibility must be 'public', 'security_and_analysis[0].advanced_security[0].status' must also be set to 'enabled', or your Organization must have split licensing for Advanced security.",
									},
								},
							},
						},
						"secret_scanning_ai_detection": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The secret scanning AI detection configuration for this repository.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "secret_scanning_ai_detection"),
										Description:      "Set to 'enabled' to enable secret scanning AI detection on the repository. Can be 'enabled' or 'disabled'. If set to 'enabled', the repository's visibility must be 'public', 'security_and_analysis[0].advanced_security[0].status' must also be set to 'enabled', or your Organization must have split licensing for Advanced security.",
									},
								},
							},
						},
						"secret_scanning_non_provider_patterns": {
							Type:        schema.TypeList,
							Optional:    true,
							MaxItems:    1,
							Description: "The secret scanning non-provider patterns configuration for this repository.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"status": {
										Type:             schema.TypeString,
										Required:         true,
										ValidateDiagFunc: toDiagFunc(validation.StringInSlice([]string{"enabled", "disabled"}, false), "secret_scanning_non_provider_patterns"),
										Description:      "Set to 'enabled' to enable secret scanning non-provider patterns on the repository. Can be 'enabled' or 'disabled'. If set to 'enabled', the repository's visibility must be 'public', 'security_and_analysis[0].advanced_security[0].status' must also be set to 'enabled', or your Organization must have split licensing for Advanced security.",
									},
								},
							},
						},
					},
				},
			},
			"has_issues": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to enable the GitHub Issues features on the repository",
			},
			"has_discussions": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to enable GitHub Discussions on the repository. Defaults to 'false'.",
			},
			"has_projects": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to enable the GitHub Projects features on the repository. Per the GitHub documentation when in an organization that has disabled repository projects it will default to 'false' and will otherwise default to 'true'. If you specify 'true' when it has been disabled it will return an error.",
			},
			"has_downloads": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to enable the (deprecated) downloads features on the repository.",
				Deprecated:  "This attribute is no longer in use, but it hasn't been removed yet. It will be removed in a future version. See https://github.com/orgs/community/discussions/102145#discussioncomment-8351756",
			},
			"has_wiki": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to enable the GitHub Wiki features on the repository.",
			},
			"is_template": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to tell GitHub that this is a template repository.",
			},
			"allow_merge_commit": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     true,
				Description: "Set to 'false' to disable merge commits on the repository.",
			},
			"allow_squash_merge": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     true,
				Description: "Set to 'false' to disable squash merges on the repository.",
			},
			"allow_rebase_merge": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     true,
				Description: "Set to 'false' to disable rebase merges on the repository.",
			},
			"allow_auto_merge": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Set to 'true' to allow auto-merging pull requests on the repository.",
			},
			"allow_forking": {
				Type:        schema.TypeBool,
				Optional:    true,
				Computed:    true,
				Description: "Set to 'true' to allow private forking on the repository; this is only relevant if the repository is owned by an organization and is private or internal.",
			},
			"squash_merge_commit_title": {
				Type:        schema.TypeString,
				Optional:    true,
				Default:     "COMMIT_OR_PR_TITLE",
				Description: "Can be 'PR_TITLE' or 'COMMIT_OR_PR_TITLE' for a default squash merge commit title.",
			},
			"squash_merge_commit_message": {
				Type:        schema.TypeString,
				Optional:    true,
				Default:     "COMMIT_MESSAGES",
				Description: "Can be 'PR_BODY', 'COMMIT_MESSAGES', or 'BLANK' for a default squash merge commit message.",
			},
			"merge_commit_title": {
				Type:        schema.TypeString,
				Optional:    true,
				Default:     "MERGE_MESSAGE",
				Description: "Can be 'PR_TITLE' or 'MERGE_MESSAGE' for a default merge commit title.",
			},
			"merge_commit_message": {
				Type:        schema.TypeString,
				Optional:    true,
				Default:     "PR_TITLE",
				Description: "Can be 'PR_BODY', 'PR_TITLE', or 'BLANK' for a default merge commit message.",
			},
			"delete_branch_on_merge": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Automatically delete head branch after a pull request is merged. Defaults to 'false'.",
			},
			"web_commit_signoff_required": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Require contributors to sign off on web-based commits. Defaults to 'false'.",
			},
			"auto_init": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to produce an initial commit in the repository.",
			},
			"default_branch": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "Can only be set after initial repository creation, and only if the target branch exists",
				Deprecated:  "Use the github_branch_default resource instead",
			},
			"license_template": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "Use the name of the template without the extension. For example, 'mit' or 'mpl-2.0'.",
			},
			"gitignore_template": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "Use the name of the template without the extension. For example, 'Haskell'.",
			},
			"archived": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Specifies if the repository should be archived. Defaults to 'false'. NOTE Currently, the API does not support unarchiving.",
			},
			"archive_on_destroy": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: "Set to 'true' to archive the repository instead of deleting on destroy.",
			},
			"pages": {
				Type:        schema.TypeList,
				MaxItems:    1,
				Optional:    true,
				Description: "The repository's GitHub Pages configuration",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"source": {
							Type:        schema.TypeList,
							MaxItems:    1,
							Optional:    true,
							Description: "The source branch and directory for the rendered Pages site.",
							Elem: &schema.Resource{
								Schema: map[string]*schema.Schema{
									"branch": {
										Type:        schema.TypeString,
										Required:    true,
										Description: "The repository branch used to publish the site's source files. (i.e. 'main' or 'gh-pages')",
									},
									"path": {
										Type:        schema.TypeString,
										Optional:    true,
										Default:     "/",
										Description: "The repository directory from which the site publishes (Default: '/')",
									},
								},
							},
						},
						"build_type": {
							Type:             schema.TypeString,
							Optional:         true,
							Default:          "legacy",
							Description:      "The type the page should be sourced.",
							ValidateDiagFunc: validateValueFunc([]string{"legacy", "workflow"}),
						},
						"cname": {
							Type:        schema.TypeString,
							Optional:    true,
							Description: "The custom domain for the repository. This can only be set after the repository has been created.",
						},
						"custom_404": {
							Type:        schema.TypeBool,
							Computed:    true,
							Description: "Whether the rendered GitHub Pages site has a custom 404 page",
						},
						"html_url": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "URL to the repository on the web.",
						},
						"status": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: "The GitHub Pages site's build status e.g. building or built.",
						},
						"url": {
							Type:     schema.TypeString,
							Computed: true,
						},
					},
				},
			},
			"topics": {
				Type:        schema.TypeSet,
				Optional:    true,
				Computed:    true,
				Description: "The list of topics of the repository.",
				Elem: &schema.Schema{
					Type:             schema.TypeString,
					ValidateDiagFunc: toDiagFunc(validation.StringMatch(regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,49}$`), "must include only lowercase alphanumeric characters or hyphens and cannot start with a hyphen and consist of 50 characters or less"), "topics"),
				},
			},
			"vulnerability_alerts": {
				Type:        schema.TypeBool,
				Optional:    true,
				Computed:    true,
				Description: "Set to 'true' to enable security alerts for vulnerable dependencies. Enabling requires alerts to be enabled on the owner level. (Note for importing: GitHub enables the alerts on all repos by default). Note that vulnerability alerts have not been successfully tested on any GitHub Enterprise instance and may be unavailable in those settings.",
			},
			"ignore_vulnerability_alerts_during_read": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Set to true to not call the vulnerability alerts endpoint so the resource can also be used without admin permissions during read.",
			},
			"full_name": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "A string of the form 'orgname/reponame'.",
			},
			"html_url": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "URL to the repository on the web.",
			},
			"ssh_clone_url": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "URL that can be provided to 'git clone' to clone the repository via SSH.",
			},
			"svn_url": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "URL that can be provided to 'svn checkout' to check out the repository via GitHub's Subversion protocol emulation.",
			},
			"git_clone_url": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "URL that can be provided to 'git clone' to clone the repository anonymously via the git protocol.",
			},
			"http_clone_url": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "URL that can be provided to 'git clone' to clone the repository via HTTPS.",
			},
			"etag": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				DiffSuppressFunc: func(k, o, n string, d *schema.ResourceData) bool {
					return true
				},
				DiffSuppressOnRefresh: true,
			},
			"primary_language": {
				Type:     schema.TypeString,
				Computed: true,
			},
			"template": {
				Type:        schema.TypeList,
				Optional:    true,
				MaxItems:    1,
				Description: "Use a template repository to create this resource.",
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"include_all_branches": {
							Type:        schema.TypeBool,
							Optional:    true,
							Default:     false,
							Description: "Whether the new repository should include all the branches from the template repository (defaults to 'false', which includes only the default branch from the template).",
						},
						"owner": {
							Type:        schema.TypeString,
							Required:    true,
							Description: "The GitHub organization or user the template repository is owned by.",
						},
						"repository": {
							Type:        schema.TypeString,
							Required:    true,
							Description: "The name of the template repository.",
						},
					},
				},
			},
			"node_id": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "GraphQL global node id for use with v4 API.",
			},
			"repo_id": {
				Type:        schema.TypeInt,
				Computed:    true,
				Description: "GitHub ID for the repository.",
			},
			"allow_update_branch": {
				Type:        schema.TypeBool,
				Optional:    true,
				Description: " Set to 'true' to always suggest updating pull request branches.",
			},
		},
		CustomizeDiff: customdiff.All(
			customDiffFunction,
			customdiff.ForceNewIfChange("fork", valueChangedButNotEmpty),
			customdiff.ForceNewIfChange("source_repo", valueChangedButNotEmpty),
			customdiff.ForceNewIfChange("source_owner", valueChangedButNotEmpty),
		),
	}
}

// valueChangedButNotEmpty is a customdiff function that triggers recreation of the resource
// if the field's value changes from a non-empty state to a different non-empty value.
func valueChangedButNotEmpty(ctx context.Context, oldVal, newVal, meta any) bool {
	oldValStr := oldVal.(string)
	newValStr := newVal.(string)
	return oldValStr != "" && oldValStr != newValStr
}

func customDiffFunction(_ context.Context, diff *schema.ResourceDiff, v any) error {
	if diff.HasChange("name") {
		if err := diff.SetNewComputed("full_name"); err != nil {
			return err
		}
	}
	return nil
}

func calculateVisibility(d *schema.ResourceData) string {
	if value, ok := d.GetOk("visibility"); ok {
		return value.(string)
	}

	if value, ok := d.GetOk("private"); ok {
		if value.(bool) {
			return "private"
		} else {
			return "public"
		}
	}

	return "public"
}

func tryGetSecurityAndAnalysisSettingStatus(securityAndAnalysis map[string]any, setting string) (bool, string) {
	value, ok := securityAndAnalysis[setting]
	if !ok {
		return false, ""
	}

	asList := value.([]any)
	if len(asList) == 0 || asList[0] == nil {
		return false, ""
	}

	return true, asList[0].(map[string]any)["status"].(string)
}

func calculateSecurityAndAnalysis(d *schema.ResourceData) *github.SecurityAndAnalysis {
	value, ok := d.GetOk("security_and_analysis")
	if !ok {
		return nil
	}

	asList := value.([]any)
	if len(asList) == 0 || asList[0] == nil {
		return nil
	}

	lookup := asList[0].(map[string]any)

	var securityAndAnalysis github.SecurityAndAnalysis

	if ok, status := tryGetSecurityAndAnalysisSettingStatus(lookup, "advanced_security"); ok {
		securityAndAnalysis.AdvancedSecurity = &github.AdvancedSecurity{
			Status: github.Ptr(status),
		}
	}
	if ok, status := tryGetSecurityAndAnalysisSettingStatus(lookup, "secret_scanning"); ok {
		securityAndAnalysis.SecretScanning = &github.SecretScanning{
			Status: github.Ptr(status),
		}
	}
	if ok, status := tryGetSecurityAndAnalysisSettingStatus(lookup, "secret_scanning_push_protection"); ok {
		securityAndAnalysis.SecretScanningPushProtection = &github.SecretScanningPushProtection{
			Status: github.Ptr(status),
		}
	}

	return &securityAndAnalysis
}

func resourceGithubRepositoryObject(d *schema.ResourceData) *github.Repository {
	visibility := calculateVisibility(d)

	repository := &github.Repository{
		Name:                     github.Ptr(d.Get("name").(string)),
		Description:              github.Ptr(d.Get("description").(string)),
		Homepage:                 github.Ptr(d.Get("homepage_url").(string)),
		Visibility:               github.Ptr(visibility),
		HasDownloads:             github.Ptr(d.Get("has_downloads").(bool)),
		HasIssues:                github.Ptr(d.Get("has_issues").(bool)),
		HasDiscussions:           github.Ptr(d.Get("has_discussions").(bool)),
		HasProjects:              github.Ptr(d.Get("has_projects").(bool)),
		HasWiki:                  github.Ptr(d.Get("has_wiki").(bool)),
		IsTemplate:               github.Ptr(d.Get("is_template").(bool)),
		AllowMergeCommit:         github.Ptr(d.Get("allow_merge_commit").(bool)),
		AllowSquashMerge:         github.Ptr(d.Get("allow_squash_merge").(bool)),
		AllowRebaseMerge:         github.Ptr(d.Get("allow_rebase_merge").(bool)),
		AllowAutoMerge:           github.Ptr(d.Get("allow_auto_merge").(bool)),
		DeleteBranchOnMerge:      github.Ptr(d.Get("delete_branch_on_merge").(bool)),
		WebCommitSignoffRequired: github.Ptr(d.Get("web_commit_signoff_required").(bool)),
		AutoInit:                 github.Ptr(d.Get("auto_init").(bool)),
		LicenseTemplate:          github.Ptr(d.Get("license_template").(string)),
		GitignoreTemplate:        github.Ptr(d.Get("gitignore_template").(string)),
		Archived:                 github.Ptr(d.Get("archived").(bool)),
		Topics:                   expandStringList(d.Get("topics").(*schema.Set).List()),
		AllowUpdateBranch:        github.Ptr(d.Get("allow_update_branch").(bool)),
		SecurityAndAnalysis:      calculateSecurityAndAnalysis(d),
	}

	// only configure merge commit if we are in commit merge strategy
	allowMergeCommit, ok := d.Get("allow_merge_commit").(bool)
	if ok {
		if allowMergeCommit {
			repository.MergeCommitTitle = github.Ptr(d.Get("merge_commit_title").(string))
			repository.MergeCommitMessage = github.Ptr(d.Get("merge_commit_message").(string))
		}
	}

	// only configure squash commit if we are in squash merge strategy
	allowSquashMerge, ok := d.Get("allow_squash_merge").(bool)
	if ok {
		if allowSquashMerge {
			repository.SquashMergeCommitTitle = github.Ptr(d.Get("squash_merge_commit_title").(string))
			repository.SquashMergeCommitMessage = github.Ptr(d.Get("squash_merge_commit_message").(string))
		}
	}

	// only configure allow forking if repository is not public
	if allowForking, ok := d.GetOkExists("allow_forking"); ok && visibility != "public" { //nolint:staticcheck,SA1019 // We sometimes need to use GetOkExists for booleans
		if val, ok := allowForking.(bool); ok {
			repository.AllowForking = github.Ptr(val)
		}
	}

	return repository
}

func resourceGithubRepositoryCreate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	client := meta.(*Owner).v3client

	if branchName, hasDefaultBranch := d.GetOk("default_branch"); hasDefaultBranch && (branchName != "main") {
		return diag.Errorf("cannot set the default branch on a new repository to something other than 'main'")
	}

	repoReq := resourceGithubRepositoryObject(d)
	owner := meta.(*Owner).name
	repoName := repoReq.GetName()

	isPrivate := repoReq.GetVisibility() == "private"
	repoReq.Private = github.Ptr(isPrivate)
	if template, ok := d.GetOk("template"); ok {
		templateConfigBlocks := template.([]any)

		for _, templateConfigBlock := range templateConfigBlocks {
			templateConfigMap, ok := templateConfigBlock.(map[string]any)
			if !ok {
				return diag.FromErr(errors.New("failed to unpack template configuration block"))
			}

			templateRepo := templateConfigMap["repository"].(string)
			templateRepoOwner := templateConfigMap["owner"].(string)
			includeAllBranches := templateConfigMap["include_all_branches"].(bool)

			templateRepoReq := github.TemplateRepoRequest{
				Name:               &repoName,
				Owner:              &owner,
				Description:        github.Ptr(d.Get("description").(string)),
				Private:            github.Ptr(isPrivate),
				IncludeAllBranches: github.Ptr(includeAllBranches),
			}

			repo, _, err := client.Repositories.CreateFromTemplate(ctx,
				templateRepoOwner,
				templateRepo,
				&templateRepoReq,
			)
			if err != nil {
				return diag.FromErr(err)
			}

			d.SetId(*repo.Name)
		}
	} else if d.Get("fork").(string) == "true" {
		// Handle repository forking
		sourceOwner := d.Get("source_owner").(string)
		sourceRepo := d.Get("source_repo").(string)
		requestedName := d.Get("name").(string)
		log.Printf("[INFO] Creating fork of %s/%s in %s", sourceOwner, sourceRepo, owner)

		if sourceOwner == "" || sourceRepo == "" {
			return diag.Errorf("source_owner and source_repo must be provided when forking a repository")
		}

		// Create the fork using the GitHub client library
		opts := &github.RepositoryCreateForkOptions{
			Name: requestedName,
		}

		if meta.(*Owner).IsOrganization {
			opts.Organization = owner
		}

		fork, resp, err := client.Repositories.CreateFork(ctx, sourceOwner, sourceRepo, opts)

		if err != nil {
			// Handle accepted error (202) which means the fork is being created asynchronously
			acceptedError := &github.AcceptedError{}
			if errors.As(err, &acceptedError) {
				log.Printf("[INFO] Fork is being created asynchronously")
				// Despite the 202 status, the API should still return preliminary fork information
				if fork == nil {
					return diag.Errorf("fork information not available after accepted status")
				}
				log.Printf("[DEBUG] Fork name: %s", fork.GetName())
			} else {
				return diag.Errorf("failed to create fork: %s", err.Error())
			}
		} else if resp != nil {
			log.Printf("[DEBUG] Fork response status: %d", resp.StatusCode)
		}

		if fork == nil {
			return diag.Errorf("fork creation failed - no repository returned")
		}

		log.Printf("[INFO] Fork created with name: %s", fork.GetName())
		d.SetId(fork.GetName())
		log.Printf("[DEBUG] Set resource ID to just the name: %s", d.Id())

		_ = d.Set("name", fork.GetName())
		_ = d.Set("full_name", fork.GetFullName()) // Add the full name for reference
		_ = d.Set("html_url", fork.GetHTMLURL())
		_ = d.Set("ssh_clone_url", fork.GetSSHURL())
		_ = d.Set("git_clone_url", fork.GetGitURL())
		_ = d.Set("http_clone_url", fork.GetCloneURL())
	} else {
		// Create without a repository template
		var repo *github.Repository
		var err error
		if meta.(*Owner).IsOrganization {
			repo, _, err = client.Repositories.Create(ctx, owner, repoReq)
		} else {
			// Create repository within authenticated user's account
			repo, _, err = client.Repositories.Create(ctx, "", repoReq)
		}
		if err != nil {
			return diag.FromErr(err)
		}
		d.SetId(repo.GetName())
	}

	topics := repoReq.Topics
	if len(topics) > 0 {
		_, _, err := client.Repositories.ReplaceAllTopics(ctx, owner, repoName, topics)
		if err != nil {
			return diag.FromErr(err)
		}
	}

	pages := expandPages(d.Get("pages").([]any))
	if pages != nil {
		_, _, err := client.Repositories.EnablePages(ctx, owner, repoName, pages)
		if err != nil {
			return diag.FromErr(err)
		}
	}

	return resourceGithubRepositoryUpdate(ctx, d, meta)
}

func resourceGithubRepositoryRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	client := meta.(*Owner).v3client

	owner := meta.(*Owner).name
	repoName := d.Id()

	// When the user has not authenticated the provider, AnonymousHTTPClient is used, therefore owner == "". In this
	// case lookup the owner in the data, and use that, if present.
	if explicitOwner, _, ok := resourceGithubParseFullName(d); ok && owner == "" {
		owner = explicitOwner
	}

	ctx = context.WithValue(ctx, ctxId, d.Id())
	if !d.IsNewResource() {
		ctx = context.WithValue(ctx, ctxEtag, d.Get("etag").(string))
	}

	repo, resp, err := client.Repositories.Get(ctx, owner, repoName)
	if err != nil {
		var ghErr *github.ErrorResponse
		if errors.As(err, &ghErr) {
			if ghErr.Response.StatusCode == http.StatusNotModified {
				return nil
			}
			if ghErr.Response.StatusCode == http.StatusNotFound {
				log.Printf("[INFO] Removing repository %s/%s from state because it no longer exists in GitHub",
					owner, repoName)
				d.SetId("")
				return nil
			}
		}
		return diag.FromErr(err)
	}

	_ = d.Set("etag", resp.Header.Get("ETag"))
	_ = d.Set("name", repoName)
	_ = d.Set("description", repo.GetDescription())
	_ = d.Set("primary_language", repo.GetLanguage())
	_ = d.Set("homepage_url", repo.GetHomepage())
	_ = d.Set("private", repo.GetPrivate())
	_ = d.Set("visibility", repo.GetVisibility())
	_ = d.Set("has_issues", repo.GetHasIssues())
	_ = d.Set("has_discussions", repo.GetHasDiscussions())
	_ = d.Set("has_projects", repo.GetHasProjects())
	_ = d.Set("has_wiki", repo.GetHasWiki())
	_ = d.Set("is_template", repo.GetIsTemplate())
	_ = d.Set("full_name", repo.GetFullName())
	_ = d.Set("default_branch", repo.GetDefaultBranch())
	_ = d.Set("html_url", repo.GetHTMLURL())
	_ = d.Set("ssh_clone_url", repo.GetSSHURL())
	_ = d.Set("svn_url", repo.GetSVNURL())
	_ = d.Set("git_clone_url", repo.GetGitURL())
	_ = d.Set("http_clone_url", repo.GetCloneURL())
	_ = d.Set("archived", repo.GetArchived())
	_ = d.Set("topics", flattenStringList(repo.Topics))
	_ = d.Set("node_id", repo.GetNodeID())
	_ = d.Set("repo_id", repo.GetID())

	// GitHub API doesn't respond following parameters when repository is archived
	if !d.Get("archived").(bool) {
		_ = d.Set("allow_auto_merge", repo.GetAllowAutoMerge())
		_ = d.Set("allow_merge_commit", repo.GetAllowMergeCommit())
		_ = d.Set("allow_rebase_merge", repo.GetAllowRebaseMerge())
		_ = d.Set("allow_squash_merge", repo.GetAllowSquashMerge())
		_ = d.Set("allow_update_branch", repo.GetAllowUpdateBranch())
		_ = d.Set("allow_forking", repo.GetAllowForking())
		_ = d.Set("delete_branch_on_merge", repo.GetDeleteBranchOnMerge())
		_ = d.Set("web_commit_signoff_required", repo.GetWebCommitSignoffRequired())
		_ = d.Set("has_downloads", repo.GetHasDownloads())
		_ = d.Set("merge_commit_message", repo.GetMergeCommitMessage())
		_ = d.Set("merge_commit_title", repo.GetMergeCommitTitle())
		_ = d.Set("squash_merge_commit_message", repo.GetSquashMergeCommitMessage())
		_ = d.Set("squash_merge_commit_title", repo.GetSquashMergeCommitTitle())
	}

	if repo.GetHasPages() {
		pages, _, err := client.Repositories.GetPagesInfo(ctx, owner, repoName)
		if err != nil {
			return diag.FromErr(err)
		}
		if err := d.Set("pages", flattenPages(pages)); err != nil {
			return diag.Errorf("error setting pages: %s", err.Error())
		}
	}

	// Set fork information if this is a fork
	if repo.GetFork() {
		_ = d.Set("fork", "true")

		// If the repository has parent information, set the source details
		if repo.Parent != nil {
			_ = d.Set("source_owner", repo.Parent.GetOwner().GetLogin())
			_ = d.Set("source_repo", repo.Parent.GetName())
		}
	} else {
		_ = d.Set("fork", "false")
		_ = d.Set("source_owner", "")
		_ = d.Set("source_repo", "")
	}

	if repo.TemplateRepository != nil {
		if err = d.Set("template", []any{
			map[string]any{
				"owner":      repo.TemplateRepository.Owner.Login,
				"repository": repo.TemplateRepository.Name,
			},
		}); err != nil {
			return diag.FromErr(err)
		}
	} else {
		if err = d.Set("template", []any{}); err != nil {
			return diag.FromErr(err)
		}
	}

	if !d.Get("ignore_vulnerability_alerts_during_read").(bool) {
		vulnerabilityAlerts, _, err := client.Repositories.GetVulnerabilityAlerts(ctx, owner, repoName)
		if err != nil {
			return diag.Errorf("error reading repository vulnerability alerts: %s", err.Error())
		}
		if err = d.Set("vulnerability_alerts", vulnerabilityAlerts); err != nil {
			return diag.FromErr(err)
		}
	}

	if err = d.Set("security_and_analysis", flattenSecurityAndAnalysis(repo.GetSecurityAndAnalysis())); err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceGithubRepositoryUpdate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	// Can only update a repository if it is not archived or the update is to
	// archive the repository (unarchiving is not supported by the GitHub API)
	if d.Get("archived").(bool) && !d.HasChange("archived") {
		log.Printf("[INFO] Skipping update of archived repository")
		return nil
	}

	client := meta.(*Owner).v3client

	repoReq := resourceGithubRepositoryObject(d)

	// handle visibility updates separately from other fields
	visibility := repoReq.GetVisibility()
	repoReq.Visibility = nil

	// This change needs to be made with the correct visibility
	allowForking := repoReq.AllowForking
	if d.HasChanges("visibility", "private") {
		repoReq.AllowForking = nil
	}

	if !d.HasChange("security_and_analysis") {
		repoReq.SecurityAndAnalysis = nil
		log.Print("[DEBUG] No security_and_analysis update required. Removing this field from the payload.")
	}

	// The documentation for `default_branch` states: "This can only be set
	// after a repository has already been created". However, for backwards
	// compatibility we need to allow terraform configurations that set
	// `default_branch` to "main" when a repository is created.
	if d.HasChange("default_branch") && !d.IsNewResource() {
		repoReq.DefaultBranch = github.Ptr(d.Get("default_branch").(string))
	}

	repoName := d.Id()
	owner := meta.(*Owner).name
	ctx = context.WithValue(ctx, ctxId, d.Id())

	// When the organization has "Require sign off on web-based commits" enabled,
	// the API doesn't allow you to send `web_commit_signoff_required` in order to
	// update the repository with this field or it will throw a 422 error.
	// As a workaround, we check if the organization requires it, and if so,
	// we remove the field from the request.
	if d.HasChange("web_commit_signoff_required") && meta.(*Owner).IsOrganization {
		organization, _, err := client.Organizations.Get(ctx, owner)
		if err == nil {
			if organization != nil && organization.GetWebCommitSignoffRequired() {
				repoReq.WebCommitSignoffRequired = nil
			}
		}
	}

	repo, _, err := client.Repositories.Edit(ctx, owner, repoName, repoReq)
	if err != nil {
		return diag.FromErr(err)
	}
	d.SetId(*repo.Name)

	if d.HasChange("pages") && !d.IsNewResource() {
		opts := expandPagesUpdate(d.Get("pages").([]any))
		if opts != nil {
			pages, res, err := client.Repositories.GetPagesInfo(ctx, owner, repoName)
			if res.StatusCode != http.StatusNotFound && err != nil {
				return diag.FromErr(err)
			}

			if pages == nil {
				_, _, err = client.Repositories.EnablePages(ctx, owner, repoName, &github.Pages{Source: opts.Source, BuildType: opts.BuildType})
			} else {
				_, err = client.Repositories.UpdatePages(ctx, owner, repoName, opts)
			}
			if err != nil {
				return diag.FromErr(err)
			}
		} else {
			_, err := client.Repositories.DisablePages(ctx, owner, repoName)
			if err != nil {
				return diag.FromErr(err)
			}
		}
	}

	if d.HasChange("topics") {
		topics := repoReq.Topics
		_, _, err = client.Repositories.ReplaceAllTopics(ctx, owner, *repo.Name, topics)
		if err != nil {
			return diag.FromErr(err)
		}
		d.SetId(*repo.Name)

		if d.HasChange("topics") {
			topics := repoReq.Topics
			_, _, err = client.Repositories.ReplaceAllTopics(ctx, owner, *repo.Name, topics)
			if err != nil {
				return diag.FromErr(err)
			}
		}
	}

	if v, ok := d.GetOkExists("vulnerability_alerts"); ok { //nolint:staticcheck,SA1019 // We sometimes need to use GetOkExists for booleans
		if val, ok := v.(bool); ok {
			err := updateVulnerabilityAlerts(ctx, client, owner, repoName, val)
			if err != nil {
				return diag.FromErr(err)
			}
		}
	}

	if d.HasChanges("visibility", "private") {
		repoReq.Visibility = github.Ptr(visibility)
		repoReq.AllowForking = allowForking

		log.Printf("[DEBUG] Updating repository visibility from %s to %s", repo.GetVisibility(), visibility)
		_, resp, err := client.Repositories.Edit(ctx, owner, repoName, repoReq)
		if err != nil {
			if resp.StatusCode != 422 || !strings.Contains(err.Error(), fmt.Sprintf("Visibility is already %s", visibility)) {
				return diag.FromErr(err)
			}
		}
	}

	return resourceGithubRepositoryRead(ctx, d, meta)
}

func resourceGithubRepositoryDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	client := meta.(*Owner).v3client
	repoName := d.Id()
	owner := meta.(*Owner).name
	ctx = context.WithValue(ctx, ctxId, d.Id())

	archiveOnDestroy := d.Get("archive_on_destroy").(bool)
	if archiveOnDestroy {
		if d.Get("archived").(bool) {
			log.Printf("[DEBUG] Repository already archived, nothing to do on delete: %s/%s", owner, repoName)
			return nil
		} else {
			if err := d.Set("archived", true); err != nil {
				return diag.FromErr(err)
			}
			repoReq := resourceGithubRepositoryObject(d)
			// Always remove `web_commit_signoff_required` when archiving, to avoid 422 error
			repoReq.WebCommitSignoffRequired = nil
			log.Printf("[DEBUG] Archiving repository on delete: %s/%s", owner, repoName)
			_, _, err := client.Repositories.Edit(ctx, owner, repoName, repoReq)
			return diag.FromErr(err)
		}
	}

	log.Printf("[DEBUG] Deleting repository: %s/%s", owner, repoName)
	_, err := client.Repositories.Delete(ctx, owner, repoName)
	return diag.FromErr(err)
}

func resourceGithubRepositoryImport(ctx context.Context, d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) {
	if err := d.Set("auto_init", false); err != nil {
		return nil, err
	}
	if err := d.Set("ignore_vulnerability_alerts_during_read", true); err != nil {
		return nil, err
	}
	return []*schema.ResourceData{d}, nil
}

func expandPages(input []any) *github.Pages {
	if len(input) == 0 || input[0] == nil {
		return nil
	}
	pages := input[0].(map[string]any)
	source := &github.PagesSource{
		Branch: github.Ptr("main"),
	}
	if len(pages["source"].([]any)) == 1 {
		if pagesSource, ok := pages["source"].([]any)[0].(map[string]any); ok {
			if v, ok := pagesSource["branch"].(string); ok {
				source.Branch = github.Ptr(v)
			}
			if v, ok := pagesSource["path"].(string); ok {
				// To set to the root directory "/", leave source.Path unset
				if v != "" && v != "/" {
					source.Path = github.Ptr(v)
				}
			}
		}
	}

	var buildType *string
	if v, ok := pages["build_type"].(string); ok {
		buildType = github.Ptr(v)
	}

	return &github.Pages{Source: source, BuildType: buildType}
}

func expandPagesUpdate(input []any) *github.PagesUpdate {
	if len(input) == 0 || input[0] == nil {
		return nil
	}

	pages := input[0].(map[string]any)
	update := &github.PagesUpdate{}

	// Only set the github.PagesUpdate CNAME field if the value is a non-empty string.
	// Leaving the CNAME field unset will remove the custom domain.
	if v, ok := pages["cname"].(string); ok && v != "" {
		update.CNAME = github.Ptr(v)
	}

	// Only set the github.PagesUpdate BuildType field if the value is a non-empty string.
	if v, ok := pages["build_type"].(string); ok && v != "" {
		update.BuildType = github.Ptr(v)
	}

	// To update the GitHub Pages source, the github.PagesUpdate Source field
	// must include the branch name and optionally the subdirectory /docs.
	// e.g. "master" or "master /docs"
	// This is only necessary if the BuildType is "legacy".
	if update.BuildType == nil || *update.BuildType == "legacy" {
		pagesSource := pages["source"].([]any)[0].(map[string]any)
		sourceBranch := pagesSource["branch"].(string)
		sourcePath := ""
		if v, ok := pagesSource["path"].(string); ok && v != "" {
			sourcePath = v
		}
		update.Source = &github.PagesSource{Branch: &sourceBranch, Path: &sourcePath}
	}

	return update
}

func flattenPages(pages *github.Pages) []any {
	if pages == nil {
		return []any{}
	}

	pagesMap := make(map[string]any)
	buildType := pages.GetBuildType()
	pagesMap["build_type"] = buildType

	if buildType == "legacy" {
		sourceMap := make(map[string]any)
		sourceMap["branch"] = pages.GetSource().GetBranch()
		sourceMap["path"] = pages.GetSource().GetPath()
		pagesMap["source"] = []any{sourceMap}
	} else {
		pagesMap["source"] = nil
	}

	pagesMap["url"] = pages.GetURL()
	pagesMap["status"] = pages.GetStatus()
	pagesMap["cname"] = pages.GetCNAME()
	pagesMap["custom_404"] = pages.GetCustom404()
	pagesMap["html_url"] = pages.GetHTMLURL()

	return []any{pagesMap}
}

func flattenRepositoryLicense(repositorylicense *github.RepositoryLicense) []any {
	if repositorylicense == nil {
		return []any{}
	}

	licenseMap := make(map[string]any)
	licenseMap["key"] = repositorylicense.GetLicense().GetKey()
	licenseMap["name"] = repositorylicense.GetLicense().GetName()
	licenseMap["url"] = repositorylicense.GetLicense().GetURL()
	licenseMap["spdx_id"] = repositorylicense.GetLicense().GetSPDXID()
	licenseMap["html_url"] = repositorylicense.GetLicense().GetHTMLURL()
	licenseMap["featured"] = repositorylicense.GetLicense().GetFeatured()
	licenseMap["description"] = repositorylicense.GetLicense().GetDescription()
	licenseMap["implementation"] = repositorylicense.GetLicense().GetImplementation()
	licenseMap["permissions"] = repositorylicense.GetLicense().GetPermissions()
	licenseMap["conditions"] = repositorylicense.GetLicense().GetConditions()
	licenseMap["limitations"] = repositorylicense.GetLicense().GetLimitations()
	licenseMap["body"] = repositorylicense.GetLicense().GetBody()

	repositorylicenseMap := make(map[string]any)
	repositorylicenseMap["license"] = []any{licenseMap}
	repositorylicenseMap["name"] = repositorylicense.GetName()
	repositorylicenseMap["path"] = repositorylicense.GetPath()
	repositorylicenseMap["sha"] = repositorylicense.GetSHA()
	repositorylicenseMap["size"] = repositorylicense.GetSize()
	repositorylicenseMap["url"] = repositorylicense.GetURL()
	repositorylicenseMap["html_url"] = repositorylicense.GetHTMLURL()
	repositorylicenseMap["git_url"] = repositorylicense.GetGitURL()
	repositorylicenseMap["download_url"] = repositorylicense.GetDownloadURL()
	repositorylicenseMap["type"] = repositorylicense.GetType()
	repositorylicenseMap["content"] = repositorylicense.GetContent()
	repositorylicenseMap["encoding"] = repositorylicense.GetEncoding()

	return []any{repositorylicenseMap}
}

func flattenSecurityAndAnalysis(securityAndAnalysis *github.SecurityAndAnalysis) []any {
	if securityAndAnalysis == nil {
		return []any{}
	}

	securityAndAnalysisMap := make(map[string]any)

	advancedSecurity := securityAndAnalysis.GetAdvancedSecurity()
	if advancedSecurity != nil {
		securityAndAnalysisMap["advanced_security"] = []any{map[string]any{
			"status": advancedSecurity.GetStatus(),
		}}
	}

	securityAndAnalysisMap["secret_scanning"] = []any{map[string]any{
		"status": securityAndAnalysis.GetSecretScanning().GetStatus(),
	}}

	securityAndAnalysisMap["secret_scanning_push_protection"] = []any{map[string]any{
		"status": securityAndAnalysis.GetSecretScanningPushProtection().GetStatus(),
	}}

	return []any{securityAndAnalysisMap}
}

// In case full_name can be determined from the data, parses it into an org and repo name proper. For example,
// resourceGithubParseFullName will return "myorg", "myrepo", true when full_name is "myorg/myrepo".
func resourceGithubParseFullName(resourceDataLike interface {
	GetOk(string) (any, bool)
},
) (string, string, bool) {
	x, ok := resourceDataLike.GetOk("full_name")
	if !ok {
		return "", "", false
	}
	s, ok := x.(string)
	if !ok || s == "" {
		return "", "", false
	}
	parts := strings.Split(s, "/")
	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
		return "", "", false
	}
	return parts[0], parts[1], true
}

func updateVulnerabilityAlerts(ctx context.Context, client *github.Client, owner, repoName string, state bool) error {
	var err error

	if state {
		_, err = client.Repositories.EnableVulnerabilityAlerts(ctx, owner, repoName)
	} else {
		_, err = client.Repositories.DisableVulnerabilityAlerts(ctx, owner, repoName)
	}
	if err != nil {
		return err
	}

	return nil
}