[3rwww1]

Continuation of #3424 by @Gaardsholt, who handed it over in that thread. The PR is a single commit on current main: the original work, with @Gaardsholt credited as co-author, plus the changes that address the review and align the resource with ARCHITECTURE.md.

Resolves #2720
Resolves #3339

---

Before the change?

• No way to manage Dependabot organization private registries with Terraform.

After the change?

• New github_organization_private_registry resource and data source.

  resource "github_organization_private_registry" "npm" {
    registry_type = "npm_registry"
    url           = "https://npm.pkg.github.com"
    auth_type     = "token"
    value         = var.npm_token
    visibility    = "all"
  }

• Changes on top of feat: add github_organization_private_registry resource and data source #3424, from the review threads and the contribution guides:

  • Create and Update no longer call Read. Create takes computed fields from the POST body; Update does one GET for the timestamp because PATCH returns no body.
  • 404 handling uses errors.AsType, http.StatusNotFound and tflog.
  • auth_type is ForceNew: the API rejects changing it after creation.
  • registry_type is no longer sent on update.
  • selected_repository_ids declares Set: schema.HashInt. The GET endpoint never returns this list (only the POST 201 body does), so Read keeps the configured value and the description says import cannot recover it.
  • remote_updated_at lets the shared diffSecret detect an out-of-band secret change and re-send the secret on the next apply. It runs only for token and username_password.
  • The custom diff rejects value/value_encrypted on OIDC registries, treats an unknown-at-plan value as present, and checks selected_repository_ids against visibility at create time.
  • key_id is written to state only after the API call succeeds. value_encrypted requires key_id.
  • Removing username sends an empty string so the PATCH clears it instead of being dropped by omitempty.
  • hex_organization and hex_repository added to the registry type list, per the current REST schema.
  • Examples: token registry, username/password with selected repositories, OIDC AWS with no secret, import.
  • Tests use t.Run subtests with ConfigStateChecks, an import step, a plan check on update, a ForceNew plan check, a username clearing step, and randomized URLs so parallel runs do not collide.
  • Read writes optional fields only when the API returns them, so an imported registry matches a created one.

• Not covered, out of scope for go-github v92: the newer oidc_cloudsmith and oidc_gcp auth types and their fields.

Pull request checklist

• Schema migrations have been created if needed - not needed, new resource
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

• Yes
• No

---

Acceptance tests ran green against a throwaway organization (GH_TEST_AUTH_MODE=organization): TestAccGithubOrganizationPrivateRegistry with its four subtests (create then import then update, selected repositories, ForceNew on registry_type, clearing username) and TestAccGithubDataSourceOrganizationPrivateRegistry. The organization was left with no registries and no repositories afterwards.

[github-actions]

👋 Hi, and thank you for this contribution!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions.

---

_{🤖 This is an automated message.}

[3rwww1]

Hello @deiga, could you please have a look? As stated in the desc, this is the continuation of a work you have already reviewed

[3rwww1]

Hi @stevehipwell, acceptance tests pass against a throwaway org on my side. CI is waiting on workflow approval, would you mind approving the runs? Happy to adjust anything once you have a moment to look. Thanks!

[3rwww1]

Hello @deiga, @stevehipwell, could a maintainer have a look at this PR? Thank you!

[3rwww1]

@deiga @stevehipwell I rebased this PR on current main and squashed it into a single commit, a2b8ebf. The code is unchanged from the previous head: only the history moved.

The CI and CodeQL runs on this PR are waiting on workflow approval, so they have not run yet. Could one of you approve them and review when you have a moment? Thanks!

[3rwww1]

@deiga @stevehipwell I ran the CI checks locally on the current head, a2b8ebf, in a clean container (golangci-lint v2.15.0, Go 1.27.2). Everything passes:

• go build ./...: OK
• make test: 144 tests pass, 0 fail
• golangci-lint run ./...: 0 issues
• strict lint on new code (.golangci.new.yml, new from the merge base with main): 0 issues

The CI and CodeQL runs on this head are still waiting for workflow approval. Could a maintainer approve them? Thank you!