feat: add github_organization_private_registry resource and data source

docs/data-sources/organization_private_registry.md

@@ -0,0 +1,48 @@
+---
+page_title: "github_organization_private_registry (Data Source) - GitHub"
+subcategory: ""
+description: |-
+  Use this data source to retrieve information about a specific organization private registry.
+---
+
+# github_organization_private_registry (Data Source)
+
+Use this data source to retrieve information about a specific organization private registry.
+
+## Example Usage
+
+```terraform
+data "github_organization_private_registry" "example" {
+  name = "NPM_REGISTRY_1"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The auto-generated name of the private registry (computed by GitHub).
+
+### Read-Only
+
+- `auth_type` (String) The authentication type for the private registry.
+- `created_at` (String) The time the registry was created.
+- `id` (String) The ID of this resource.
+- `oidc_audience` (String) The JWT audience.
+- `oidc_aws_account_id` (String) The AWS account ID.
+- `oidc_aws_domain` (String) The AWS domain.
+- `oidc_aws_domain_owner` (String) The AWS domain owner.
+- `oidc_aws_region` (String) The AWS region.
+- `oidc_aws_role_name` (String) The AWS role name.
+- `oidc_azure_client_id` (String) The Azure client ID.
+- `oidc_azure_tenant_id` (String) The Azure tenant ID.
+- `oidc_jfrog_identity_mapping_name` (String) The JFrog identity mapping name.
+- `oidc_jfrog_provider_name` (String) The JFrog provider name.
+- `registry_type` (String) The registry type.
+- `replaces_base` (Boolean) Whether the private registry should replace the public base registry.
+- `selected_repository_ids` (Set of Number) An array of repository IDs that can access the organization private registry.
+- `updated_at` (String) The time the registry was updated.
+- `url` (String) The registry URL.
+- `username` (String) The registry username.
+- `visibility` (String) Configures the access that repositories have to the organization private registry.

docs/resources/organization_private_registry.md

@@ -0,0 +1,111 @@
+---
+page_title: "github_organization_private_registry (Resource) - GitHub"
+subcategory: ""
+description: |-
+  This resource allows you to create and manage an organization private registry for Dependabot.
+---
+
+# github_organization_private_registry (Resource)
+
+This resource allows you to create and manage an organization private registry for Dependabot.
+
+## Example Usage
+
+```terraform
+# Token-authenticated npm registry, available to every repository of the organization.
+resource "github_organization_private_registry" "example" {
+  registry_type = "npm_registry"
+  url           = "https://npm.pkg.github.com"
+  auth_type     = "token"
+  value         = var.npm_token
+  visibility    = "all"
+}
+```
+
+```terraform
+# Username and password registry, restricted to selected repositories.
+resource "github_repository" "example" {
+  name = "example"
+}
+
+resource "github_organization_private_registry" "example" {
+  registry_type           = "maven_repository"
+  url                     = "https://maven.example.com/releases"
+  auth_type               = "username_password"
+  username                = "deploy"
+  value                   = var.maven_password
+  visibility              = "selected"
+  selected_repository_ids = [github_repository.example.repo_id]
+}
+```
+
+```terraform
+# AWS CodeArtifact registry authenticated through OIDC, no stored secret.
+resource "github_organization_private_registry" "example" {
+  registry_type         = "maven_repository"
+  url                   = "https://example-111122223333.d.codeartifact.eu-west-3.amazonaws.com/maven/releases/"
+  auth_type             = "oidc_aws"
+  oidc_aws_region       = "eu-west-3"
+  oidc_aws_account_id   = "111122223333"
+  oidc_aws_role_name    = "dependabot-codeartifact"
+  oidc_aws_domain       = "example"
+  oidc_aws_domain_owner = "111122223333"
+  visibility            = "private"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `registry_type` (String) The registry type. Must be one of `maven_repository`, `nuget_feed`, `goproxy_server`, `npm_registry`, `rubygems_server`, `cargo_registry`, `composer_repository`, `docker_registry`, `git_source`, `helm_registry`, `hex_organization`, `hex_repository`, `pub_repository`, `python_index`, or `terraform_registry`.
+- `url` (String) The URL of the private registry.
+- `visibility` (String) Configures the access that repositories have to the organization private registry. Must be one of `all`, `private`, or `selected`.
+
+### Optional
+
+- `auth_type` (String) The authentication type for the private registry. Can be `token`, `username_password`, `oidc_azure`, `oidc_aws`, or `oidc_jfrog`. Defaults to `token`. Cannot be changed after creation.
+- `key_id` (String) ID of the public key used to encrypt the secret. Required if `value_encrypted` is set.
+- `oidc_audience` (String) The OIDC audience.
+- `oidc_aws_account_id` (String) The AWS account ID. Required when `auth_type` is `oidc_aws`.
+- `oidc_aws_domain` (String) The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
+- `oidc_aws_domain_owner` (String) The CodeArtifact domain owner. Required when `auth_type` is `oidc_aws`.
+- `oidc_aws_region` (String) The AWS region. Required when `auth_type` is `oidc_aws`.
+- `oidc_aws_role_name` (String) The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
+- `oidc_azure_client_id` (String) The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
+- `oidc_azure_tenant_id` (String) The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
+- `oidc_jfrog_identity_mapping_name` (String) The JFrog identity mapping name.
+- `oidc_jfrog_provider_name` (String) The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
+- `replaces_base` (Boolean) Indicates whether this private registry should replace the base registry.
+- `selected_repository_ids` (Set of Number) An array of repository IDs that can access the organization private registry. Only valid when `visibility` is `selected`. GitHub does not return this list when reading a registry, so it is kept from the configuration and cannot be recovered by `terraform import`.
+- `username` (String) The username to use when authenticating with the private registry.
+- `value` (String, Sensitive) The plaintext secret to be encrypted and sent to GitHub. This is used for a token when `auth_type` is `token`, and for a password when `auth_type` is `username_password`. One of `value` or `value_encrypted` is required for those auth types.
+- `value_encrypted` (String, Sensitive) The secret encrypted with the organization private registries public key, in Base64 format. One of `value` or `value_encrypted` is required when `auth_type` is `token` or `username_password`.
+
+### Read-Only
+
+- `created_at` (String) The timestamp when the private registry was created.
+- `id` (String) The ID of this resource.
+- `name` (String) The auto-generated name of the private registry (computed by GitHub).
+- `remote_updated_at` (String) The timestamp when the private registry was last updated in GitHub. A difference with `updated_at` means the secret was changed outside of Terraform.
+- `updated_at` (String) The timestamp when the private registry was last updated by this resource.
+
+## Import
+
+Import is supported using the following syntax:
+
+In Terraform v1.5.0 and later, the [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used with the `id` attribute, for example:
+
+```terraform
+import {
+  to = github_organization_private_registry.example
+  id = "registry-name"
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import github_organization_private_registry.example registry-name
+```

examples/data-sources/github_organization_private_registry/data-source.tf

@@ -0,0 +1,3 @@
+data "github_organization_private_registry" "example" {
+  name = "NPM_REGISTRY_1"
+}

examples/resources/github_organization_private_registry/import-by-string-id.tf

@@ -0,0 +1,4 @@
+import {
+  to = github_organization_private_registry.example
+  id = "registry-name"
+}

examples/resources/github_organization_private_registry/import.sh

@@ -0,0 +1 @@
+terraform import github_organization_private_registry.example registry-name

examples/resources/github_organization_private_registry/resource_1.tf

@@ -0,0 +1,8 @@
+# Token-authenticated npm registry, available to every repository of the organization.
+resource "github_organization_private_registry" "example" {
+  registry_type = "npm_registry"
+  url           = "https://npm.pkg.github.com"
+  auth_type     = "token"
+  value         = var.npm_token
+  visibility    = "all"
+}

examples/resources/github_organization_private_registry/resource_2.tf

@@ -0,0 +1,14 @@
+# Username and password registry, restricted to selected repositories.
+resource "github_repository" "example" {
+  name = "example"
+}
+
+resource "github_organization_private_registry" "example" {
+  registry_type           = "maven_repository"
+  url                     = "https://maven.example.com/releases"
+  auth_type               = "username_password"
+  username                = "deploy"
+  value                   = var.maven_password
+  visibility              = "selected"
+  selected_repository_ids = [github_repository.example.repo_id]
+}

examples/resources/github_organization_private_registry/resource_3.tf

@@ -0,0 +1,12 @@
+# AWS CodeArtifact registry authenticated through OIDC, no stored secret.
+resource "github_organization_private_registry" "example" {
+  registry_type         = "maven_repository"
+  url                   = "https://example-111122223333.d.codeartifact.eu-west-3.amazonaws.com/maven/releases/"
+  auth_type             = "oidc_aws"
+  oidc_aws_region       = "eu-west-3"
+  oidc_aws_account_id   = "111122223333"
+  oidc_aws_role_name    = "dependabot-codeartifact"
+  oidc_aws_domain       = "example"
+  oidc_aws_domain_owner = "111122223333"
+  visibility            = "private"
+}

github/data_source_github_organization_private_registry.go

@@ -0,0 +1,145 @@
+package github
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
+	"github.com/integrations/terraform-provider-github/v6/internal/tfpluginv2util"
+)
+
+func dataSourceGithubOrganizationPrivateRegistry() *schema.Resource {
+	return &schema.Resource{
+		ReadContext: dataSourceGithubOrganizationPrivateRegistryRead,
+		Description: "Use this data source to retrieve information about a specific organization private registry.",
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Description: "The auto-generated name of the private registry (computed by GitHub).",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			"registry_type": {
+				Description: "The registry type.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"url": {
+				Description: "The registry URL.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"username": {
+				Description: "The registry username.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"replaces_base": {
+				Description: "Whether the private registry should replace the public base registry.",
+				Type:        schema.TypeBool,
+				Computed:    true,
+			},
+			"visibility": {
+				Description: "Configures the access that repositories have to the organization private registry.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"auth_type": {
+				Description: "The authentication type for the private registry.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_azure_tenant_id": {
+				Description: "The Azure tenant ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_azure_client_id": {
+				Description: "The Azure client ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_region": {
+				Description: "The AWS region.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_account_id": {
+				Description: "The AWS account ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_role_name": {
+				Description: "The AWS role name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_domain": {
+				Description: "The AWS domain.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_domain_owner": {
+				Description: "The AWS domain owner.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_jfrog_provider_name": {
+				Description: "The JFrog provider name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_audience": {
+				Description: "The JWT audience.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_jfrog_identity_mapping_name": {
+				Description: "The JFrog identity mapping name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"selected_repository_ids": {
+				Description: "An array of repository IDs that can access the organization private registry.",
+				Type:        schema.TypeSet,
+				Computed:    true,
+				Elem: &schema.Schema{
+					Type: schema.TypeInt,
+				},
+			},
+			"created_at": {
+				Description: "The time the registry was created.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"updated_at": {
+				Description: "The time the registry was updated.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func dataSourceGithubOrganizationPrivateRegistryRead(ctx context.Context, d *schema.ResourceData, m any) diag.Diagnostics {
+	meta, _ := m.(*Owner)
+	client := meta.v3client
+	owner := meta.name
+	registryName := tfpluginv2util.Get[string](d, "name")
+
+	registry, _, err := client.PrivateRegistries.GetOrganizationPrivateRegistry(ctx, owner, registryName)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	d.SetId(registry.GetName())
+
+	if err := setPrivateRegistryAttributes(d, registry); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("updated_at", registry.GetUpdatedAt().String()); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}