feat: add github_organization_private_registry resource and data source

docs/data-sources/organization_private_registry.md

@@ -0,0 +1,48 @@
+---
+page_title: "github_organization_private_registry (Data Source) - GitHub"
+subcategory: ""
+description: |-
+  Use this data source to retrieve information about a specific organization private registry.
+---
+
+# github_organization_private_registry (Data Source)
+
+Use this data source to retrieve information about a specific organization private registry.
+
+## Example Usage
+
+```terraform
+data "github_organization_private_registry" "my_registry" {
+  name = "NPM_REGISTRY_SECRET_1"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The auto-generated name of the private registry (computed by GitHub).
+
+### Read-Only
+
+- `auth_type` (String) The authentication type for the private registry.
+- `created_at` (String) The time the registry was created.
+- `id` (String) The ID of this resource.
+- `oidc_audience` (String) The JWT audience.
+- `oidc_aws_account_id` (String) The AWS account ID.
+- `oidc_aws_domain` (String) The AWS domain.
+- `oidc_aws_domain_owner` (String) The AWS domain owner.
+- `oidc_aws_region` (String) The AWS region.
+- `oidc_aws_role_name` (String) The AWS role name.
+- `oidc_azure_client_id` (String) The Azure client ID.
+- `oidc_azure_tenant_id` (String) The Azure tenant ID.
+- `oidc_jfrog_identity_mapping_name` (String) The JFrog identity mapping name.
+- `oidc_jfrog_provider_name` (String) The JFrog provider name.
+- `registry_type` (String) The registry type.
+- `replaces_base` (Boolean) Whether the private registry should replace the public base registry.
+- `selected_repository_ids` (Set of Number) An array of repository IDs that can access the organization private registry.
+- `updated_at` (String) The time the registry was updated.
+- `url` (String) The registry URL.
+- `username` (String) The registry username.
+- `visibility` (String) Configures the access that repositories have to the organization private registry.

docs/resources/organization_private_registry.md

@@ -0,0 +1,59 @@
+---
+page_title: "github_organization_private_registry (Resource) - GitHub"
+subcategory: ""
+description: |-
+  This resource allows you to create and manage an organization private registry.
+---
+
+# github_organization_private_registry (Resource)
+
+This resource allows you to create and manage an organization private registry.
+
+## Example Usage
+
+```terraform
+resource "github_organization_private_registry" "my_registry" {
+  registry_type = "npm_registry"
+  url           = "https://npm.pkg.github.com"
+  auth_type     = "username_password"
+  username      = "github-actions"
+  value         = "super_secret_token_123"
+  visibility    = "private"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `registry_type` (String) The registry type. Can be `maven_repository`, `nuget_feed`, `goproxy_server`, `npm_registry`, `rubygems_server`, `cargo_registry`, `composer_repository`, `docker_registry`, `git_source`, `helm_registry`, `pub_repository`, `python_index`, or `terraform_registry`.
+- `url` (String) The URL of the private registry.
+- `visibility` (String) Configures the access that repositories have to the organization private registry. Must be one of `all`, `private`, or `selected`.
+
+### Optional
+
+- `auth_type` (String) The authentication type for the private registry. Can be `token`, `username_password`, `oidc_azure`, `oidc_aws`, or `oidc_jfrog`. Defaults to `token`.
+- `key_id` (String) ID of the public key used to encrypt the secret. Required if encrypted_value is set.
+- `oidc_audience` (String) The OIDC audience.
+- `oidc_aws_account_id` (String) The AWS account ID. Required when auth_type is oidc_aws.
+- `oidc_aws_domain` (String) The CodeArtifact domain. Required when auth_type is oidc_aws.
+- `oidc_aws_domain_owner` (String) The CodeArtifact domain owner. Required when auth_type is oidc_aws.
+- `oidc_aws_region` (String) The AWS region. Required when auth_type is oidc_aws.
+- `oidc_aws_role_name` (String) The AWS IAM role name. Required when auth_type is oidc_aws.
+- `oidc_azure_client_id` (String) The client ID of the Azure AD application. Required when auth_type is oidc_azure.
+- `oidc_azure_tenant_id` (String) The tenant ID of the Azure AD application. Required when auth_type is oidc_azure.
+- `oidc_jfrog_identity_mapping_name` (String) The JFrog identity mapping name.
+- `oidc_jfrog_provider_name` (String) The JFrog OIDC provider name. Required when auth_type is oidc_jfrog.
+- `replaces_base` (Boolean) Indicates whether this private registry should replace the base registry.
+- `selected_repository_ids` (Set of Number) An array of repository IDs that can access the organization private registry.
+- `username` (String) The username to use when authenticating with the private registry.
+- `value` (String, Sensitive) The plaintext secret to be encrypted and sent to GitHub. This is used for a token when auth_type is token, and for a password when auth_type is username_password. Required when auth_type is token or username_password.
+- `value_encrypted` (String, Sensitive) The encrypted value of the secret using the GitHub public key in Base64 format.
+
+### Read-Only
+
+- `created_at` (String) The timestamp when the private registry was created.
+- `id` (String) The ID of this resource.
+- `name` (String) The auto-generated name of the private registry (computed by GitHub).
+- `updated_at` (String) The timestamp when the private registry was last updated.

examples/data-sources/github_organization_private_registry/data-source.tf

@@ -0,0 +1,3 @@
+data "github_organization_private_registry" "my_registry" {
+  name = "NPM_REGISTRY_SECRET_1"
+}

examples/resources/github_organization_private_registry/resource.tf

@@ -0,0 +1,8 @@
+resource "github_organization_private_registry" "my_registry" {
+  registry_type = "npm_registry"
+  url           = "https://npm.pkg.github.com"
+  auth_type     = "username_password"
+  username      = "github-actions"
+  value         = "super_secret_token_123"
+  visibility    = "private"
+}

github/data_source_github_organization_private_registry.go

@@ -0,0 +1,205 @@
+package github
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func dataSourceGithubOrganizationPrivateRegistry() *schema.Resource {
+	return &schema.Resource{
+		ReadContext: dataSourceGithubOrganizationPrivateRegistryRead,
+		Description: "Use this data source to retrieve information about a specific organization private registry.",
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Description: "The auto-generated name of the private registry (computed by GitHub).",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			"registry_type": {
+				Description: "The registry type.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"url": {
+				Description: "The registry URL.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"username": {
+				Description: "The registry username.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"replaces_base": {
+				Description: "Whether the private registry should replace the public base registry.",
+				Type:        schema.TypeBool,
+				Computed:    true,
+			},
+			"visibility": {
+				Description: "Configures the access that repositories have to the organization private registry.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"auth_type": {
+				Description: "The authentication type for the private registry.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_azure_tenant_id": {
+				Description: "The Azure tenant ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_azure_client_id": {
+				Description: "The Azure client ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_region": {
+				Description: "The AWS region.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_account_id": {
+				Description: "The AWS account ID.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_role_name": {
+				Description: "The AWS role name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_domain": {
+				Description: "The AWS domain.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_aws_domain_owner": {
+				Description: "The AWS domain owner.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_jfrog_provider_name": {
+				Description: "The JFrog provider name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_audience": {
+				Description: "The JWT audience.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"oidc_jfrog_identity_mapping_name": {
+				Description: "The JFrog identity mapping name.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"selected_repository_ids": {
+				Description: "An array of repository IDs that can access the organization private registry.",
+				Type:        schema.TypeSet,
+				Computed:    true,
+				Elem: &schema.Schema{
+					Type: schema.TypeInt,
+				},
+			},
+			"created_at": {
+				Description: "The time the registry was created.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			"updated_at": {
+				Description: "The time the registry was updated.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func dataSourceGithubOrganizationPrivateRegistryRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
+	client := meta.(*Owner).v3client
+	org := meta.(*Owner).name
+	registryName := d.Get("name").(string)
+
+	registry, _, err := client.PrivateRegistries.GetOrganizationPrivateRegistry(ctx, org, registryName)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	d.SetId(registry.GetName())
+
+	if registry.RegistryType != nil {
+		if err := d.Set("registry_type", string(*registry.RegistryType)); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	if err := d.Set("url", registry.GetURL()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("username", registry.GetUsername()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("replaces_base", registry.GetReplacesBase()); err != nil {
+		return diag.FromErr(err)
+	}
+	if registry.Visibility != nil {
+		if err := d.Set("visibility", string(*registry.Visibility)); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	if registry.AuthType != nil {
+		if err := d.Set("auth_type", string(*registry.AuthType)); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	if err := d.Set("oidc_azure_tenant_id", registry.GetTenantID()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_azure_client_id", registry.GetClientID()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_aws_region", registry.GetAWSRegion()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_aws_account_id", registry.GetAccountID()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_aws_role_name", registry.GetRoleName()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_aws_domain", registry.GetDomain()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_aws_domain_owner", registry.GetDomainOwner()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_jfrog_provider_name", registry.GetJFrogOIDCProviderName()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_audience", registry.GetAudience()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("oidc_jfrog_identity_mapping_name", registry.GetIdentityMappingName()); err != nil {
+		return diag.FromErr(err)
+	}
+
+	var repoIDs []any
+	for _, id := range registry.SelectedRepositoryIDs {
+		repoIDs = append(repoIDs, int(id))
+	}
+	if err := d.Set("selected_repository_ids", schema.NewSet(schema.HashInt, repoIDs)); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("created_at", registry.GetCreatedAt().String()); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("updated_at", registry.GetUpdatedAt().String()); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}

github/data_source_github_organization_private_registry_test.go

@@ -0,0 +1,46 @@
+package github
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+)
+
+func TestAccGithubDataSourceOrganizationPrivateRegistry(t *testing.T) {
+	config := `
+		resource "github_organization_private_registry" "test" {
+			registry_type  = "npm_registry"
+			url            = "https://npm.pkg.github.com"
+			username       = "github-actions"
+			value          = "super_secret_token_123"
+			visibility     = "private"
+		}
+
+		data "github_organization_private_registry" "test" {
+			name = github_organization_private_registry.test.name
+		}
+	`
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			skipUnlessMode(t, organization)
+			skipUnlessHasOrgs(t)
+		},
+		ProviderFactories: providerFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue("data.github_organization_private_registry.test", tfjsonpath.New("id"), knownvalue.NotNull()),
+					statecheck.ExpectKnownValue("data.github_organization_private_registry.test", tfjsonpath.New("registry_type"), knownvalue.StringExact("npm_registry")),
+					statecheck.ExpectKnownValue("data.github_organization_private_registry.test", tfjsonpath.New("url"), knownvalue.StringExact("https://npm.pkg.github.com")),
+					statecheck.ExpectKnownValue("data.github_organization_private_registry.test", tfjsonpath.New("username"), knownvalue.StringExact("github-actions")),
+					statecheck.ExpectKnownValue("data.github_organization_private_registry.test", tfjsonpath.New("visibility"), knownvalue.StringExact("private")),
+				},
+			},
+		},
+	})
+}

github/provider.go

@@ -212,6 +212,7 @@ func NewProvider(version, commit string) func() *schema.Provider {
 				"github_organization_block":                                             resourceOrganizationBlock(),
 				"github_organization_custom_role":                                       resourceGithubOrganizationCustomRole(),
 				"github_organization_custom_properties":                                 resourceGithubOrganizationCustomProperties(),
+				"github_organization_private_registry":                                  resourceGithubOrganizationPrivateRegistry(),
 				"github_organization_project":                                           resourceGithubOrganizationProject(),
 				"github_organization_repository_role":                                   resourceGithubOrganizationRepositoryRole(),
 				"github_organization_role":                                              resourceGithubOrganizationRole(),
@@ -300,6 +301,7 @@ func NewProvider(version, commit string) func() *schema.Provider {
 				"github_organization_custom_properties":                                 dataSourceGithubOrganizationCustomProperties(),
 				"github_organization_external_identities":                               dataSourceGithubOrganizationExternalIdentities(),
 				"github_organization_ip_allow_list":                                     dataSourceGithubOrganizationIpAllowList(),
+				"github_organization_private_registry":                                  dataSourceGithubOrganizationPrivateRegistry(),
 				"github_organization_members":                                           dataSourceGithubOrganizationMembers(),
 				"github_organization_repositories":                                      dataSourceGithubOrganizationRepositories(),
 				"github_organization_repository_role":                                   dataSourceGithubOrganizationRepositoryRole(),