feat: Add resources and data sources for enterprise-owned organization app installations

docs/data-sources/enterprise_app_accessible_organization_repositories.md

@@ -0,0 +1,36 @@
+---
+page_title: "github_enterprise_app_accessible_organization_repositories (Data Source) - GitHub"
+description: |-
+  Get the repositories of an enterprise-owned organization that a GitHub App can be granted access to.
+---
+
+# github_enterprise_app_accessible_organization_repositories (Data Source)
+
+Use this data source to retrieve the repositories of an enterprise-owned organization
+that a GitHub App can be granted access to.
+
+## Example Usage
+
+```terraform
+data "github_enterprise_app_accessible_organization_repositories" "example" {
+  enterprise_slug = "my-enterprise"
+  organization    = "my-org"
+}
+```
+
+## Argument Reference
+
+- `enterprise_slug` - (Required) The slug of the enterprise.
+- `organization` - (Required) The login of the enterprise-owned organization.
+
+## Attributes Reference
+
+- `repositories` - List of repositories. Each `repository` block consists of the fields documented below.
+
+---
+
+The `repository` block consists of:
+
+- `id` - The ID of the repository.
+- `name` - The name of the repository.
+- `full_name` - The full name of the repository (`org/repo`).

docs/data-sources/enterprise_app_installable_organizations.md

@@ -0,0 +1,34 @@
+---
+page_title: "github_enterprise_app_installable_organizations (Data Source) - GitHub"
+description: |-
+  Get the organizations in an enterprise that a GitHub App can be installed on.
+---
+
+# github_enterprise_app_installable_organizations (Data Source)
+
+Use this data source to retrieve the enterprise-owned organizations that a GitHub
+App can be installed on.
+
+## Example Usage
+
+```terraform
+data "github_enterprise_app_installable_organizations" "example" {
+  enterprise_slug = "my-enterprise"
+}
+```
+
+## Argument Reference
+
+- `enterprise_slug` - (Required) The slug of the enterprise.
+
+## Attributes Reference
+
+- `organizations` - List of organizations. Each `organization` block consists of the fields documented below.
+
+---
+
+The `organization` block consists of:
+
+- `id` - The ID of the organization.
+- `login` - The login (slug) of the organization.
+- `accessible_repositories_url` - The URL for the repositories the app can access on the organization.

docs/data-sources/enterprise_app_installations.md

@@ -0,0 +1,46 @@
+---
+page_title: "github_enterprise_app_installations (Data Source) - GitHub"
+description: |-
+  Get the GitHub App installations of an enterprise-owned organization.
+---
+
+# github_enterprise_app_installations (Data Source)
+
+Use this data source to retrieve the GitHub App installations on an enterprise-owned
+organization.
+
+## Example Usage
+
+```terraform
+data "github_enterprise_app_installations" "example" {
+  enterprise_slug = "my-enterprise"
+  organization    = "my-org"
+}
+```
+
+## Argument Reference
+
+- `enterprise_slug` - (Required) The slug of the enterprise that owns the organization.
+- `organization` - (Required) The login of the enterprise-owned organization.
+
+## Attributes Reference
+
+- `installations` - List of GitHub App installations on the organization. Each `installation` block consists of the fields documented below.
+
+---
+
+The `installation` block consists of:
+
+- `id` - The ID of the GitHub App installation.
+- `app_id` - The ID of the GitHub App.
+- `app_slug` - The URL-friendly name of the GitHub App.
+- `client_id` - The OAuth client ID of the GitHub App.
+- `target_id` - The ID of the account the GitHub App is installed on.
+- `target_type` - The type of account the GitHub App is installed on.
+- `repository_selection` - Whether the installation has access to `all` repositories or only `selected` ones.
+- `permissions` - A map of the permissions granted to the GitHub App installation.
+- `events` - The list of events the GitHub App installation subscribes to.
+- `suspended` - Whether the GitHub App installation is currently suspended.
+- `single_file_paths` - The list of single file paths the GitHub App installation has access to.
+- `created_at` - The date the GitHub App installation was created.
+- `updated_at` - The date the GitHub App installation was last updated.

docs/resources/enterprise_app_installation.md

@@ -0,0 +1,51 @@
+---
+page_title: "github_enterprise_app_installation (Resource) - GitHub"
+description: |-
+  Install and manage a GitHub App on an enterprise-owned organization.
+---
+
+# github_enterprise_app_installation (Resource)
+
+This resource installs a GitHub App on an enterprise-owned organization and manages
+the installation's repository access. Deleting the resource uninstalls the app from
+the organization.
+
+The token used by the provider must have permission to administer the enterprise,
+and the organization must be owned by the enterprise.
+
+## Example Usage
+
+```terraform
+resource "github_enterprise_app_installation" "example" {
+  enterprise_slug      = "my-enterprise"
+  organization         = "my-org"
+  client_id            = "Iv23liABCDEFGH012345"
+  repository_selection = "selected"
+  repositories         = ["repo-a", "repo-b"]
+}
+```
+
+## Argument Reference
+
+- `enterprise_slug` - (Required, ForceNew) The slug of the enterprise that owns the organization.
+- `organization` - (Required, ForceNew) The login of the enterprise-owned organization to install the app on.
+- `client_id` - (Required, ForceNew) The Client ID of the GitHub App to install.
+- `repository_selection` - (Required) Which repositories the app can access. One of `all`, `selected`, or `none`.
+- `repositories` - (Optional) Repository names the installation should have access to. Only used when `repository_selection` is `selected`.
+
+## Attributes Reference
+
+The following additional attributes are exported:
+
+- `installation_id` - The ID of the GitHub App installation.
+- `app_id` - The ID of the installed GitHub App.
+- `app_slug` - The URL-friendly name of the GitHub App.
+
+## Import
+
+Enterprise App Installations can be imported using a composite ID of
+`<enterprise_slug>:<organization>:<installation_id>`:
+
+```shell
+terraform import github_enterprise_app_installation.example my-enterprise:my-org:12345678
+```

docs/resources/enterprise_app_installation_repositories.md

@@ -0,0 +1,47 @@
+---
+page_title: "github_enterprise_app_installation_repositories (Resource) - GitHub"
+description: |-
+  Manage the repositories an enterprise-owned organization's GitHub App installation can access.
+---
+
+# github_enterprise_app_installation_repositories (Resource)
+
+This resource manages the set of repositories accessible to a GitHub App installation
+on an enterprise-owned organization. It only applies when the installation's
+`repository_selection` is `selected`.
+
+Use [`github_enterprise_app_installation`](enterprise_app_installation.md) to control
+installation lifecycle and `repository_selection`; use this resource to drift-detect
+and reconcile the repository list.
+
+## Example Usage
+
+```terraform
+resource "github_enterprise_app_installation_repositories" "example" {
+  enterprise_slug       = "my-enterprise"
+  organization          = "my-org"
+  installation_id       = "12345678"
+  selected_repositories = ["repo-a", "repo-b"]
+}
+```
+
+## Argument Reference
+
+- `enterprise_slug` - (Required, ForceNew) The slug of the enterprise that owns the organization.
+- `organization` - (Required, ForceNew) The login of the enterprise-owned organization the app is installed on.
+- `installation_id` - (Required, ForceNew) The ID of the GitHub App installation.
+- `selected_repositories` - (Required) The set of repository names the installation should have access to.
+
+~> **Note**: Deleting this resource removes every repository currently selected for
+the installation, which leaves the installation with no accessible repositories.
+Either uninstall the app via the parent `github_enterprise_app_installation` resource
+or switch the installation's `repository_selection` to `all` instead.
+
+## Import
+
+Enterprise App Installation Repositories can be imported using a composite ID of
+`<enterprise_slug>:<organization>:<installation_id>`:
+
+```shell
+terraform import github_enterprise_app_installation_repositories.example my-enterprise:my-org:12345678
+```

examples/data-sources/enterprise_app_accessible_organization_repositories/example_1.tf

@@ -0,0 +1,4 @@
+data "github_enterprise_app_accessible_organization_repositories" "example" {
+  enterprise_slug = "my-enterprise"
+  organization    = "my-org"
+}

examples/data-sources/enterprise_app_installable_organizations/example_1.tf

@@ -0,0 +1,3 @@
+data "github_enterprise_app_installable_organizations" "example" {
+  enterprise_slug = "my-enterprise"
+}

examples/data-sources/enterprise_app_installations/example_1.tf

@@ -0,0 +1,4 @@
+data "github_enterprise_app_installations" "example" {
+  enterprise_slug = "my-enterprise"
+  organization    = "my-org"
+}

examples/resources/enterprise_app_installation/example_1.tf

@@ -0,0 +1,7 @@
+resource "github_enterprise_app_installation" "example" {
+  enterprise_slug      = "my-enterprise"
+  organization         = "my-org"
+  client_id            = "Iv23liABCDEFGH012345"
+  repository_selection = "selected"
+  repositories         = ["repo-a", "repo-b"]
+}

examples/resources/enterprise_app_installation_repositories/example_1.tf

@@ -0,0 +1,6 @@
+resource "github_enterprise_app_installation_repositories" "example" {
+  enterprise_slug       = "my-enterprise"
+  organization          = "my-org"
+  installation_id       = "12345678"
+  selected_repositories = ["repo-a", "repo-b"]
+}

github/data_source_github_enterprise_app_accessible_organization_repositories.go

@@ -0,0 +1,83 @@
+package github
+
+import (
+	"context"
+
+	"github.com/google/go-github/v89/github"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func dataSourceGithubEnterpriseAppAccessibleOrganizationRepositories() *schema.Resource {
+	return &schema.Resource{
+		ReadContext: dataSourceGithubEnterpriseAppAccessibleOrganizationRepositoriesRead,
+		Description: "Use this data source to retrieve repositories of an enterprise-owned organization that a GitHub App can be granted access to.",
+
+		Schema: map[string]*schema.Schema{
+			"enterprise_slug": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "The slug of the enterprise.",
+			},
+			"organization": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "The login of the enterprise-owned organization.",
+			},
+			"repositories": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: "Repositories of the organization a GitHub App can access.",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"id": {
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+						"name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"full_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func dataSourceGithubEnterpriseAppAccessibleOrganizationRepositoriesRead(ctx context.Context, d *schema.ResourceData, m any) diag.Diagnostics {
+	meta, _ := m.(*Owner)
+	client := meta.v3client
+	enterprise, _ := d.Get("enterprise_slug").(string)
+	org, _ := d.Get("organization").(string)
+
+	opts := &github.ListOptions{PerPage: meta.maxPerPage}
+	results := make([]map[string]any, 0)
+	for {
+		repos, resp, err := client.Enterprise.ListAppAccessibleOrganizationRepositories(ctx, enterprise, org, opts)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		for _, r := range repos {
+			results = append(results, map[string]any{
+				"id":        r.ID,
+				"name":      r.Name,
+				"full_name": r.FullName,
+			})
+		}
+		if resp.NextPage == 0 {
+			break
+		}
+		opts.Page = resp.NextPage
+	}
+
+	d.SetId(buildTwoPartID(enterprise, org))
+	if err := d.Set("repositories", results); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}