fix: bump github provider floor to 6.8.0 for fork support (STS-1942)

[whyvez]

Summary

PR #4 wired fork/source_owner/source_repo into github_repository.repository, but versions.tf still capped the integrations/github provider at < 6.0. Those arguments only exist in the provider from 6.8.0 onward, so no version could satisfy both constraints — downstream applies fail with An argument named "fork" is not expected here.

• Bump versions.tf provider floor to >= 6.8.0, < 7.0.
• Bump the same floor in test/unit-complete/provider.tf and examples/public-repository/provider.tf, which each had their own separate (stricter) constraints capping below 6.0.
• Drop the now-stale branch_protections_v3 broken in >= 5.3 comments/version exclusions — that provider bug predates and is unrelated to this floor. Verified against the provider source at tag v6.13.0 that github_branch_protection_v3's schema is unchanged for every field this module sets, so no changes were needed there.
• Fix a real, separate schema break found by running terraform validate locally: github_branch_protection's (branch_protections_v4) top-level blocks_creations/push_restrictions arguments were replaced by a nested restrict_pushes { blocks_creations, push_allowances } block in provider 6.x. var.branch_protections_v4's public input shape is unchanged.
• Add a validate CI job (root module + test/unit-complete, no credentials required) so provider-schema mismatches like this get caught automatically going forward — worth noting this repo's unit-tests CI job has never actually executed (0 Actions runs in its history, no TEST_GITHUB_TOKEN/TEST_GITHUB_ORGANIZATION secrets configured), so this is currently the only automated signal this repo has. examples/public-repository is excluded from the new job's matrix since it pulls the published mineiros-io/repository/github registry module (not this local module) with its own old, unrelated provider pin — pre-existing and out of scope here.
• Update README's provider-compatibility badge/prose.
• Add CHANGELOG entries under [Unreleased].

Verification

Ran terraform init/validate locally via Docker (hashicorp/terraform:1.9, --platform linux/amd64 to match CI runners) against the root module and test/unit-complete with the bumped >= 6.8.0, < 7.0 constraint — both pass cleanly (aside from a pre-existing, unrelated deprecation warning on github_repository_project, since GitHub removed the classic Projects API). This is the same check the new validate CI job runs.

Ticket

STS-1942

---

Paired with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: f885c80a-a862-4b3e-ad24-b4d19f2273e9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}