fix: handle sha_pinning_required=false

[sheeeng]

Split CreateOrUpdate into separate Create and Update functions for both github_actions_organization_permissions and github_actions_repository_permissions resources.

In Create, replace d.GetOk() with d.GetOkExists() for sha_pinning_required. The field is Optional and Computed, so GetOk returns (false, false) when a user explicitly writes sha_pinning_required = false, which is indistinguishable from omitting the field. GetOkExists returns (false, true), correctly detecting the explicit value.

In Update, use d.HasChange() + d.Get(), which avoids the zero-value problem entirely by checking the state diff.

Add two-step acceptance tests (true → false) to verify the fix.

Fix #3223.

---

Before the change?

• Setting sha_pinning_required = false applied successfully in Terraform, but not actually changed in GitHub resources itself.

After the change?

• Setting sha_pinning_required = false applied successfully in Terraform, and actually changed in GitHub resources itself.

Pull request checklist

• Schema migrations have been created if needed (example)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[deiga]

LGTM! @stevehipwell WDYT?

[stevehipwell]

@sheeeng I thought the whole point here was that SHA pinning was dependent on organization configuration? This change would not fix the issue, but would break this resource.

I'm not sure how I missed this in review, but I'll repeat my suggestion to look at how allow_forking works in the repository resource. To fix this you should split the create and update functions in the resource to simplify the logic. Then in create you can use d.GetOkExists() to see if it should be sent. In update you need to check d.Changed() and if it has changed you need to use d.Get() and then send that value.

[deiga]

Partial review. Apply comments suggestions to all applicable sections

[deiga]

The code looks like you're using an AI to generate it and it's lost all notion of what is supposed to happen.

Please go through the code yourself and understand for yourself what it should be doing.

If the next time I come to review this and you're still showing disregard for the comments that have been left earlier, then I'll close the PR.

It's not worth anybody's time for us to play Broken Telephone from us to your AI.

[sheeeng]

I did a rebase from default branch. The pull request is updated with a force-push.