From ecb506d771d51235b4599ca46731664e2d9ae7f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9o=20=28LeC-D=29?= Date: Sun, 15 Mar 2026 14:44:04 -0400 Subject: [PATCH 1/3] fix: add validation to key_prefix in autolink reference resource (#3176) GitHub's API enforces that key_prefix: - must only contain letters, numbers, or .-_+=:/# - must not end with a number Without client-side validation, terraform plan succeeds with an invalid key_prefix (e.g. 'PTFY25') but terraform apply fails with a 422 from the GitHub API, giving a confusing plan/apply inconsistency. Added ValidateDiagFunc using a regexp that mirrors the API constraints, so invalid key_prefix values are caught at plan time. --- github/resource_github_repository_autolink_reference.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/github/resource_github_repository_autolink_reference.go b/github/resource_github_repository_autolink_reference.go index c7e5817ffe..cec451e5b8 100644 --- a/github/resource_github_repository_autolink_reference.go +++ b/github/resource_github_repository_autolink_reference.go @@ -69,6 +69,10 @@ func resourceGithubRepositoryAutolinkReference() *schema.Resource { Required: true, ForceNew: true, Description: "This prefix appended by a number will generate a link any time it is found in an issue, pull request, or commit", + ValidateDiagFunc: validation.ToDiagFunc(validation.StringMatch( + regexp.MustCompile(`^[a-zA-Z0-9.=+:/#_-]*[a-zA-Z.=+:/#_-]$`), + "must only contain letters, numbers, or .-_+=:/# and must not end with a number", + )), }, "target_url_template": { Type: schema.TypeString, From c3b0efd3b911b1dd12206eea29f323a3dcdb0b96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A9o?= Date: Mon, 16 Mar 2026 15:27:32 -0400 Subject: [PATCH 2/3] test: add regression test for key_prefix ending with a digit Adds a plan-time validation test asserting that a key_prefix ending in a digit (e.g. PTFY25) is rejected before any API call is made. Addresses review comment from @austenstone. --- ...thub_repository_autolink_reference_test.go | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/github/resource_github_repository_autolink_reference_test.go b/github/resource_github_repository_autolink_reference_test.go index e97b14abf6..f772422b9d 100644 --- a/github/resource_github_repository_autolink_reference_test.go +++ b/github/resource_github_repository_autolink_reference_test.go @@ -296,4 +296,24 @@ func TestAccGithubRepositoryAutolinkReference(t *testing.T) { }, }) }) + + t.Run("rejects key_prefix ending with a digit at plan time", func(t *testing.T) { + config := ` + resource "github_repository_autolink_reference" "autolink_invalid" { + repository = "some-repo" + key_prefix = "PTFY25" + target_url_template = "https://example.com/" + } + ` + + resource.UnitTest(t, resource.TestCase{ + ProviderFactories: providerFactories, + Steps: []resource.TestStep{ + { + Config: config, + ExpectError: regexp.MustCompile(`must not end with a number`), + }, + }, + }) + }) } From b1015f6d3a30dc15e24fe18f5e3c090cac583480 Mon Sep 17 00:00:00 2001 From: LeC-D Date: Wed, 18 Mar 2026 20:03:58 -0400 Subject: [PATCH 3/3] fix: split key_prefix validation into two separate validators MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per review by @deiga: use two StringMatch validators inside validation.All() — one for allowed characters (^[a-zA-Z0-9.=+:/#_-]+$) and one for the digit-suffix check (\D$) — instead of a single combined regex. This makes the error messages more precise. --- .../resource_github_repository_autolink_reference.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/github/resource_github_repository_autolink_reference.go b/github/resource_github_repository_autolink_reference.go index cec451e5b8..2464f18c37 100644 --- a/github/resource_github_repository_autolink_reference.go +++ b/github/resource_github_repository_autolink_reference.go @@ -69,9 +69,15 @@ func resourceGithubRepositoryAutolinkReference() *schema.Resource { Required: true, ForceNew: true, Description: "This prefix appended by a number will generate a link any time it is found in an issue, pull request, or commit", - ValidateDiagFunc: validation.ToDiagFunc(validation.StringMatch( - regexp.MustCompile(`^[a-zA-Z0-9.=+:/#_-]*[a-zA-Z.=+:/#_-]$`), - "must only contain letters, numbers, or .-_+=:/# and must not end with a number", + ValidateDiagFunc: validation.ToDiagFunc(validation.All( + validation.StringMatch( + regexp.MustCompile(`^[a-zA-Z0-9.=+:/#_-]+$`), + "must only contain letters, numbers, or the characters .-_+=:/#", + ), + validation.StringMatch( + regexp.MustCompile(`\D$`), + "must not end with a number", + ), )), }, "target_url_template": {