fix: add plan-time validation to key_prefix in autolink reference resource (#3176)

[LeC-D]

Summary

Fixes #3176

Problem

terraform plan accepts any value for key_prefix in github_repository_autolink_reference, but terraform apply can fail with a 422 from the GitHub API if the value is invalid:

key_prefix must not end with a number
key_prefix must only contain letters, numbers, or .-_+=:/#

This creates a confusing plan/apply inconsistency where the plan shows a clean diff but apply fails.

Fix

Added ValidateDiagFunc to the key_prefix schema field using a regexp that mirrors GitHub's API constraints:

• Allowed characters: letters, digits, and .-_+=:/#
• Must not end with a digit

ValidateDiagFunc: validation.ToDiagFunc(validation.StringMatch(
    regexp.MustCompile(`^[a-zA-Z0-9.=+:/#_-]*[a-zA-Z.=+:/#_-]$`),
    "must only contain letters, numbers, or .-_+=:/# and must not end with a number",
)),

Both regexp and validation were already imported in this file (used by target_url_template). No new dependencies needed.

Testing

Existing acceptance tests use key_prefix values like TEST1-, TEST2-, etc. which all pass the new validation. Invalid values like PTFY25 (ends with digit) will now be caught at plan time.

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[austenstone]

Left a concrete regression-test suggestion so the fix is covered at plan time as well as in the schema.

[austenstone]

This validation looks right. I think the missing piece is a regression test that proves invalid prefixes now fail during terraform plan, since that’s the behavior this PR is fixing.

Because this PR only changes this file, I can’t attach a native GitHub suggestion directly to github/resource_github_repository_autolink_reference_test.go, but something along these lines would lock it in:

t.Run("rejects invalid key_prefix at plan time", func(t *testing.T) {
	randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
	repoName := fmt.Sprintf("%srepo-autolink-%s", testResourcePrefix, randomID)
	config := fmt.Sprintf(`
		resource "github_repository" "test" {
			name        = "%s"
			description = "Test autolink validation"
		}

		resource "github_repository_autolink_reference" "invalid" {
			repository = github_repository.test.name

			key_prefix          = "PTFY25"
			target_url_template = "https://example.com/PTFY-<num>"
		}
	`, repoName)

	resource.Test(t, resource.TestCase{
		PreCheck:          func() { skipUnauthenticated(t) },
		ProviderFactories: providerFactories,
		Steps: []resource.TestStep{
			{
				Config:      config,
				ExpectError: regexp.MustCompile(`must only contain letters, numbers, or .* must not end with a number`),
			},
		},
	})
})

That would make sure we don’t regress back to the current plan/apply mismatch later.

[LeC-D]

Good catch! Added a resource.UnitTest sub-test that passes key_prefix = "PTFY25" (ends with a digit) and asserts a plan-time error matching must not end with a number. The test uses providerFactories and doesn't require a real GitHub account.

[LeC-D]

Good call! Added a resource.UnitTest sub-test in resource_github_repository_autolink_reference_test.go that passes key_prefix = "PTFY25" (ends with a digit) and asserts a plan-time error matching must not end with a number. This locks in the validation behavior without requiring a real GitHub account.

[LeC-D]

Rebased on upstream main to bring the branch up to date.

[deiga]

suggestion: use 2 validations, one for suffix and one for allowed chars.
And the must not end with could be simplified to \D$ I think

[LeC-D]

Done — split into two StringMatch validators inside validation.All(): one for allowed characters (^[a-zA-Z0-9.=+:/#_-]+$) and one for the digit-suffix check using \D$ as you suggested. Error messages are now separate and targeted.

[LeC-D]

Applied @deiga's review feedback: split the key_prefix validation into two separate StringMatch validators inside validation.All() — one for allowed characters (^[a-zA-Z0-9.=+:/#_-]+$) and one for the digit-suffix check (\D$). Error messages are now more targeted. Thanks for the suggestion!

[LeC-D]

Rebased on upstream main (2026-03-24) to bring the branch back up to date.