Reject fork_from alongside unsupported repository keys

gitea_fork can only express the source repo and owning organisation, so any
other setting in a fork's yaml is silently dropped.

- validate fork_from entries carry no other repository attributes, naming the
  offending config key and attributes
- note that gitea_fork has no archive_on_destroy

modules/gitea_instance/modules/repository/main.tf

@@ -45,6 +45,7 @@ moved {
   to   = gitea_repository.this[0]
 }
 
+# gitea_fork has no archive_on_destroy, so removing a fork from the config deletes the repository instead of archiving it.
 resource "gitea_fork" "this" {
   count = var.fork_from == null ? 0 : 1
 

modules/gitea_instance/variables.tf

@@ -45,6 +45,19 @@ variable "repository" {
     migration_releases        = optional(bool)
   }))
   default = {}
+
+  validation {
+    condition = alltrue([
+      for key, repo in var.repository :
+      length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) == 0
+      if repo.fork_from != null
+    ])
+    error_message = "gitea_fork only takes the source repository and the owning organisation, so fork_from cannot be combined with other repository settings: ${join("; ", [
+      for key, repo in var.repository :
+      "${key} also sets ${join(", ", [for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)])}"
+      if repo.fork_from != null && length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) > 0
+    ])}."
+  }
 }
 
 variable "branch_protection" {