From 8bc04e2c7d57f325a8cddf9e0d2d334efbf17bed Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 16:03:44 +1000
Subject: [PATCH] Reject fork_from alongside unsupported repository keys

gitea_fork can only express the source repo and owning organisation, so any
other setting in a fork's yaml is silently dropped.

- validate fork_from entries carry no other repository attributes, naming the
  offending config key and attributes
- note that gitea_fork has no archive_on_destroy
---
 modules/gitea_instance/modules/repository/main.tf |  1 +
 modules/gitea_instance/variables.tf               | 13 +++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/modules/gitea_instance/modules/repository/main.tf b/modules/gitea_instance/modules/repository/main.tf
index d3749cd..80c8e03 100644
--- a/modules/gitea_instance/modules/repository/main.tf
+++ b/modules/gitea_instance/modules/repository/main.tf
@@ -45,6 +45,7 @@ moved {
   to   = gitea_repository.this[0]
 }
 
+# gitea_fork has no archive_on_destroy, so removing a fork from the config deletes the repository instead of archiving it.
 resource "gitea_fork" "this" {
   count = var.fork_from == null ? 0 : 1
 
diff --git a/modules/gitea_instance/variables.tf b/modules/gitea_instance/variables.tf
index 909ba71..c7ce6b7 100644
--- a/modules/gitea_instance/variables.tf
+++ b/modules/gitea_instance/variables.tf
@@ -45,6 +45,19 @@ variable "repository" {
     migration_releases        = optional(bool)
   }))
   default = {}
+
+  validation {
+    condition = alltrue([
+      for key, repo in var.repository :
+      length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) == 0
+      if repo.fork_from != null
+    ])
+    error_message = "gitea_fork only takes the source repository and the owning organisation, so fork_from cannot be combined with other repository settings: ${join("; ", [
+      for key, repo in var.repository :
+      "${key} also sets ${join(", ", [for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)])}"
+      if repo.fork_from != null && length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) > 0
+    ])}."
+  }
 }
 
 variable "branch_protection" {