feat: support use_immutable_subject and sub_claim_prefix on repository OIDC subject claim template

docs/resources/actions_repository_oidc_subject_claim_customization_template.md

@@ -29,6 +29,11 @@ resource "github_actions_repository_oidc_subject_claim_customization_template" "
   repository         = github_repository.example.name
   use_default        = false
   include_claim_keys = ["actor", "context", "repository_owner"]
+
+  # Opt this repository into immutable subject claims (owner and repository IDs)
+  # ahead of an org-wide rollout.
+  use_immutable_subject = true
+  sub_claim_prefix      = "custom-prefix"
 }
 ```
 
@@ -38,6 +43,8 @@ The following arguments are supported:
 
 - `use_default` - (Required) Whether to use the default template or not. If `true`, `include_claim_keys` must not be set.
 - `include_claim_keys` - (Optional) A list of OpenID Connect claims.
+- `use_immutable_subject` - (Optional) Whether to use immutable subject claims, which include the immutable repository and owner IDs, for this repository.
+- `sub_claim_prefix` - (Optional) An optional prefix to add to the repository's subject claim.
 
 ## Import
 

examples/resources/actions_repository_oidc_subject_claim_customization_template/example_1.tf

@@ -6,4 +6,9 @@ resource "github_actions_repository_oidc_subject_claim_customization_template" "
   repository         = github_repository.example.name
   use_default        = false
   include_claim_keys = ["actor", "context", "repository_owner"]
+
+  # Opt this repository into immutable subject claims (owner and repository IDs)
+  # ahead of an org-wide rollout.
+  use_immutable_subject = true
+  sub_claim_prefix      = "custom-prefix"
 }

github/resource_github_actions_repository_oidc_subject_claim_customization_template.go

@@ -39,6 +39,18 @@ func resourceGithubActionsRepositoryOIDCSubjectClaimCustomizationTemplate() *sch
 					Type: schema.TypeString,
 				},
 			},
+			"use_immutable_subject": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Computed:    true,
+				Description: "Whether to use immutable subject claims, which include the immutable repository and owner IDs, for this repository.",
+			},
+			"sub_claim_prefix": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Description: "An optional prefix to add to the repository's subject claim.",
+			},
 		},
 	}
 }
@@ -73,6 +85,14 @@ func resourceGithubActionsRepositoryOIDCSubjectClaimCustomizationTemplateCreateO
 		customOIDCSubjectClaimTemplate.IncludeClaimKeys = claimsStr
 	}
 
+	if v, ok := d.GetOk("use_immutable_subject"); ok {
+		customOIDCSubjectClaimTemplate.UseImmutableSubject = new(v.(bool))
+	}
+
+	if v, ok := d.GetOk("sub_claim_prefix"); ok {
+		customOIDCSubjectClaimTemplate.SubClaimPrefix = new(v.(string))
+	}
+
 	ctx := context.Background()
 	_, err := client.Actions.SetRepoOIDCSubjectClaimCustomTemplate(ctx, owner, repository, customOIDCSubjectClaimTemplate)
 	if err != nil {
@@ -104,6 +124,12 @@ func resourceGithubActionsRepositoryOIDCSubjectClaimCustomizationTemplateRead(d
 	if err = d.Set("include_claim_keys", template.IncludeClaimKeys); err != nil {
 		return err
 	}
+	if err = d.Set("use_immutable_subject", template.UseImmutableSubject); err != nil {
+		return err
+	}
+	if err = d.Set("sub_claim_prefix", template.SubClaimPrefix); err != nil {
+		return err
+	}
 
 	return nil
 }

github/resource_github_actions_repository_oidc_subject_claim_customization_template_test.go

@@ -62,6 +62,45 @@ func TestAccGithubActionsRepositoryOIDCSubjectClaimCustomizationTemplate(t *test
 		})
 	})
 
+	t.Run("creates repository oidc subject claim customization template with immutable subject without error", func(t *testing.T) {
+		t.Parallel()
+
+		randomID := acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
+		repoName := fmt.Sprintf("%srepo-act-oidc-%s", testResourcePrefix, randomID)
+		config := fmt.Sprintf(`
+		resource "github_repository" "test" {
+			name = "%s"
+			visibility = "private"
+		}
+
+		resource "github_actions_repository_oidc_subject_claim_customization_template" "test" {
+			repository = github_repository.test.name
+			use_default = false
+			include_claim_keys = ["repo"]
+			use_immutable_subject = true
+			sub_claim_prefix = "custom-prefix"
+		}`, repoName)
+
+		check := resource.ComposeTestCheckFunc(
+			resource.TestCheckResourceAttr(
+				"github_actions_repository_oidc_subject_claim_customization_template.test",
+				"use_immutable_subject", "true"),
+			resource.TestCheckResourceAttr(
+				"github_actions_repository_oidc_subject_claim_customization_template.test",
+				"sub_claim_prefix", "custom-prefix"),
+		)
+		resource.Test(t, resource.TestCase{
+			PreCheck:          func() { skipUnauthenticated(t) },
+			ProviderFactories: providerFactories,
+			Steps: []resource.TestStep{
+				{
+					Config: config,
+					Check:  check,
+				},
+			},
+		})
+	})
+
 	t.Run("updates repository oidc subject claim customization template without error", func(t *testing.T) {
 		t.Parallel()
 

templates/resources/actions_repository_oidc_subject_claim_customization_template.md.tmpl

@@ -28,6 +28,8 @@ The following arguments are supported:
 
 - `use_default` - (Required) Whether to use the default template or not. If `true`, `include_claim_keys` must not be set.
 - `include_claim_keys` - (Optional) A list of OpenID Connect claims.
+- `use_immutable_subject` - (Optional) Whether to use immutable subject claims, which include the immutable repository and owner IDs, for this repository.
+- `sub_claim_prefix` - (Optional) An optional prefix to add to the repository's subject claim.
 
 ## Import