Merge branch 'main' into master

.editorconfig

@@ -9,6 +9,6 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[{*.yml, *.tf}]
+[{*.yml,*.tf}]
 indent_style = space
 indent_size = 2

.github/workflows/codeql-analysis.yml

@@ -13,17 +13,21 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
+    paths-ignore:
+      - '**/*.md'
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
+    paths-ignore:
+      - '**/*.md'
   schedule:
     - cron: '15 11 * * 0'
 
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read
@@ -38,17 +42,17 @@ jobs:
 
     steps:
     - name: Checkout Code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version-file: 'go.mod'
         cache: true
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +63,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +77,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v3

.github/workflows/dependency-submission.yml

@@ -2,25 +2,27 @@ name: Go Dependency Submission
 on:
   push:
     branches:
-      - master
+      - main
+    paths-ignore:
+      - '**/*.md'
 
 permissions:
   contents: write
 
 jobs:
   go-dependency-submission:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
           cache: true
 
       - name: Run snapshot action
-        uses: actions/go-dependency-submission@v1
+        uses: actions/go-dependency-submission@v2
         with:
           go-mod-path: go.mod

.github/workflows/release.yml

@@ -7,12 +7,12 @@ on:
 jobs:
   wait:
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Wait for acceptance tests
     steps:
       - name: Wait for acceptance tests
         id: wait
-        uses: "WyriHaximus/github-action-wait-for-status@v1.4.0"
+        uses: "WyriHaximus/github-action-wait-for-status@v1.8.0"
         with:
           ignoreActions: Wait for acceptance tests
           checkInterval: 30
@@ -22,45 +22,45 @@ jobs:
       status: steps.wait.outputs.status
 
   release:
+    permissions: write-all
     needs:
       - wait
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
           cache: true
 
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v2
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Get tag name
         id: get_tag_name
-        run: echo ::set-output name=TAG::${GITHUB_REF#refs/tags/}
+        run: echo "name=TAG::${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
       - name: Build release notes link
         id: build-release-notes
         run: |
           releaseDate=$(date '+%B-%-d-%Y' | tr '[:upper:]' '[:lower:]')
           releaseVersion=$(echo ${{ steps.get_tag_name.outputs.TAG }} | tr -d '.')
           tmp=$(mktemp -d)
-          echo "[Release Notes](https://github.com/mrparkers/terraform-provider-keycloak/blob/master/CHANGELOG.md#${releaseVersion}-${releaseDate})" > ${tmp}/release-notes.md
+          echo "[Release Notes](https://github.com/keycloak/terraform-provider-keycloak/blob/main/CHANGELOG.md#${releaseVersion}-${releaseDate})" > ${tmp}/release-notes.md
           cat ${tmp}/release-notes.md
-          echo ::set-output name=NOTES::${tmp}/release-notes.md
+          echo "name=NOTES::${tmp}/release-notes.md" >> $GITHUB_OUTPUT
 
       - name: GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v6
         with:
-          version: v0.179.0
-          args: release --rm-dist --release-notes=${{ steps.build-release-notes.outputs.NOTES }}
+          args: release --clean --release-notes=${{ steps.build-release-notes.outputs.NOTES }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.github/workflows/test.yml

@@ -2,22 +2,26 @@ name: test
 on:
   push:
     branches:
-      - master
+      - main
+    paths-ignore:
+      - '**/*.md'
   pull_request:
     branches:
-      - master
+      - main
+    paths-ignore:
+      - '**/*.md'
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 2 # we want the HEAD commit and the previous commit to compare changed files
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -31,7 +35,7 @@ jobs:
       # we only want to run tests if any code changes (not for README or docs changes)
       - name: Check Changed Files
         id: files
-        uses: tj-actions/changed-files@v1.1.3
+        uses: tj-actions/changed-files@v45
         with:
           files: |
             .github
@@ -56,50 +60,52 @@ jobs:
       (needs.verify.outputs.code-files-changed || startsWith(github.ref, 'refs/tags/v'))
     needs:
       - verify
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         keycloak-version:
-          - '21.0.1'
-          - '20.0.5'
-          - '19.0.2'
+          - '26.0.7'
+          - '25.0.6'
+          - '24.0.5'
+          - '23.0.7'
+          - '22.0.5'
       fail-fast: false
     concurrency:
       group: ${{ github.head_ref || github.run_id }}-${{ matrix.keycloak-version }}
       cancel-in-progress: true
-    services:
-      keycloak:
-        # we have to use a custom docker image for these tests, since it's not possible to provide command-line args
-        # to a service container.  see https://github.com/actions/runner/issues/2139
-        image: mrparkers/keycloak-dev:${{ matrix.keycloak-version }}
-        ports:
-          - 8080:8080
-        env:
-          KC_DB: dev-mem
-          KC_LOG_LEVEL: INFO
-          KEYCLOAK_ADMIN: keycloak
-          KEYCLOAK_ADMIN_PASSWORD: password
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
           cache: true
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v1
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_wrapper: false
-          terraform_version: 1.4.1
+          terraform_version: 1.9.8
+
+      - name: Start Keycloak Container
+        run: |
+          docker run -d --name keycloak \
+          -p 8080:8080 \
+          -e KC_DB=dev-mem \
+          -e KC_LOG_LEVEL=INFO \
+          -e KEYCLOAK_ADMIN=keycloak \
+          -e KEYCLOAK_ADMIN_PASSWORD=password \
+          -e KC_FEATURES=preview \
+          -v $PWD/provider/misc:/opt/keycloak/misc:z \
+          quay.io/keycloak/keycloak:${{ matrix.keycloak-version }} start-dev
 
       - name: Initialize Keycloak
         run: ./scripts/wait-for-local-keycloak.sh && ./scripts/create-terraform-client.sh
 
       - name: Get Keycloak Version
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         id: keycloak-version
         env:
           KEYCLOAK_VERSION: ${{ matrix.keycloak-version }}
@@ -108,14 +114,19 @@ jobs:
             return process.env.KEYCLOAK_VERSION.split("-")[0]
       - name: Test
         run: |
+          terraform version
           go mod download
           make testacc
         env:
           KEYCLOAK_CLIENT_ID: terraform
           KEYCLOAK_CLIENT_SECRET: 884e0f95-0f42-4a63-9b1f-94274655669e
-          KEYCLOAK_CLIENT_TIMEOUT: 30
+          KEYCLOAK_CLIENT_TIMEOUT: 120
           KEYCLOAK_REALM: master
           KEYCLOAK_URL: "http://localhost:8080"
           KEYCLOAK_TEST_PASSWORD_GRANT: "true"
           KEYCLOAK_VERSION: ${{ steps.keycloak-version.outputs.result }}
         timeout-minutes: 60
+      - name: Clean up
+        run: |
+          docker stop keycloak
+          docker rm keycloak

.gitignore

@@ -19,6 +19,9 @@ terraform.d/
 .terraform.lock.hcl
 terraform.tfstate*
 
+# local experiments or reproducers
+scratch/
+
 .gradle/
 
 # custom user federation example
@@ -32,3 +35,5 @@ site/
 *.zip
 
 .DS_Store
+
+test_env.json

.goreleaser.yml

@@ -1,5 +1,7 @@
 # Visit https://goreleaser.com for documentation on how to customize this
 # behavior.
+version: 2
+
 before:
   hooks:
     # this is just an example and not a requirement for provider building/publishing
@@ -45,7 +47,7 @@ signs:
   - artifacts: checksum
     args:
       # if you are using this is a GitHub action or some other automated pipeline, you
-      # need to pass the batch flag to indicate its not interactive.
+      # need to pass the batch flag to indicate it's not interactive.
       - "--batch"
       - "--local-user"
       - "{{ .Env.GPG_FINGERPRINT }}" # set this environment variable for your signing key
@@ -57,4 +59,4 @@ release:
 # If you want to manually examine the release before its live, uncomment this line:
 # draft: true
 changelog:
-  skip: true
+  disable: true