fix: do not update/create rulesets on archived repository

github/resource_github_repository.go

@@ -693,6 +693,13 @@ func resourceGithubRepositoryRead(d *schema.ResourceData, meta interface{}) erro
 		d.Set("merge_commit_title", repo.GetMergeCommitTitle())
 		d.Set("squash_merge_commit_message", repo.GetSquashMergeCommitMessage())
 		d.Set("squash_merge_commit_title", repo.GetSquashMergeCommitTitle())
+
+		// Get repository rulesets
+		rulesets, _, err := client.Repositories.GetAllRulesets(ctx, owner, repoName, true)
+		if err != nil {
+			return fmt.Errorf("error getting repository rulesets: %v", err)
+		}
+		d.Set("rulesets", rulesets)
 	}
 
 	if repo.GetHasPages() {
@@ -746,7 +753,6 @@ func resourceGithubRepositoryUpdate(d *schema.ResourceData, meta interface{}) er
 	}
 
 	client := meta.(*Owner).v3client
-
 	repoReq := resourceGithubRepositoryObject(d)
 
 	// handle visibility updates separately from other fields
@@ -757,6 +763,11 @@ func resourceGithubRepositoryUpdate(d *schema.ResourceData, meta interface{}) er
 		log.Print("[DEBUG] No security_and_analysis update required. Removing this field from the payload.")
 	}
 
+	// Skip ruleset operations if repository is archived
+	if d.Get("archived").(bool) {
+		log.Printf("[DEBUG] Repository is archived, skipping ruleset operations")
+	}
+
 	// The documentation for `default_branch` states: "This can only be set
 	// after a repository has already been created". However, for backwards
 	// compatibility we need to allow terraform configurations that set

github/resource_github_repository_test.go

@@ -985,6 +985,77 @@ func TestAccGithubRepositories(t *testing.T) {
 
 	})
 
+	t.Run("skips ruleset operations for archived repositories", func(t *testing.T) {
+		config := fmt.Sprintf(`
+			resource "github_repository" "test" {
+				name        = "tf-acc-test-archive-ruleset-%[1]s"
+				description = "Terraform acceptance tests %[1]s"
+				archived    = false
+			}
+
+			resource "github_repository_ruleset" "test" {
+				name        = "test"
+				repository  = github_repository.test.name
+				target      = "branch"
+				enforcement = "active"
+
+				rules {
+					creation = true
+				}
+			}
+		`, randomID)
+
+		checks := map[string]resource.TestCheckFunc{
+			"before": resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr(
+					"github_repository.test", "archived",
+					"false",
+				),
+				resource.TestCheckResourceAttr(
+					"github_repository_ruleset.test", "name",
+					"test",
+				),
+			),
+			"after": resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr(
+					"github_repository.test", "archived",
+					"true",
+				),
+			),
+		}
+
+		testCase := func(t *testing.T, mode string) {
+			resource.Test(t, resource.TestCase{
+				PreCheck:  func() { skipUnlessMode(t, mode) },
+				Providers: testAccProviders,
+				Steps: []resource.TestStep{
+					{
+						Config: config,
+						Check:  checks["before"],
+					},
+					{
+						Config: strings.Replace(config,
+							`archived    = false`,
+							`archived    = true`, 1),
+						Check: checks["after"],
+					},
+				},
+			})
+		}
+
+		t.Run("with an anonymous account", func(t *testing.T) {
+			t.Skip("anonymous account not supported for this operation")
+		})
+
+		t.Run("with an individual account", func(t *testing.T) {
+			testCase(t, individual)
+		})
+
+		t.Run("with an organization account", func(t *testing.T) {
+			testCase(t, organization)
+		})
+	})
+
 }
 func TestAccGithubRepositoryPages(t *testing.T) {