feat: nullplatform_artifact + nullplatform_package resources and data sources

examples/data-sources/nullplatform_artifact/data-source.tf

@@ -0,0 +1,23 @@
+# Resolve a git repository artifact revision by url + reference — the ids are
+# ready to pin in a package BOM.
+data "nullplatform_artifact" "scopes_at_1_10" {
+  nrn  = "organization=1255165411:account=95118862"
+  type = "git_repository"
+  meta = jsonencode({
+    url       = "https://github.com/nullplatform/scopes.git"
+    reference = "1.10.0"
+  })
+}
+
+# Identity-only lookup: resolves the artifact and its latest revision.
+data "nullplatform_artifact" "scopes_latest" {
+  nrn  = "organization=1255165411:account=95118862"
+  type = "git_repository"
+  meta = jsonencode({
+    url = "https://github.com/nullplatform/scopes.git"
+  })
+}
+
+output "scopes_revision_id" {
+  value = data.nullplatform_artifact.scopes_at_1_10.revision_id
+}

examples/data-sources/nullplatform_package/data-source.tf

@@ -0,0 +1,16 @@
+# Look up a package by (nrn, slug); revision_id follows the package default.
+data "nullplatform_package" "k8s_containers" {
+  nrn  = "organization=1255165411:account=95118862"
+  slug = "k8s-containers"
+}
+
+# Pin an exact published version instead.
+data "nullplatform_package" "k8s_containers_v1" {
+  nrn     = "organization=1255165411:account=95118862"
+  slug    = "k8s-containers"
+  version = "1.0.0"
+}
+
+output "default_revision_id" {
+  value = data.nullplatform_package.k8s_containers.revision_id
+}

examples/resources/nullplatform_artifact/resource.tf

@@ -0,0 +1,26 @@
+# Register a git repository at a specific reference (commit sha, tag or
+# branch). The resource id is the revision id — ready to pin in a package BOM.
+resource "nullplatform_artifact" "scopes_source" {
+  nrn  = "organization=1255165411:account=95118862"
+  type = "git_repository"
+  meta = jsonencode({
+    url       = "https://github.com/nullplatform/scopes.git"
+    reference = "1.10.0"
+  })
+}
+
+# Register an OCI image by digest, shared with another organization scope.
+resource "nullplatform_artifact" "runtime_image" {
+  nrn  = "organization=1255165411:account=95118862"
+  type = "oci_image"
+  meta = jsonencode({
+    registry   = "ghcr.io"
+    repository = "nullplatform/runtime"
+    digest     = "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
+  })
+
+  visible_to = [
+    "organization=1255165411:account=95118862",
+    "organization=1255165411:account=12345",
+  ]
+}

examples/resources/nullplatform_package/resource.tf

@@ -0,0 +1,48 @@
+# Publish a package pinning a service specification snapshot and an artifact
+# revision. Bump `version` together with component changes to publish a new
+# revision; `default = true` promotes each publish to the package default.
+resource "nullplatform_package" "k8s_containers" {
+  nrn     = "organization=1255165411:account=95118862"
+  slug    = "k8s-containers"
+  name    = "Containers"
+  version = "1.0.0"
+  default = true
+
+  components {
+    name                 = "spec"
+    resource_type        = "service_specification"
+    resource_id          = nullplatform_service_specification.containers.id
+    resource_revision_id = var.containers_spec_snapshot_id
+  }
+
+  components {
+    name                 = "source"
+    resource_type        = "artifact"
+    resource_id          = nullplatform_artifact.scopes_source.artifact_id
+    resource_revision_id = nullplatform_artifact.scopes_source.id
+  }
+
+  visible_to = [
+    "organization=1255165411",
+  ]
+}
+
+# Pin the default to an exact published version instead of promoting each
+# publish (mutually exclusive with `default = true`). Handy for staged
+# rollouts and rollbacks: point default_version back at a previous release
+# and apply.
+resource "nullplatform_package" "pinned" {
+  nrn     = "organization=1255165411:account=95118862"
+  slug    = "pinned-runtime"
+  name    = "Pinned Runtime"
+  version = "1.1.0"
+
+  default_version = "1.0.0" # consumers stay on 1.0.0 while 1.1.0 soaks
+
+  components {
+    name                 = "spec"
+    resource_type        = "service_specification"
+    resource_id          = nullplatform_service_specification.containers.id
+    resource_revision_id = var.containers_spec_snapshot_id
+  }
+}

nullplatform/data_source_package.go

@@ -0,0 +1,131 @@
+package nullplatform
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func dataSourcePackage() *schema.Resource {
+	return &schema.Resource{
+		Description: "Looks up an existing nullplatform package by its natural key (nrn, slug). " +
+			"Optionally resolves a specific published version to its revision id; otherwise " +
+			"`revision_id` follows the package default (falling back to latest). The revision ids " +
+			"are what services bind to and what package-in-package composition will pin.",
+		ReadContext: dataSourcePackageRead,
+		Schema: map[string]*schema.Schema{
+			"nrn": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "The owner NRN of the package.",
+			},
+			"slug": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "The package slug, unique per NRN.",
+			},
+			"version": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Resolve this exact published semver to `revision_id`. When omitted, `revision_id` follows the package default.",
+			},
+			"name": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Human-readable display name.",
+			},
+			"visible_to": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Description: "NRNs allowed to consume this package.",
+			},
+			"revision_id": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Revision UUID for `version` when set; otherwise the default (or latest) revision.",
+			},
+			"default_revision_id": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Revision UUID services bind to by default.",
+			},
+			"latest_revision_id": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Highest-semver revision UUID.",
+			},
+			"default_version": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Semver of the default revision.",
+			},
+			"latest_version": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Semver of the latest revision.",
+			},
+		},
+	}
+}
+
+func dataSourcePackageRead(_ context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	nullOps := m.(NullOps)
+
+	nrn := d.Get("nrn").(string)
+	slug := d.Get("slug").(string)
+
+	pkg, err := nullOps.FindPackage(nrn, slug)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	revisionID := pkg.DefaultRevisionID
+	if revisionID == "" {
+		revisionID = pkg.LatestRevisionID
+	}
+
+	if version, ok := d.GetOk("version"); ok {
+		revisions, err := nullOps.ListPackageRevisions(pkg.ID)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		revisionID = ""
+		for _, revision := range revisions {
+			if revision.Version == version.(string) {
+				revisionID = revision.ID
+				break
+			}
+		}
+		if revisionID == "" {
+			return diag.FromErr(fmt.Errorf("package %s/%s has no published version %s", nrn, slug, version))
+		}
+	}
+
+	d.SetId(pkg.ID)
+	if err := d.Set("name", pkg.Name); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("visible_to", pkg.VisibleTo); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("revision_id", revisionID); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("default_revision_id", pkg.DefaultRevisionID); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("latest_revision_id", pkg.LatestRevisionID); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("default_version", pkg.DefaultVersion); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("latest_version", pkg.LatestVersion); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}