Add terraform state registry

models/packages/descriptor.go

@@ -203,6 +203,8 @@ func GetPackageDescriptorWithCache(ctx context.Context, pv *PackageVersion, c *c
 		metadata = &rubygems.Metadata{}
 	case TypeSwift:
 		metadata = &swift.Metadata{}
+	case TypeTerraformState:
+		// terraform packages have no metadata
 	case TypeVagrant:
 		metadata = &vagrant.Metadata{}
 	default:

models/packages/package.go

@@ -30,28 +30,29 @@ type Type string
 
 // List of supported packages
 const (
-	TypeAlpine    Type = "alpine"
-	TypeArch      Type = "arch"
-	TypeCargo     Type = "cargo"
-	TypeChef      Type = "chef"
-	TypeComposer  Type = "composer"
-	TypeConan     Type = "conan"
-	TypeConda     Type = "conda"
-	TypeContainer Type = "container"
-	TypeCran      Type = "cran"
-	TypeDebian    Type = "debian"
-	TypeGeneric   Type = "generic"
-	TypeGo        Type = "go"
-	TypeHelm      Type = "helm"
-	TypeMaven     Type = "maven"
-	TypeNpm       Type = "npm"
-	TypeNuGet     Type = "nuget"
-	TypePub       Type = "pub"
-	TypePyPI      Type = "pypi"
-	TypeRpm       Type = "rpm"
-	TypeRubyGems  Type = "rubygems"
-	TypeSwift     Type = "swift"
-	TypeVagrant   Type = "vagrant"
+	TypeAlpine         Type = "alpine"
+	TypeArch           Type = "arch"
+	TypeCargo          Type = "cargo"
+	TypeChef           Type = "chef"
+	TypeComposer       Type = "composer"
+	TypeConan          Type = "conan"
+	TypeConda          Type = "conda"
+	TypeContainer      Type = "container"
+	TypeCran           Type = "cran"
+	TypeDebian         Type = "debian"
+	TypeGeneric        Type = "generic"
+	TypeGo             Type = "go"
+	TypeHelm           Type = "helm"
+	TypeMaven          Type = "maven"
+	TypeNpm            Type = "npm"
+	TypeNuGet          Type = "nuget"
+	TypePub            Type = "pub"
+	TypePyPI           Type = "pypi"
+	TypeRpm            Type = "rpm"
+	TypeRubyGems       Type = "rubygems"
+	TypeSwift          Type = "swift"
+	TypeTerraformState Type = "terraform"
+	TypeVagrant        Type = "vagrant"
 )
 
 var TypeList = []Type{
@@ -76,6 +77,7 @@ var TypeList = []Type{
 	TypeRpm,
 	TypeRubyGems,
 	TypeSwift,
+	TypeTerraformState,
 	TypeVagrant,
 }
 
@@ -124,6 +126,8 @@ func (pt Type) Name() string {
 		return "RubyGems"
 	case TypeSwift:
 		return "Swift"
+	case TypeTerraformState:
+		return "Terraform State"
 	case TypeVagrant:
 		return "Vagrant"
 	}
@@ -175,6 +179,8 @@ func (pt Type) SVGName() string {
 		return "gitea-rubygems"
 	case TypeSwift:
 		return "gitea-swift"
+	case TypeTerraformState:
+		return "gitea-terraform"
 	case TypeVagrant:
 		return "gitea-vagrant"
 	}

models/packages/terraform/lock.go

@@ -0,0 +1,59 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+package terraform
+
+import (
+	"context"
+	"time"
+
+	packages_model "code.gitea.io/gitea/models/packages"
+	"code.gitea.io/gitea/modules/json"
+)
+
+const LockFile = "terraform.lock"
+
+// LockInfo is the metadata for a terraform lock.
+type LockInfo struct {
+	ID        string    `json:"ID"`
+	Operation string    `json:"Operation"`
+	Info      string    `json:"Info"`
+	Who       string    `json:"Who"`
+	Version   string    `json:"Version"`
+	Created   time.Time `json:"Created"`
+	Path      string    `json:"Path"`
+}
+
+func (l *LockInfo) IsLocked() bool {
+	return l.ID != ""
+}
+
+// GetLock returns the terraform lock for the given package.
+// Lock is empty if no lock exists.
+func GetLock(ctx context.Context, packageID int64) (LockInfo, error) {
+	var lock LockInfo
+	locks, err := packages_model.GetPropertiesByName(ctx, packages_model.PropertyTypePackage, packageID, LockFile)
+	if err != nil {
+		return lock, err
+	}
+	if len(locks) == 0 || locks[0].Value == "" {
+		return lock, nil
+	}
+
+	err = json.Unmarshal([]byte(locks[0].Value), &lock)
+	return lock, err
+}
+
+// SetLock sets the terraform lock for the given package.
+func SetLock(ctx context.Context, packageID int64, lock *LockInfo) error {
+	jsonBytes, err := json.Marshal(lock)
+	if err != nil {
+		return err
+	}
+
+	return packages_model.InsertOrUpdateProperty(ctx, packages_model.PropertyTypePackage, packageID, LockFile, string(jsonBytes))
+}
+
+// RemoveLock removes the terraform lock for the given package.
+func RemoveLock(ctx context.Context, packageID int64) error {
+	return packages_model.InsertOrUpdateProperty(ctx, packages_model.PropertyTypePackage, packageID, LockFile, "")
+}

modules/setting/packages.go

@@ -39,6 +39,7 @@ var (
 		LimitSizeRpm         int64
 		LimitSizeRubyGems    int64
 		LimitSizeSwift       int64
+		LimitSizeTerraform   int64
 		LimitSizeVagrant     int64
 
 		DefaultRPMSignEnabled bool
@@ -86,6 +87,7 @@ func loadPackagesFrom(rootCfg ConfigProvider) (err error) {
 	Packages.LimitSizeRpm = mustBytes(sec, "LIMIT_SIZE_RPM")
 	Packages.LimitSizeRubyGems = mustBytes(sec, "LIMIT_SIZE_RUBYGEMS")
 	Packages.LimitSizeSwift = mustBytes(sec, "LIMIT_SIZE_SWIFT")
+	Packages.LimitSizeTerraform = mustBytes(sec, "LIMIT_SIZE_TERRAFORM")
 	Packages.LimitSizeVagrant = mustBytes(sec, "LIMIT_SIZE_VAGRANT")
 	Packages.DefaultRPMSignEnabled = sec.Key("DEFAULT_RPM_SIGN_ENABLED").MustBool(false)
 	return nil

options/locale/locale_en-US.json

@@ -3563,6 +3563,18 @@
   "packages.swift.registry": "Set up this registry from the command line:",
   "packages.swift.install": "Add the package in your <code>Package.swift</code> file:",
   "packages.swift.install2": "and run the following command:",
+  "packages.terraform.install": "Set your state to use the http backend",
+  "packages.terraform.install2": "and run the following command:",
+  "packages.terraform.lock_status": "Lock Status",
+  "packages.terraform.locked_by": "Locked by %s",
+  "packages.terraform.unlocked": "Unlocked",
+  "packages.terraform.lock": "Lock",
+  "packages.terraform.unlock": "Unlock",
+  "packages.terraform.lock.success": "Terraform state was successfully locked.",
+  "packages.terraform.unlock.success": "Terraform state was successfully unlocked.",
+  "packages.terraform.lock.error.already_locked": "Terraform state is already locked.",
+  "packages.terraform.delete.locked": "Terraform state is locked and cannot be deleted.",
+  "packages.terraform.delete.latest": "The latest version of a Terraform state cannot be deleted.",
   "packages.vagrant.install": "To add a Vagrant box, run the following command:",
   "packages.settings.link": "Link this package to a repository",
   "packages.settings.link.description": "If you link a package with a repository, the package will appear in the repository's package list. Only repositories under the same owner can be linked. Leaving the field empty will remove the link.",

routers/api/packages/api.go

@@ -32,6 +32,7 @@ import (
 	"code.gitea.io/gitea/routers/api/packages/rpm"
 	"code.gitea.io/gitea/routers/api/packages/rubygems"
 	"code.gitea.io/gitea/routers/api/packages/swift"
+	"code.gitea.io/gitea/routers/api/packages/terraform"
 	"code.gitea.io/gitea/routers/api/packages/vagrant"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/context"
@@ -509,6 +510,21 @@ func CommonRoutes() *web.Router {
 				r.Get("/identifiers", swift.CheckAcceptMediaType(swift.AcceptJSON), swift.LookupPackageIdentifiers)
 			}, reqPackageAccess(perm.AccessModeRead))
 		})
+		// See https://docs.gitlab.com/ci/jobs/fine_grained_permissions/#terraform-state-endpoints
+		// For endpoint and permission reference
+		r.Group("/terraform/state/{name}", func() {
+			r.Get("", terraform.GetTerraformState)
+			r.Get("/versions/{serial}", terraform.GetTerraformStateBySerial)
+			r.Group("", func() {
+				r.Post("", terraform.UploadState)
+				r.Delete("", terraform.DeleteState)
+				r.Delete("/versions/{serial}", terraform.DeleteStateBySerial)
+			}, reqPackageAccess(perm.AccessModeWrite))
+			r.Group("/lock", func() {
+				r.Post("", terraform.LockState)
+				r.Delete("", terraform.UnlockState)
+			}, reqPackageAccess(perm.AccessModeWrite))
+		}, reqPackageAccess(perm.AccessModeRead))
 		r.Group("/vagrant", func() {
 			r.Group("/authenticate", func() {
 				r.Get("", vagrant.CheckAuthenticate)