fix(repository): migrate vulnerability_alerts to dedicated resource

[posquit0]

Summary

The integrations/github provider deprecated the vulnerability_alerts attribute on the github_repository resource in favor of the dedicated github_repository_vulnerability_alerts resource. Reading it in the module output produced:

Warning: Deprecated value used
  on .../repository/outputs.tf line 175, in output "vulnerability_alerts":
 175:   value = github_repository.this.vulnerability_alerts
Deprecated resource attribute "vulnerability_alerts" used.

This PR migrates to the dedicated resource and, while at it, reworks the module input.

Changes

• Removed vulnerability_alerts from the github_repository resource.
• Added a github_repository_vulnerability_alerts.this resource (manages Dependabot alerts for vulnerable dependencies).
• Removed the vulnerability_alerts input variable; the toggle is now a DEPENDABOT_ALERTS entry in the existing features set, consistent with the other feature toggles (DISCUSSIONS, ISSUES, PROJECTS, WIKI). The resource is driven by contains(var.features, "DEPENDABOT_ALERTS").
• Kept the vulnerability_alerts output (now sourced from the new resource's enabled).
• Updated the README resource list, resources table, and inputs.

⚠️ Breaking change

The vulnerability_alerts input is removed. Consumers migrate as:

# before
vulnerability_alerts = true

# after
features = ["ISSUES", "DEPENDABOT_ALERTS"]

State migration note

Because alerts now live in a separate resource, the next terraform apply drops the attribute from github_repository.this and creates github_repository_vulnerability_alerts.this — same underlying GitHub setting, no functional change. Optionally terraform import github_repository_vulnerability_alerts.this <repo-name> to avoid the recreate.

terraform validate passes; the targeted deprecation warning is gone.

[gemini-code-assist]

Code Review

This pull request refactors the GitHub repository module to manage vulnerability alerts using a separate github_repository_vulnerability_alerts resource instead of the inline argument on github_repository. However, the new resource does not support an enabled argument or attribute. The feedback suggests conditionally creating the resource using the count meta-argument and updating the output accordingly to prevent Terraform evaluation errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The github_repository_vulnerability_alerts resource in the GitHub provider does not support an enabled argument. To conditionally enable or disable vulnerability alerts, you should use the count meta-argument to conditionally create the resource based on var.vulnerability_alerts.

resource "github_repository_vulnerability_alerts" "this" {
  count      = var.vulnerability_alerts ? 1 : 0
  repository = github_repository.this.name
}

[gemini-code-assist]

Since the github_repository_vulnerability_alerts resource does not have an enabled attribute, and should be conditionally created using count, referencing github_repository_vulnerability_alerts.this.enabled directly will result in a Terraform evaluation error. Instead, you can check if the resource is created by checking the length of the resource list.

  value       = length(github_repository_vulnerability_alerts.this) > 0