Add terraform state registry (#36710)

Adds terraform/opentofu state registry with locking. Implements: https://github.com/go-gitea/gitea/issues/33644. I also checked [encrypted state](https://opentofu.org/docs/language/state/encryption), it works out of the box.

Docs PR: https://gitea.com/gitea/docs/pulls/357

---------

Co-authored-by: Andras Elso <elso.andras@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/packages/terraform/spec.go

@@ -0,0 +1,85 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package terraform
+
+import (
+	"context"
+
+	packages_model "code.gitea.io/gitea/models/packages"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/optional"
+	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
+	"code.gitea.io/gitea/modules/util"
+	packages_service "code.gitea.io/gitea/services/packages"
+)
+
+type Specialization struct{}
+
+var _ packages_service.Specialization = (*Specialization)(nil)
+
+func (s Specialization) GetViewPackageVersionData(ctx context.Context, pd *packages_model.PackageDescriptor) (any, error) {
+	var ret struct {
+		IsLatestVersion bool
+		TerraformLock   *terraform_module.LockInfo
+	}
+	latestPvs, _, err := packages_model.SearchLatestVersions(ctx, &packages_model.PackageSearchOptions{
+		PackageID:  pd.Package.ID,
+		IsInternal: optional.Some(false),
+	})
+	if err != nil {
+		return ret, err
+	}
+	isLatest := len(latestPvs) > 0 && latestPvs[0].ID == pd.Version.ID
+	ret.IsLatestVersion = isLatest
+
+	if isLatest {
+		lockInfo, err := terraform_module.GetLock(ctx, pd.Package.ID)
+		if err != nil {
+			return ret, nil
+		}
+		if lockInfo.IsLocked() {
+			ret.TerraformLock = &lockInfo
+		}
+	}
+	return ret, nil
+}
+
+func (s Specialization) OnBeforeRemovePackageAll(ctx context.Context, doer *user_model.User, pkg *packages_model.Package, pds []*packages_model.PackageDescriptor) error {
+	locked, err := IsLocked(ctx, pkg)
+	if err != nil {
+		return err
+	}
+	if locked {
+		return util.ErrorWrapTranslatable(
+			util.ErrorWrap(util.ErrUnprocessableContent, "terraform state is locked and cannot be deleted"),
+			"packages.terraform.delete.locked",
+		)
+	}
+	return nil
+}
+
+func (s Specialization) OnBeforeRemovePackageVersion(ctx context.Context, doer *user_model.User, pd *packages_model.PackageDescriptor) error {
+	locked, err := IsLocked(ctx, pd.Package)
+	if err != nil {
+		return err
+	}
+	if locked {
+		return util.ErrorWrapTranslatable(
+			util.ErrorWrap(util.ErrUnprocessableContent, "terraform state is locked and cannot be deleted"),
+			"packages.terraform.delete.locked",
+		)
+	}
+
+	latest, err := IsLatest(ctx, pd)
+	if err != nil {
+		return err
+	}
+	if latest {
+		return util.ErrorWrapTranslatable(
+			util.ErrorWrap(util.ErrUnprocessableContent, "the latest version of a Terraform state cannot be deleted"),
+			"packages.terraform.delete.latest",
+		)
+	}
+	return nil
+}

services/packages/terraform/state.go

@@ -0,0 +1,44 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package terraform
+
+import (
+	"context"
+
+	packages_model "code.gitea.io/gitea/models/packages"
+	"code.gitea.io/gitea/modules/optional"
+	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
+)
+
+// IsLocked is a helper function to check if the terraform state is locked
+func IsLocked(ctx context.Context, pkg *packages_model.Package) (bool, error) {
+	// Non terraform state packages aren't handled here
+	if pkg.Type == packages_model.TypeTerraformState {
+		return false, nil
+	}
+
+	lock, err := terraform_module.GetLock(ctx, pkg.ID)
+	if err != nil {
+		return false, err
+	}
+	return lock.IsLocked(), nil
+}
+
+// IsLatest is a helper function to check if the terraform state is the latest version
+func IsLatest(ctx context.Context, pd *packages_model.PackageDescriptor) (bool, error) {
+	if pd.Package.Type == packages_model.TypeTerraformState {
+		return false, nil
+	}
+	latestPvs, _, err := packages_model.SearchLatestVersions(ctx, &packages_model.PackageSearchOptions{
+		PackageID:  pd.Package.ID,
+		IsInternal: optional.Some(false),
+	})
+	if err != nil {
+		return false, err
+	}
+	if len(latestPvs) > 0 && latestPvs[0].ID == pd.Version.ID {
+		return true, nil
+	}
+	return false, nil
+}