gitlab_project_access_token produces "Provider produced inconsistent result after apply" on rotation with provider ≥ 18.11.0.

Posting this as an issue as although there are workarounds it feels like this shouldn't be an issue when running terraform after a project or group access token expires.

If this Error is intentional wpuld be great to understand why thats the case 🙂

Error

Error: Provider produced inconsistent result after apply When applying changes to gitlab_project_access_token., provider "registry.opentofu.org/gitlabhq/gitlab" (or registry.terraform.io/...) produced an unexpected new value: .active: was cty.False, but now cty.True. This is a bug in the provider, which should be reported in the provider's own issue tracker.

Provider version

18.11.0

GitLab version

18.11.0 self hosted GitLab Ultimate

Minimal reproduction

resource "gitlab_project_access_token" "example" {
  project      = "<project-id-or-path>"
  name         = "test-rotation-token"
  scopes       = ["api"]
  access_level = "maintainer"   # or whatever you use

  rotation_configuration {
    expiration_days    = 30
    rotate_before_days = 7
  }
}

Steps:

1. Apply once so the token exists.
2. Then wait for the token to expire and then rerun the pipeline terraform apply → fails with the .active inconsistency.
3. A second terraform apply usually succeeds. Or adding a life cycle ignore_changes block can be utilised as a workaround.

Additional context

Related earlier fixes: !2841 (merged) (18.8.0 – fixed validate_past_expiration_date inconsistency), !2759 (merged), !2722 (merged). Still reproduces on 18.11.0.

Expected

Rotation completes and state is updated with active = true without an inconsistency error.