fix: Handle out-of-band deletion of policy attachment
Description
Fixes a state drift issue in the gitlab_group_security_policy_attachment resource where out-of-band deletions were not being correctly detected by Terraform.
Why was this needed?
If a security policy project was unassigned from a group via the GitLab UI or API (bypassing Terraform), the Read operation wasn't properly clearing the orphaned resource from the state file. Because the state still held the old data, Terraform did not realize it needed to recreate the attachment during the next terraform apply.
What are the relevant changes?
-
Resource (
Readfunction): Added a guard clause to check ifresponse.Data.Group.SecurityPolicyProjector itsIDisnilor empty. If so, it callsresp.State.RemoveResource(ctx)to drop the resource from state and log a warning. -
Acceptance Tests: Added
TestAcc_GitlabGroupSecurityPolicyAttachment_RecreateOnExternalDelete. This test uses aPreConfighook to execute a GraphQL mutation that unassigns the policy project out-of-band, validating that Terraform successfully catches the drift and recreates the resource.
Closes: #6727 (closed)