<details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=40916776&issueIid=6861) - [Work on this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=40916776&issueIid=6861) </details> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=40916776&issueIid=6861) </details> ## Summary When applying a `gitlab_branch_protection` resource with `allowed_to_unprotect = []` (empty), the GitLab Terraform provider returns an inconsistent result after apply. Instead of respecting the empty list, the API silently defaults `allowed_to_unprotect` to `[{ access_level = "maintainer" }]`, causing Terraform to report a plan/apply mismatch. ## Background Discovered in [infra-mgmt!2988](https://gitlab.com/gitlab-com/gl-infra/infra-mgmt/-/merge_requests/2988) while importing the `gitlab-com/gl-infra/sandbox/protos` project into IaC management. ## Error The following errors are produced during `terraform apply`: ``` Error: Provider produced inconsistent result after apply When applying changes to module.project_gitlab_infra_tools["protos"].gitlab_branch_protection.branch["main"], provider "provider[\"registry.terraform.io/gitlabhq/gitlab\"]" produced an unexpected new value: .allowed_to_unprotect: actual set element cty.ObjectVal(map[string]cty.Value{"access_level":cty.StringVal("maintainer"), "access_level_description":cty.StringVal("Maintainers"), "group_id":cty.NullVal(cty.Number), "user_id":cty.NullVal(cty.Number)}) does not correlate with any element in plan. This is a bug in the provider, which should be reported in the provider's own issue tracker. Error: Provider produced inconsistent result after apply ...allowed_to_unprotect: length changed from 0 to 1. ``` ## Terraform Config The configuration being applied: ```terraform resource "gitlab_branch_protection" "branch" { project = 83923062 branch = "main" code_owner_approval_required = false allowed_to_merge = [{ access_level = "maintainer" }] allowed_to_push = [{ access_level = "no one" }] allowed_to_unprotect = [] } ``` ## Root Cause (suspected) As identified by [@PatrickRice](https://gitlab.com/PatrickRice): because `allowed_to_unprotect` is empty, it is likely not being sent to the API, causing the GitLab API to apply its default value of `maintainer`. The provider then reads back the actual state (which now includes the maintainer entry) and detects a drift from the planned empty set. ## Steps to Reproduce 1. Define a `gitlab_branch_protection` resource with `allowed_to_unprotect = []` 2. Run `terraform apply` 3. Observe the "Provider produced inconsistent result after apply" error ## Expected Behavior Setting `allowed_to_unprotect = []` should result in no unprotect access levels being set, and the provider should explicitly send an empty value to the API rather than omitting the field. ## Actual Behavior The API defaults `allowed_to_unprotect` to `[{ access_level = "maintainer" }]`, causing a plan/apply inconsistency. ## References - [infra-mgmt!2988](https://gitlab.com/gitlab-com/gl-infra/infra-mgmt/-/merge_requests/2988#note_3577659102) - original discussion between [@pguinoiseau](https://gitlab.com/pguinoiseau) and [@PatrickRice](https://gitlab.com/PatrickRice) - [branch.tf in terraform-modules/gitlab/project](https://gitlab.com/gitlab-com/gl-infra/terraform-modules/gitlab/project/-/blob/main/branch.tf) ## Implementation Plan All changes are in `internal/provider/resource_gitlab_branch_protection.go` and `internal/provider/resource_gitlab_branch_protection_test.go`. ### Root cause (confirmed by code review) The GitLab API silently injects default access level entries when `allowed_to_push`, `allowed_to_merge`, or `allowed_to_unprotect` are empty on `POST /projects/:id/protected_branches`. The provider passes an empty options slice for each, so the API applies its defaults. The `waitForProtectedBranchAsync` poller then short-circuits for all three when `want == 0`: ```go // existing (buggy) logic pushSettled := wantPush == 0 || gotPush == wantPush mergeSettled := wantMerge == 0 || gotMerge == wantMerge unprotectSettled := wantUnprotect == 0 || gotUnprotect == wantUnprotect ``` This causes the poller to return immediately with the API-injected defaults still present. `protectedBranchToStateModel` then reads those entries back into state, producing a mismatch against the planned empty set. The `Computed: true` schema attribute does **not** absorb this drift when the user has explicitly configured `= []` in their config — Terraform knows the planned value is a known empty set and enforces it. The same "provider produced inconsistent result after apply" error therefore affects all three fields when set to `[]`, not just `allowed_to_unprotect`. ### Changes required **1. Fix `waitForProtectedBranchAsync` — remove the `want == 0` short-circuit for all three fields** The poller must always wait for `got == want`, including when `want == 0`. The existing short-circuit was masking the bug: ```go // After pushSettled := gotPush == wantPush mergeSettled := gotMerge == wantMerge unprotectSettled := gotUnprotect == wantUnprotect ``` **2. Add a post-create/post-update cleanup to remove API-injected defaults** When the plan specifies 0 entries for any of the three fields but the API returned non-zero entries, issue an explicit `UpdateProtectedBranch` call that marks each injected entry with `Destroy: true`. Extract this into a single generalized helper called from both `Create` and `Update` when `isEE`: ```go // removeAPIInjectedDefaults issues an UpdateProtectedBranch call to destroy any // access-level entries that the GitLab API injected as defaults but were not // requested in the plan (i.e. the plan wanted 0 entries but the API returned some). func (r *gitlabBranchProtectionResource) removeAPIInjectedDefaults( ctx context.Context, projectID, branch string, pb *gitlab.ProtectedBranch, wantPush, wantMerge, wantUnprotect int, ) (*gitlab.ProtectedBranch, error) { var pushDestroy, mergeDestroy, unprotectDestroy []*gitlab.BranchPermissionOptions if wantPush == 0 { for _, e := range pb.PushAccessLevels { id := e.ID pushDestroy = append(pushDestroy, &gitlab.BranchPermissionOptions{ID: &id, Destroy: gitlab.Ptr(true)}) } } if wantMerge == 0 { for _, e := range pb.MergeAccessLevels { id := e.ID mergeDestroy = append(mergeDestroy, &gitlab.BranchPermissionOptions{ID: &id, Destroy: gitlab.Ptr(true)}) } } if wantUnprotect == 0 { for _, e := range pb.UnprotectAccessLevels { id := e.ID unprotectDestroy = append(unprotectDestroy, &gitlab.BranchPermissionOptions{ID: &id, Destroy: gitlab.Ptr(true)}) } } if len(pushDestroy) == 0 && len(mergeDestroy) == 0 && len(unprotectDestroy) == 0 { return pb, nil // nothing to clean up } updated, _, err := r.client.ProtectedBranches.UpdateProtectedBranch( projectID, branch, &gitlab.UpdateProtectedBranchOptions{ Name: gitlab.Ptr(branch), AllowedToPush: &pushDestroy, AllowedToMerge: &mergeDestroy, AllowedToUnprotect: &unprotectDestroy, }, gitlab.WithContext(ctx), ) return updated, err } ``` Call this in `Create` and `Update` after the async wait, when `isEE`, passing the `want*` counts from the plan. **3. Add acceptance tests for all three fields set to `[]`** Add test steps in `resource_gitlab_branch_protection_test.go` covering: - `allowed_to_unprotect = []` — the originally reported case - `allowed_to_push = []` - `allowed_to_merge = []` - All three set to `[]` simultaneously Each step should verify no plan diff after apply and that the state reflects an empty set. ### Files to change | File | Change | |------|--------| | `internal/provider/resource_gitlab_branch_protection.go` | Fix `waitForProtectedBranchAsync` short-circuit; add `removeAPIInjectedDefaults` helper; call it from `Create` and `Update` | | `internal/provider/resource_gitlab_branch_protection_test.go` | Add acceptance tests for each field set to `[]` |