<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/engineering/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=40916776&issueIid=6895) - [Collaborate/take over this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=40916776&issueIid=6895) </details> <!--IssueSummary end--> ## Bug Report `gitlab_project` creation (with `initialize_with_readme = true`) always fails after the 10 min create timeout: ``` Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded ``` The project is created, but the resource is marked **tainted**. The next apply destroys and recreates it. On gitlab.com the destroyed project is renamed to `<path>-deletion_scheduled-<id>` and kept, so every retry burns a project; for us this also breaks follow-up automation keyed to the project path. In 3 days we accumulated 28 `-deletion_scheduled-` projects (7 consecutive failed applies × 4 projects). Only workaround today: `tofu untaint` each project after the failure, then re-apply. ## Root cause (as far as we can tell) `expectDefaultBranchProtection()` in `internal/provider/sdk/resource_gitlab_project.go` (v19.3.0, around L2096) decides whether to wait based on the **deprecated** integer field: ```go return group.DefaultBranchProtection != 0, nil ``` The parent group was created by `gitlab_group` with a `default_branch_protection_defaults {}` block where `allowed_to_push` / `allowed_to_merge` end up as empty lists. For that group the Groups API returns contradictory data: ```json "default_branch_protection": 2, "default_branch_protection_defaults": { "allowed_to_push": [], "allow_force_push": false, "allowed_to_merge": [], "developer_can_initial_push": false, "code_owner_approval_required": false } ``` GitLab honours `default_branch_protection_defaults` → the new project's `main` is **not** protected (`GET /projects/:id/repository/branches/main` → `"protected": false`, `GET /projects/:id/protected_branches` → `[]`). The provider trusts the legacy `2` → waits for protection that never comes → timeout → taint. Sibling group with non-empty defaults (`allowed_to_push/merge: [{access_level: 40}]`) works fine: projects get `main` protected and create succeeds. Related: #6304 (same symptom, closed 2024-05 when `default_branch_protection_defaults` was added to `gitlab_group`, but the wait check in `gitlab_project` still reads the deprecated field). ## Steps to reproduce ```hcl resource "gitlab_group" "g" { name = "repro" path = "repro" parent_id = <parent> default_branch_protection_defaults {} # or allowed_to_push = [], allowed_to_merge = [] } resource "gitlab_project" "p" { name = "repro" namespace_id = gitlab_group.g.id initialize_with_readme = true default_branch = "main" } ``` `tofu apply` → `gitlab_project.p` hangs 10 min, fails with the error above, is tainted. Re-apply → destroy + recreate → same error. ## Expected behaviour Provider should not wait when the group's effective default-branch protection is "not protected", i.e. evaluate `default_branch_protection_defaults` (e.g. no push/merge access levels ⇒ no protection) instead of / in addition to the deprecated `default_branch_protection`. Alternatively the timeout should not leave the resource tainted when the project itself was created successfully. Possibly also a GitLab API issue: `default_branch_protection` should not report `2` when the effective defaults produce no protection. ## Additional details - GitLab Terraform Provider version: `19.3.0` (`registry.opentofu.org/gitlabhq/gitlab`) - OpenTofu: `1.12.1` (image `registry.gitlab.com/components/opentofu/gitlab-opentofu:4.9.0-opentofu1.12.1-alpine`) - GitLab: gitlab.com (SaaS), top-level group `default_branch_protection: 4` - Auth: group access token with Owner role (gitlab.com, no instance-admin access) - `skip_wait_for_default_branch_protection` not set <details><summary>apply log excerpt (first creation + re-run after taint)</summary> ``` ### First creation (2026-09-28) module.projects["project-a"].gitlab_project.project: Creating... module.projects["project-c"].gitlab_project.project: Creating... module.projects["project-b"].gitlab_project.project: Creating... module.projects["project-d"].gitlab_project.project: Creating... │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-b"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-c"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-d"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-a"].gitlab_project.project, ### Re-run after taint (2026-09-30) module.projects["project-b"].gitlab_project.project: Destroying... [id=<id-b>] module.projects["project-a"].gitlab_project.project: Destroying... [id=<id-a>] module.projects["project-d"].gitlab_project.project: Destroying... [id=<id-d>] module.projects["project-c"].gitlab_project.project: Destroying... [id=<id-c>] module.projects["project-c"].gitlab_project.project: Destruction complete after 6s module.projects["project-c"].gitlab_project.project: Creating... module.projects["project-d"].gitlab_project.project: Destruction complete after 6s module.projects["project-d"].gitlab_project.project: Creating... module.projects["project-b"].gitlab_project.project: Destruction complete after 6s module.projects["project-b"].gitlab_project.project: Creating... module.projects["project-a"].gitlab_project.project: Destruction complete after 12s module.projects["project-a"].gitlab_project.project: Creating... │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-d"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-b"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-a"].gitlab_project.project, │ Error: error while waiting for branch main to reach 'protected' status; current status is protected false, context deadline exceeded │ with module.projects["project-c"].gitlab_project.project, ``` </details> <details><summary>Groups API response for the parent group</summary> ```json { "id": <group-id>, "full_path": "my-org/parent-group/child-group", "created_at": "<timestamp>", "default_branch_protection": 2, "default_branch_protection_defaults": { "allowed_to_push": [], "allow_force_push": false, "allowed_to_merge": [], "developer_can_initial_push": false, "code_owner_approval_required": false } } ``` </details> <details><summary>Project + default branch after creation</summary> ```json { "id": <project-id>, "path_with_namespace": "my-org/parent-group/child-group/project-a", "created_at": "<timestamp>", "default_branch": "main", "empty_repo": false } { "name": "main", "protected": false, "default": true, "developers_can_push": false, "developers_can_merge": false } ``` </details>