## Bug Report `gitlab_group_dependency_proxy` builds its `updateDependencyProxySettings` mutation with `fmt.Sprintf` and writes `identity` and `secret` between quotes in the query as they are, without escaping them: https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/blob/3204e99af4c265e77435206f2e6160ff2cc6566b/internal/provider/resource_gitlab_group_dependency_proxy.go#L304-318 The GraphQL parser decodes the query, so what happens depends on the characters in the value: - A backslash escape that is valid in a GraphQL string, such as `\"` or `\\`, is decoded. The secret `pa\"ss\\word` arrives as `pa"ss\word`, the apply succeeds, and the next plan shows no changes, because the secret is never read back. Pulls through the proxy would then authenticate to Docker Hub with a different secret from the configured one. - The same escape in `identity` changes the stored identity too, but the mutation returns the decoded identity, so the apply fails with "Provider produced inconsistent result after apply" after the setting was changed, and on create the resource is left tainted. - A lone `"`, or a `\` followed by a character that isn't a GraphQL escape, makes the query invalid. The parse error comes back in the `errors` of an HTTP 200 answer, which the resource doesn't read, so the apply fails with "Provider produced inconsistent result after apply" on `enabled` and `identity` instead of showing the parse error. ### Steps to reproduce 1. Apply the configuration below with provider `19.5.0`. 2. The secret the API receives is `pa"ss\word`, not the configured `pa\"ss\\word`. 3. Run `terraform plan`: no changes. I reproduced it with Terraform 1.13.4 against a stand-in for the GitLab API that parses, validates and executes each GraphQL request with graphql-core against GitLab's GraphQL schema, so no GitLab instance was involved, and I haven't sent such a query to one. GitLab parses with graphql-ruby, which follows the same string grammar. The other two cases above come from the same setup, with `identity = "some\\\\identity"` and with `secret = "pa\"ss"`. ### Current behaviour The value GitLab receives differs from the configured one, or the apply fails with an error that doesn't name the cause. ### Expected behaviour GitLab receives `identity` and `secret` exactly as configured, whatever characters they hold. ## Relevant Terraform Configuration The provider block points at the stand-in. ```hcl terraform { required_providers { gitlab = { source = "gitlabhq/gitlab" version = "19.5.0" } } } provider "gitlab" { base_url = "http://gitlab-stand-in:8080/api/v4" token = "dummy-token" early_auth_check = false } resource "gitlab_group_dependency_proxy" "example" { group = "1234" enabled = true identity = "someidentity" secret = "pa\\\"ss\\\\word" } ``` ## Relevant Terraform Command ```sh terraform apply ``` ## Relevant Log Output <details> <summary>The query 19.5.0 sends for each of the three values, and what the stand-in received after parsing it (the stand-in answers group 1234 as my-group and prints each query on one line):</summary> ```plaintext mutation { updateDependencyProxySettings(input: { groupPath: "my-group", enabled: true, identity: "someidentity", secret: "pa\"ss\\word" }){ errors dependencyProxySetting{ enabled, identity } } } received enabled=`True` groupPath=`my-group` identity=`someidentity` secret=`pa"ss\word` mutation { updateDependencyProxySettings(input: { groupPath: "my-group", enabled: true, identity: "some\\identity", secret: "somesecret" }){ errors dependencyProxySetting{ enabled, identity } } } received enabled=`True` groupPath=`my-group` identity=`some\identity` secret=`somesecret` mutation { updateDependencyProxySettings(input: { groupPath: "my-group", enabled: true, identity: "someidentity", secret: "pa"ss" }){ errors dependencyProxySetting{ enabled, identity } } } Syntax Error: Unterminated string. ``` </details> <details> <summary><code>terraform apply</code> with <code>identity = "some\\\\identity"</code>:</summary> ```plaintext Error: Provider produced inconsistent result after apply When applying changes to gitlab_group_dependency_proxy.example, provider "provider[\"registry.terraform.io/gitlabhq/gitlab\"]" produced an unexpected new value: .identity: was cty.StringVal("some\\\\identity"), but now cty.StringVal("some\\identity"). This is a bug in the provider, which should be reported in the provider's own issue tracker. ``` </details> ## Additional Details - GitLab Terraform Provider Version: every release since the resource was added in `17.11.0`; reproduced with `19.5.0` and with `main` at 3204e99af4c265e77435206f2e6160ff2cc6566b - GitLab Instance Version: not involved; a stand-in with GitLab's GraphQL schema as introspected from GitLab.com (19.5.0-pre) - Terraform Version: `1.13.4` - License Tier: any ## Possible fix Send the group path, `enabled`, `identity` and `secret` as GraphQL variables, typed as the mutation's input declares them, the way `gitlab_group_dependency_proxy_image_ttl_policy` already sends its own: ```graphql mutation($groupPath: ID!, $enabled: Boolean, $identity: String, $secret: String) { updateDependencyProxySettings(input: { groupPath: $groupPath, enabled: $enabled, identity: $identity, secret: $secret }) { errors dependencyProxySetting { enabled, identity } } } ``` I have a merge request ready for it, together with the fix for #6906 in the same resource.