gitlab_project_approval_rule modification completes but no changes are made

[Stromweld]

GitLab Provider version

3.11.1

GitLab version

Latest SaaS

Terraform version

1.0.5

Relevant Terraform Configuration

resource "gitlab_project" "example" {
  name        = "example"
  visibility_level = "private"
}

resource "gitlab_project_approval_rule" "example-one" {
  project            = 5
  name               = "Example Rule"
  approvals_required = 1
  user_ids           = [50, 500]
}

Relevant log output

Note: Objects have changed outside of Terraform
Terraform detected the following changes made outside of Terraform since the
last "terraform apply":
  # module.gitlab_project_example_1.gitlab_project_approval_rule.example has been changed
  ~ resource "gitlab_project_approval_rule" "example" {
      ~ group_ids            = [
          - <redacted>,
          - <redacted>,
        ]
        id                   = "<redacted>"
        name                 = "test1"
        # (4 unchanged attributes hidden)
    }
  # module.gitlab_project_example_2.gitlab_project_approval_rule.example has been changed
  ~ resource "gitlab_project_approval_rule" "example" {
      ~ group_ids            = [
          - <redacted>,
          - <redacted>,
        ]
        id                   = "<redacted>"
        name                 = "test2"
        # (4 unchanged attributes hidden)
    }
Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.
─────────────────────────────────────────────────────────────────────────────
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
Terraform will perform the following actions:
  # module.gitlab_project_example_1.gitlab_project_approval_rule.example will be updated in-place
  ~ resource "gitlab_project_approval_rule" "example" {
      ~ group_ids            = [
          + <redacted>,
          + <redacted>,
        ]
        id                   = "<redacted>"
        name                 = "test1"
        # (4 unchanged attributes hidden)
    }
  # module.gitlab_project_example_2.gitlab_project_approval_rule.example will be updated in-place
  ~ resource "gitlab_project_approval_rule" "approval_rule" {
      ~ group_ids            = [
          + <redacted>,
          + <redacted>,
        ]
        id                   = "<redacted>"
        name                 = "test2"
        # (4 unchanged attributes hidden)
    }
Plan: 0 to add, 2 to change, 0 to destroy.
module.gitlab_project_example_1.gitlab_project_approval_rule.example: Modifying... [id=<redacted>]
module.gitlab_project_example_2.gitlab_project_approval_rule.example: Modifying... [id=<redacted>]
module.gitlab_project_example_1.gitlab_project_approval_rule.example: Modifications complete after 1s [id=<redacted>]
module.gitlab_project_example_2.gitlab_project_approval_rule.example: Modifications complete after 0s [id=<redacted>]
Apply complete! Resources: 0 added, 2 changed, 0 destroyed.

Description

modify approval_rule resource to add group_ids = [<example_group_id_number_1>, <example_group_id_number_2>].

Run of plan should complete successfully and show rule in place modification to add the groups.

Apply will run successfully and log output shows modifications completed successfully.

Manual observation of the resource in Gitlab UI shows no change and subsequent plans and applys show modifications again.

Changes outside of Terraform show group_ids were removed.

[jtymes]

We've also been running into this problem. It may be related to this issue.

What is weird is that if I call to re-set the approval group directly with curl, it works. This has been my hacky workaround for the past couple months. I do wonder if it's worth investigating if there is something in the provider or go-gitlab that would cause this to not stick.

[Stromweld]

It could be related. The only users that have reporter permissions and that are in the group we are trying to add are only in there due to inheritance from parent group.

[github-actions[bot]]

Marking this issue as stale due to 120 days of inactivity. If this issue receives no comments in the next 30 days it will be closed. Maintainers can also remove the stale label.

Please comment with more information if you would like this issue to remain open.