fix: Import-safety fixes for managed group lookups and gitlab_branch - #11
Merged
Conversation
…keys managed_group_paths referenced keys(gitlab_group.parent_groups) and keys(gitlab_group.subgroups), which feeds into referenced_group_paths and therefore data.gitlab_group.referenced's for_each. Referencing a resource address there makes the for_each depend on that resource being planned first, which breaks operations that don't plan the whole graph up front -- notably terraform import, which fails with 'Invalid for_each argument: known only after apply' even though the underlying value never actually depends on anything computed. Compute the same key set (group.name, or parent/name for subgroups) directly from var.gitlab_groups instead, mirroring the gitlab_group.parent_groups/ subgroups for_each expressions without referencing those resources. Makes managed_group_paths a pure function of input variables, safe for import, plan, and apply alike. Verified via terraform console that referenced_group_ paths now resolves to a fully known set instead of known-after-apply.
ref is only populated in state at creation time; the provider has no way to
read it back for an existing branch. After import (or for a branch that has
since diverged from its original ref), state has ref unset while config
still declares it, and since ref is ForceNew, Terraform plans to destroy and
recreate the branch -- discarding its actual commit history. This is exactly
what the provider's own docs recommend guarding against.
Add lifecycle { ignore_changes = [ref] } to gitlab_branch.this.
wiseelf
requested review from
babychm,
chas0amx,
kushlychok,
perun-ai and
sirantd
July 7, 2026 08:07
kushlychok
approved these changes
Jul 7, 2026
github-actions Bot
pushed a commit
that referenced
this pull request
Jul 7, 2026
## [2.0.1](v2.0.0...v2.0.1) (2026-07-07) ### Bug Fixes * Import-safety fixes for managed group lookups and gitlab_branch ([#11](#11)) ([0e8291b](0e8291b))
|
This PR is included in version 2.0.1 🎉 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
local.managed_group_pathsreferencedkeys(gitlab_group.parent_groups)/keys(gitlab_group.subgroups), which madedata.gitlab_group.referenced'sfor_eachdepend on those resources being planned first. That's fine forplan/apply(which plan the whole graph), but breaksterraform import, which fails withInvalid for_each argument: ... known only after applyeven though the underlying value is a pure function ofvar.gitlab_groups. Now computed directly fromvar.gitlab_groups, mirroring the same key expressions used by thegitlab_group.parent_groups/subgroupsresources, with zero resource references.gitlab_branch.thishad nolifecycle { ignore_changes = [ref] }. Per the provider's own docs,refis only populated in state at creation time and can't be read back for an existing branch — so importing a branch (or one that's diverged from its original ref) leavesrefunset in state while config still declares it, and sincerefisForceNew, the next plan destroys and recreates the branch, discarding its actual commit history.Both surfaced from the same live import attempt against a real branch (
dev/demo) that already has real commit history — recreating it would have wiped that history.Test plan
terraform validatepasses on the root moduleterraform consolesmoke test confirmsmanaged_group_paths/referenced_group_pathsnow resolve to fully known values (no(known after apply)) against syntheticvar.gitlab_groups/var.gitlab_projectsdatagitlab_branchdocs, which recommend this exactignore_changespattern for importsdev/mc-iris-demoimport end-to-end to confirm both thefor_eacherror and the destroy/recreate plan are gone