Support creating project in group without default branch protection

internal/provider/resource_gitlab_group.go

@@ -208,7 +208,9 @@ func resourceGitlabGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 		options.ParentID = gitlab.Int(v.(int))
 	}
 
-	if v, ok := d.GetOk("default_branch_protection"); ok {
+	// nolint:staticcheck // SA1019 ignore deprecated GetOkExists
+	// lintignore: XR001 // TODO: replace with alternative for GetOkExists
+	if v, ok := d.GetOkExists("default_branch_protection"); ok {
 		options.DefaultBranchProtection = gitlab.Int(v.(int))
 	}
 

internal/provider/resource_gitlab_group_test.go

@@ -41,7 +41,7 @@ func TestAccGitlabGroup_basic(t *testing.T) {
 			},
 			// Update the group to change the description
 			{
-				Config: testAccGitlabGroupUpdateConfig(rInt),
+				Config: testAccGitlabGroupUpdateConfig(rInt, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGitlabGroupExists("gitlab_group.foo", &group),
 					testAccCheckGitlabGroupAttributes(&group, &testAccGitlabGroupExpectedAttributes{
@@ -63,6 +63,30 @@ func TestAccGitlabGroup_basic(t *testing.T) {
 					}),
 				),
 			},
+			// Update the group to use zero-value `default_branch_protection`
+			{
+				Config: testAccGitlabGroupUpdateConfig(rInt, 0),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGitlabGroupExists("gitlab_group.foo", &group),
+					testAccCheckGitlabGroupAttributes(&group, &testAccGitlabGroupExpectedAttributes{
+						Name:                    fmt.Sprintf("bar-name-%d", rInt),
+						Path:                    fmt.Sprintf("bar-path-%d", rInt),
+						Description:             "Terraform acceptance tests! Updated description",
+						LFSEnabled:              false,
+						Visibility:              "public", // default value
+						RequestAccessEnabled:    true,
+						ProjectCreationLevel:    "developer",
+						SubGroupCreationLevel:   "maintainer",
+						RequireTwoFactorAuth:    true,
+						TwoFactorGracePeriod:    56,
+						AutoDevopsEnabled:       true,
+						EmailsDisabled:          true,
+						MentionsDisabled:        true,
+						ShareWithGroupLock:      true,
+						DefaultBranchProtection: 0,
+					}),
+				),
+			},
 			// Update the group to put the name and description back
 			{
 				Config: testAccGitlabGroupConfig(rInt),
@@ -398,7 +422,7 @@ resource "gitlab_group" "foo" {
   `, rInt, rInt)
 }
 
-func testAccGitlabGroupUpdateConfig(rInt int) string {
+func testAccGitlabGroupUpdateConfig(rInt int, defaultBranchProtection int) string {
 	return fmt.Sprintf(`
 resource "gitlab_group" "foo" {
   name = "bar-name-%d"
@@ -414,13 +438,13 @@ resource "gitlab_group" "foo" {
   emails_disabled = true
   mentions_disabled = true
   share_with_group_lock = true
-  default_branch_protection = 1
+  default_branch_protection = %d
 
   # So that acceptance tests can be run in a gitlab organization
   # with no billing
   visibility_level = "public"
 }
-  `, rInt, rInt)
+  `, rInt, rInt, defaultBranchProtection)
 }
 
 func testAccGitlabNestedGroupConfig(rInt int) string {

internal/provider/resource_gitlab_project.go

@@ -599,10 +599,19 @@ func resourceGitlabProjectCreate(ctx context.Context, d *schema.ResourceData, me
 			return diag.Errorf("Failed to protect default branch %q for project %q: %s", newDefaultBranch, d.Id(), err)
 		}
 
-		log.Printf("[DEBUG] unprotect old default branch %q for project %q", oldDefaultBranch, d.Id())
-		_, err = client.ProtectedBranches.UnprotectRepositoryBranches(project.ID, oldDefaultBranch, gitlab.WithContext(ctx))
-		if err != nil {
-			return diag.Errorf("Failed to unprotect undesired default branch %q for project %q: %s", oldDefaultBranch, d.Id(), err)
+		log.Printf("[DEBUG] check for protection on old default branch %q for project %q", oldDefaultBranch, d.Id())
+		branch, _, err := client.ProtectedBranches.GetProtectedBranch(project.ID, oldDefaultBranch, gitlab.WithContext(ctx))
+		if err != nil && !is404(err) {
+			return diag.Errorf("Failed to check for protected default branch %q for project %q: %v", oldDefaultBranch, d.Id(), err)
+		}
+		if branch == nil {
+			log.Printf("[DEBUG] Default protected branch %q for project %q does not exist", oldDefaultBranch, d.Id())
+		} else {
+			log.Printf("[DEBUG] unprotect old default branch %q for project %q", oldDefaultBranch, d.Id())
+			_, err = client.ProtectedBranches.UnprotectRepositoryBranches(project.ID, oldDefaultBranch, gitlab.WithContext(ctx))
+			if err != nil {
+				return diag.Errorf("Failed to unprotect undesired default branch %q for project %q: %v", oldDefaultBranch, d.Id(), err)
+			}
 		}
 
 		log.Printf("[DEBUG] delete old default branch %q for project %q", oldDefaultBranch, d.Id())

internal/provider/resource_gitlab_project_test.go

@@ -411,6 +411,23 @@ member_check = false
 	})
 }
 
+func TestAccGitlabProject_groupWithoutDefaultBranchProtection(t *testing.T) {
+	var project gitlab.Project
+	rInt := acctest.RandInt()
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: providerFactories,
+		CheckDestroy:      testAccCheckGitlabProjectDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGitlabProjectConfigWithoutDefaultBranchProtection(rInt),
+				Check:  testAccCheckGitlabProjectExists("gitlab_project.foo", &project),
+			},
+		},
+	})
+}
+
 func TestAccGitlabProject_IssueMergeRequestTemplates(t *testing.T) {
 	var project gitlab.Project
 	rInt := acctest.RandInt()
@@ -1075,6 +1092,23 @@ resource "gitlab_project" "foo" {
 	`, rInt, rInt, rInt)
 }
 
+func testAccGitlabProjectConfigWithoutDefaultBranchProtection(rInt int) string {
+	return fmt.Sprintf(`
+resource "gitlab_group" "foo" {
+  name = "foogroup-%d"
+  path = "foogroup-%d"
+  default_branch_protection = 0
+  visibility_level = "public"
+}
+
+resource "gitlab_project" "foo" {
+  name = "foo-%d"
+  description = "Terraform acceptance tests"
+  namespace_id = "${gitlab_group.foo.id}"
+}
+	`, rInt, rInt, rInt)
+}
+
 func testAccGitlabProjectTransferBetweenGroups(rInt int) string {
 	return fmt.Sprintf(`
 resource "gitlab_group" "foo" {