unkinben
df118383da
Why: - The go-gitea/gitea provider's SDK (v0.25.1, already shipped in provider 0.8.1 on main) rejects a team permission of `none` on every EditTeam with "permission mode invalid"; it only accepts read/write/admin/owner client-side. The same check exists in the older 0.21.0 SDK, so the provider version is not the lever here. - The team module's `units` (server returns an unordered space-separated string that never matches the provider's comma-ordered default) and `repositories` (provider sorts state; `include_all_repositories` populates every repo) drift on representation alone, so every apply plans an in-place update for every team. - Each update calls EditTeam, which replays the stored `permission=none` kept by `ignore_changes` and fails, blocking apply for every non-owner team (docker/terraform/rpmbuild/puppet/pybuild/forgebot/agents) and the whole terraform-git apply, including the unkin-agent rollout. Change: - Add `units` and `repositories` to the team `ignore_changes` so provider representation churn no longer triggers an EditTeam call. - Preserve each team's current on-server permission and repository membership (no access change).
20 lines
778 B
Terraform
20 lines
778 B
Terraform
resource "gitea_team" "this" {
|
|
name = var.name
|
|
organisation = var.organisation
|
|
description = var.description
|
|
permission = var.permission
|
|
include_all_repositories = var.include_all_repositories
|
|
can_create_repos = var.can_create_repos
|
|
repositories = var.repositories
|
|
|
|
lifecycle {
|
|
# Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
|
|
ignore_changes = [permission, units, repositories]
|
|
}
|
|
}
|
|
|
|
resource "gitea_team_members" "this" {
|
|
team_id = gitea_team.this.id
|
|
members = toset(var.members)
|
|
}
|