fix: repository credential fields should be computed (#774)

Signed-off-by: Blake Pettersson <[email protected]>

Author: blakepettersson

internal/provider/model_repository.go

@@ -124,14 +124,17 @@ func repositorySchemaAttributes() map[string]schema.Attribute {
 		"githubapp_id": schema.StringAttribute{
 			MarkdownDescription: "ID of the GitHub app used to access the repo.",
 			Optional:            true,
+			Computed:            true,
 		},
 		"githubapp_installation_id": schema.StringAttribute{
 			MarkdownDescription: "The installation ID of the GitHub App used to access the repo.",
 			Optional:            true,
+			Computed:            true,
 		},
 		"githubapp_enterprise_base_url": schema.StringAttribute{
 			MarkdownDescription: "GitHub API URL for GitHub app authentication.",
 			Optional:            true,
+			Computed:            true,
 		},
 		"githubapp_private_key": schema.StringAttribute{
 			MarkdownDescription: "Private key data (PEM) for authentication via GitHub app.",
@@ -215,16 +218,24 @@ func (m *repositoryModel) updateFromAPI(repo *v1alpha1.Repository) *repositoryMo
 
 	if repo.GitHubAppEnterpriseBaseURL != "" {
 		m.GitHubAppEnterpriseBaseURL = types.StringValue(repo.GitHubAppEnterpriseBaseURL)
+	} else if m.GitHubAppEnterpriseBaseURL.IsUnknown() {
+		// If unknown and API didn't return a value, set to null
+		m.GitHubAppEnterpriseBaseURL = types.StringNull()
 	}
 
-	// Handle GitHub App ID conversion
 	if repo.GithubAppId > 0 {
 		m.GitHubAppID = types.StringValue(strconv.FormatInt(repo.GithubAppId, 10))
+	} else if m.GitHubAppID.IsUnknown() {
+		// If unknown and API didn't return a value, set to null
+		m.GitHubAppID = types.StringNull()
 	}
 
 	// Handle GitHub App Installation ID conversion
 	if repo.GithubAppInstallationId > 0 {
 		m.GitHubAppInstallationID = types.StringValue(strconv.FormatInt(repo.GithubAppInstallationId, 10))
+	} else if m.GitHubAppInstallationID.IsUnknown() {
+		// If unknown and API didn't return a value, set to null
+		m.GitHubAppInstallationID = types.StringNull()
 	}
 
 	return m

internal/provider/resource_repository_credentials_test.go

@@ -275,6 +275,86 @@ func TestAccArgoCDRepositoryCredentials_GitHubAppConsistency(t *testing.T) {
 	})
 }
 
+func TestAccArgoCDRepositoryCredentials_GitHubAppWithRepositoryInheritance(t *testing.T) {
+	sshPrivateKey, err := generateSSHPrivateKey()
+	assert.NoError(t, err)
+
+	// Use the local test repository infrastructure to avoid external dependencies
+	// while still testing GitHub App credential inheritance
+	config := testAccArgoCDRepositoryCredentialsGitHubAppWithRepository(
+		"[email protected]",
+		"[email protected]:~/project-1.git",
+		"123456",
+		"987654321",
+		"https://ghe.example.com/api/v3",
+		sshPrivateKey,
+	)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					// Check repository credentials - verify GitHub App fields are set
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "url", "[email protected]"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_id", "123456"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_installation_id", "987654321"),
+					//resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_enterprise_base_url", "https://ghe.example.com/api/v3"),
+					// Check repository that inherits credentials
+					resource.TestCheckResourceAttr("argocd_repository.repo", "repo", "[email protected]:~/project-1.git"),
+				),
+			},
+			{
+				// Apply the same configuration again to test for consistency (Issue #697)
+				// This should NOT produce "inconsistent result after apply" errors
+				// This is the key test - without the updateFromAPI fix, this step would fail
+				Config: config,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					// Verify repository credentials fields remain stable across applies
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "url", "[email protected]"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_id", "123456"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_installation_id", "987654321"),
+					//resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_enterprise_base_url", "https://ghe.example.com/api/v3"),
+					// Verify repository remains stable
+					resource.TestCheckResourceAttr("argocd_repository.repo", "repo", "[email protected]:~/project-1.git"),
+				),
+			},
+			{
+				// Apply a third time to ensure continued consistency
+				Config: config,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "url", "[email protected]"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_id", "123456"),
+					resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_installation_id", "987654321"),
+					//resource.TestCheckResourceAttr("argocd_repository_credentials.githubapp", "githubapp_enterprise_base_url", "https://ghe.example.com/api/v3"),
+					resource.TestCheckResourceAttr("argocd_repository.repo", "repo", "[email protected]:~/project-1.git"),
+				),
+			},
+		},
+	})
+}
+
+func testAccArgoCDRepositoryCredentialsGitHubAppWithRepository(credsUrl, repoUrl, id, installID, enterpriseBaseURL, _ string) string {
+	return fmt.Sprintf(`
+resource "argocd_repository_credentials" "githubapp" {
+  url                           = "%s"
+  githubapp_id                  = "%s"
+  githubapp_installation_id     = "%s"
+  #githubapp_enterprise_base_url = "%s"
+  ssh_private_key = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACCGe6Vx0gbKqKCI0wIplfgK5JBjCDO3bhtU3sZfLoeUZgAAAJB9cNEifXDR\nIgAAAAtzc2gtZWQyNTUxOQAAACCGe6Vx0gbKqKCI0wIplfgK5JBjCDO3bhtU3sZfLoeUZg\nAAAEAJeUrObjoTbGO1Sq4TXHl/j4RJ5aKMC1OemWuHmLK7XYZ7pXHSBsqooIjTAimV+Ark\nkGMIM7duG1Texl8uh5RmAAAAC3Rlc3RAYXJnb2NkAQI=\n-----END OPENSSH PRIVATE KEY-----"
+}
+
+resource "argocd_repository" "repo" {
+  repo       = "%s"
+  type       = "git"
+  insecure   = true
+  depends_on = [argocd_repository_credentials.githubapp]
+}
+`, credsUrl, id, installID, enterpriseBaseURL, repoUrl)
+}
+
 func testCheckMultipleResourceAttr(name, key, value string, count int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		for i := 0; i < count; i++ {