resource/gitlab_project: Fix project creation when default branch protection is disabled on instance-level

Closes: #1127

Author: timofurrer

internal/provider/resource_gitlab_project.go

@@ -1084,7 +1084,7 @@ func resourceGitlabProjectCreate(ctx context.Context, d *schema.ResourceData, me
 	// disabled (`default_branch_protection = 0`) then we don't have to wait for one.
 	waitForDefaultBranchProtection, err := expectDefaultBranchProtection(ctx, client, project)
 	if err != nil {
-		return diag.Errorf("Failed to fetch group the project %d is owned by: %+v", project.ID, err)
+		return diag.Errorf("Failed to discover if branch protection is enabled by default or not for project %d: %+v", project.ID, err)
 	}
 
 	if waitForDefaultBranchProtection {
@@ -1766,6 +1766,7 @@ func namespaceOrPathChanged(ctx context.Context, d *schema.ResourceDiff, meta in
 }
 
 func expectDefaultBranchProtection(ctx context.Context, client *gitlab.Client, project *gitlab.Project) (bool, error) {
+	// If the project is part of a group it may have default branch protection disabled for its projects
 	if project.Namespace.Kind == "group" {
 		group, _, err := client.Groups.GetGroup(project.Namespace.ID, nil, gitlab.WithContext(ctx))
 		if err != nil {
@@ -1775,7 +1776,11 @@ func expectDefaultBranchProtection(ctx context.Context, client *gitlab.Client, p
 		return group.DefaultBranchProtection != 0, nil
 	}
 
-	// projects which are not assigned to a group can't have a "no branch protection" default,
-	// thus, we always expect a default branch protection.
-	return true, nil
+	// // If the project is not part of a group it may have default branch protection disabled because of the instance-wide application settings
+	settings, _, err := client.Settings.GetSettings(nil, gitlab.WithContext(ctx))
+	if err != nil {
+		return false, err
+	}
+
+	return settings.DefaultBranchProtection != 0, nil
 }

internal/provider/resource_gitlab_project_test.go

@@ -844,6 +844,13 @@ resource "gitlab_project" "foo" {
 					},
 				),
 			},
+			// Verify Import
+			{
+				ResourceName:            "gitlab_project.foo",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initialize_with_readme"},
+			},
 		},
 	})
 }
@@ -883,6 +890,99 @@ func TestAccGitlabProject_CreateProjectInUserNamespace(t *testing.T) {
 	})
 }
 
+func TestAccGitlabProject_InstanceBranchProtectionDisabled(t *testing.T) {
+	rInt := acctest.RandInt()
+
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories,
+		CheckDestroy:      testAccCheckGitlabProjectDestroy,
+		Steps: []resource.TestStep{
+			{
+				PreConfig: func() {
+					settings, _, err := testGitlabClient.Settings.GetSettings()
+					if err != nil {
+						t.Fatalf("failed to get settings: %v", err)
+					}
+					t.Cleanup(func() {
+						if _, _, err := testGitlabClient.Settings.UpdateSettings(&gitlab.UpdateSettingsOptions{DefaultBranchProtection: gitlab.Int(settings.DefaultBranchProtection)}); err != nil {
+							t.Fatalf("failed to update instance-wide default branch protection setting to default: %v", err)
+						}
+					})
+
+					if _, _, err := testGitlabClient.Settings.UpdateSettings(&gitlab.UpdateSettingsOptions{DefaultBranchProtection: gitlab.Int(0)}); err != nil {
+						t.Fatalf("failed to update instance-wide default branch protection setting: %v", err)
+					}
+				},
+				Config: ` `, // requires a space for empty config
+			},
+			// Without explicit default branch
+			{
+				Config: fmt.Sprintf(`
+					resource "gitlab_project" "foo" {
+						name                   = "foo-%d"
+						description            = "Terraform acceptance tests"
+						visibility_level       = "public"
+						initialize_with_readme = true
+					}
+				`, rInt),
+			},
+			// Verify Import
+			{
+				ResourceName:            "gitlab_project.foo",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initialize_with_readme"},
+			},
+			// Force a destroy for the project so that it can be recreated as the same resource
+			{
+				Config: ` `, // requires a space for empty config
+			},
+			// With explicit default branch set to instance-wide default
+			{
+				Config: fmt.Sprintf(`
+					resource "gitlab_project" "foo" {
+						name                   = "foo-%d"
+						description            = "Terraform acceptance tests"
+						visibility_level       = "public"
+						default_branch         = "main"
+						initialize_with_readme = true
+					}
+				`, rInt),
+			},
+			// Verify Import
+			{
+				ResourceName:            "gitlab_project.foo",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initialize_with_readme"},
+			},
+			// Force a destroy for the project so that it can be recreated as the same resource
+			{
+				Config: ` `, // requires a space for empty config
+			},
+			// With custom default branch
+			{
+				Config: fmt.Sprintf(`
+					resource "gitlab_project" "foo" {
+						name                   = "foo-%d-custom-default-branch"
+						description            = "Terraform acceptance tests"
+						visibility_level       = "public"
+						default_branch         = "foobar-non-default-branch"
+						initialize_with_readme = true
+					}
+				`, rInt),
+			},
+			// Verify Import
+			{
+				ResourceName:            "gitlab_project.foo",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"initialize_with_readme"},
+			},
+		},
+	})
+}
+
 type testAccGitlabProjectMirroredExpectedAttributes struct {
 	Mirror                           bool
 	MirrorTriggerBuilds              bool