fix(repository-webhook): preserve write-only config.secret

The webhook `secret` is supplied inside the `config` map but Forgejo,
like Gitea, treats it as write-only: it is accepted on create/update
but never returned by the API. The provider previously rebuilt `config`
wholesale from the API response in `from()`, dropping the `secret` key.
The planned `config` therefore differed from the applied `config`,
failing Terraform's post-apply consistency check with "Provider produced
inconsistent result after apply ... inconsistent values for sensitive
attribute".

Mirror the existing write-only handling (`authorization_header`,
`branch_filter`) by carrying known write-only config keys over from the
prior plan/state value when mapping the API response into state.

Author: trent-hord

CHANGELOG.md

@@ -1,3 +1,9 @@
+## Unreleased
+
+BUG FIXES:
+
+- `forgejo_repository_webhook`: Preserve write-only `config.secret` from configuration so managing the webhook secret no longer causes "Provider produced inconsistent result after apply"
+
 ## 1.5.2 (August 2, 2026)
 
 ENHANCEMENTS:

docs/resources/repository_webhook.md

@@ -40,6 +40,10 @@ resource "forgejo_repository_webhook" "example" {
   config = {
     "content_type" = "json"
     "url"          = "http://example.com/invoke"
+    # The "secret" key is write-only: Forgejo accepts it on create/update but
+    # never returns it. The provider preserves it from configuration so that
+    # managing it here does not cause "inconsistent result after apply" errors.
+    "secret" = "supersecret"
   }
 }
 

examples/resources/forgejo_repository_webhook/resource.tf

@@ -25,6 +25,10 @@ resource "forgejo_repository_webhook" "example" {
   config = {
     "content_type" = "json"
     "url"          = "http://example.com/invoke"
+    # The "secret" key is write-only: Forgejo accepts it on create/update but
+    # never returns it. The provider preserves it from configuration so that
+    # managing it here does not cause "inconsistent result after apply" errors.
+    "secret" = "supersecret"
   }
 }
 

internal/provider/repository_webhook_resource.go

@@ -53,6 +53,14 @@ type repositoryWebhookResourceModel struct {
 	UpdatedAt           types.String `tfsdk:"updated_at"`
 }
 
+// writeOnlyConfigKeys lists keys within the webhook "config" map that the
+// Forgejo API accepts on create/update but never returns in responses (a GET
+// on the hook only echoes back e.g. "url" and "content_type"). They must be
+// preserved from the prior plan/state value, otherwise the applied "config"
+// drops the key and Terraform fails its post-apply consistency check with
+// "provider produced an unexpected new value: .config".
+var writeOnlyConfigKeys = []string{"secret"}
+
 // from is a helper function to load an API struct into Terraform data model.
 func (m *repositoryWebhookResourceModel) from(h *forgejo.Hook, ctx context.Context) (diags diag.Diagnostics) {
 	if h == nil {
@@ -61,9 +69,29 @@ func (m *repositoryWebhookResourceModel) from(h *forgejo.Hook, ctx context.Conte
 
 	var d diag.Diagnostics
 
+	// The API response never includes write-only config keys (e.g. "secret"),
+	// so carry them over from the prior model value (the plan on create/update,
+	// the prior state on read) to keep the applied config consistent.
+	config := make(map[string]string, len(h.Config))
+	for k, v := range h.Config {
+		config[k] = v
+	}
+	if !m.Config.IsNull() && !m.Config.IsUnknown() {
+		var priorConfig map[string]string
+		d = m.Config.ElementsAs(ctx, &priorConfig, false)
+		diags.Append(d...)
+		for _, key := range writeOnlyConfigKeys {
+			if v, ok := priorConfig[key]; ok {
+				if _, present := config[key]; !present {
+					config[key] = v
+				}
+			}
+		}
+	}
+
 	m.WebhookID = types.Int64Value(h.ID)
 	m.Active = types.BoolValue(h.Active)
-	m.Config, d = types.MapValueFrom(ctx, types.StringType, h.Config)
+	m.Config, d = types.MapValueFrom(ctx, types.StringType, config)
 	diags.Append(d...)
 	m.CreatedAt = types.StringValue(h.Created.Format(time.RFC3339))
 	m.Events, d = types.SetValueFrom(ctx, types.StringType, h.Events)

internal/provider/repository_webhook_resource_test.go

@@ -118,6 +118,7 @@ resource "forgejo_repository_webhook" "test" {
     config = {
         "content_type" = "json"
         "url"          = "http://example.com/abc12345"
+        "secret"       = "supersecret"
     }
     active               = true
     authorization_header = "Bearer token123456"
@@ -140,6 +141,10 @@ resource "forgejo_repository_webhook" "test" {
 					statecheck.ExpectKnownValue("forgejo_repository_webhook.test", tfjsonpath.New("events").AtSliceIndex(0), knownvalue.StringExact("push")),
 					statecheck.ExpectKnownValue("forgejo_repository_webhook.test", tfjsonpath.New("config").AtMapKey("content_type"), knownvalue.StringExact("json")),
 					statecheck.ExpectKnownValue("forgejo_repository_webhook.test", tfjsonpath.New("config").AtMapKey("url"), knownvalue.StringExact("http://example.com/abc12345")),
+					// The webhook secret is write-only: the API never returns it,
+					// so the provider must preserve it from the plan to keep the
+					// applied config consistent. See from() in the resource.
+					statecheck.ExpectKnownValue("forgejo_repository_webhook.test", tfjsonpath.New("config").AtMapKey("secret"), knownvalue.StringExact("supersecret")),
 				},
 			},
 			// Recreate and Read testing