Bug: Changing .visibility for resource "forgejo_organization" fails

[Gregor-zbjk]

opentofu error message:

penTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # forgejo_organization.actions will be updated in-place
  ~ resource "forgejo_organization" "actions" {
      ~ avatar_url                    = "https://git.zobjak.de/avatars/985911f331ea9a83c08df155ebf3ad9ca3cec660845b38bfdfed87de3a61d57b" -> (known after apply)
        id                            = 4
        name                          = "actions"
      ~ visibility                    = "private" -> "public"
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  OpenTofu will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

forgejo_organization.actions: Modifying... [name=actions]
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to forgejo_organization.actions, provider "provider[\"registry.opentofu.org/svalabs/forgejo\"].gregor_zbjk" produced an
│ unexpected new value: .visibility: was cty.StringVal("public"), but now cty.StringVal("private").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

[acch]

Hi @Gregor-zbjk - thanks for your interest in the provider, and many thanks for filing this issue!

This does look like a bug indeed, I'll check if I can reproduce the issue to investigate further...

[acch]

OK, I can reproduce the issue. Changing org visibility from private to public fails, but creating an org with public and then switching to private works fine:

Original visibility	New visibility	Result
private	limited	✅
private	public	❌
limited	private	✅
limited	public	❌
public	limited	✅
public	private	✅

So in other words, switching from either private or limited to public fails, while all other combinations work fine. That's interesting indeed - looks like the Forgejo server has some additional logic for these visibility changes. Interestingly, switching visibility through the UI works just fine with any combination...

Which version of Forgejo are you using?

[acch]

As I'm unable to find any documentation in Forgejo on the observed behavior, I'm treating this as a bug in the Forgejo API server. We would need to open an issue, or identify an existing one, in order to track progress towards resolution...

[kad-hollac1]

Since it happens when changing to the default, I suspect [0] is the culprit. Compare to [1].

[0] https://codeberg.org/forgejo/forgejo/src/branch/forgejo/routers/api/v1/org/org.go#L416
[1] https://codeberg.org/forgejo/forgejo/src/branch/forgejo/routers/web/org/setting.go#L127

[acch]

Thanks much for your analysis @kad-hollac1! That reinforces my belief that we would need to file an issue with Forgejo: "Changing org visibility to default value fails via API, but succeeds via web"...