BBD: Changing draft false->true with additional version_spec changes causes provider bug

[grubmeshi]

Error: Provider produced inconsistent result after apply
  │ 
  │ When applying changes to
  │ meshstack_building_block_definition.aks_github_connector, provider
  │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
  │ unexpected new value: .version_latest_release.content_hash: was
  │ cty.StringVal("v1:d940439d5070619b20c4a0ae2edd1eaf71b44eae63b57e83f64316bc1c81740d"),
  │ but now
  │ cty.StringVal("v1:0a55e3e42232dff6ce76f57cad93b731c30a07f8d71be4d58c353b1ba7059167").
  │ 
  │ This is a bug in the provider, which should be reported in the provider's
  │ own issue tracker.

Note: Also reported to happen in import when changes are applied in the same step.

[grubmeshi]

Currently not reproducible.

[grubmeshi]

I think the main observation is that the content_hash of the actually released and thus immutable version change on PUT. Might be something really subtle such as ordering of set entries or null vs. empty collection. Or it's secret handling/hashing.

Reported by customer in BD-2427.

@malhussan encountered it with internal code as well: https://github.com/meshcloud/internal-cloudfoundation/blob/main/foundations/meshcloud-prod/platforms/aws/buildingblocks/dns/terragrunt.hcl

09:25:13.005 STDOUT tofu: Note: Objects have changed outside of OpenTofu
09:25:13.005 STDOUT tofu:
09:25:13.005 STDOUT tofu: OpenTofu detected the following changes made outside of OpenTofu since the
09:25:13.005 STDOUT tofu: last "tofu apply" which may have affected this plan:
09:25:13.005 STDOUT tofu:   # meshstack_building_block_definition.this has changed
09:25:13.005 STDOUT tofu:   ~ resource "meshstack_building_block_definition" "this" {
09:25:13.005 STDOUT tofu:       ~ version_latest         = {
09:25:13.005 STDOUT tofu:           ~ content_hash = "v1:50ee5f8e8f72d63e9de984dc876bb845229fba46bbb8855c1ab33bf95fd70acd" -> "v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"
09:25:13.005 STDOUT tofu:           ~ number       = 2 -> 7
09:25:13.005 STDOUT tofu:           ~ uuid         = "91c320ab-d2ec-4b92-8b68-a633951437f3" -> "2a5d041d-477c-4899-91e1-e26bb04b822b"
09:25:13.005 STDOUT tofu:             # (1 unchanged attribute hidden)
09:25:13.005 STDOUT tofu:         }
09:25:13.005 STDOUT tofu:       ~ version_latest_release = {
09:25:13.005 STDOUT tofu:           ~ content_hash = "v1:50ee5f8e8f72d63e9de984dc876bb845229fba46bbb8855c1ab33bf95fd70acd" -> "v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"
09:25:13.005 STDOUT tofu:           ~ number       = 2 -> 7
09:25:13.005 STDOUT tofu:           ~ uuid         = "91c320ab-d2ec-4b92-8b68-a633951437f3" -> "2a5d041d-477c-4899-91e1-e26bb04b822b"
09:25:13.005 STDOUT tofu:             # (1 unchanged attribute hidden)
09:25:13.005 STDOUT tofu:         }
09:25:13.005 STDOUT tofu:         # (5 unchanged attributes hidden)
09:25:13.005 STDOUT tofu:     }
09:25:13.005 STDOUT tofu: Unless you have made equivalent changes to your configuration, or ignored the
09:25:13.005 STDOUT tofu: relevant attributes using ignore_changes, the following plan may include
09:25:13.005 STDOUT tofu: actions to undo or respond to these changes.
09:25:13.005 STDOUT tofu:
09:25:13.005 STDOUT tofu: ─────────────────────────────────────────────────────────────────────────────
09:25:13.006 STDOUT tofu: OpenTofu used the selected providers to generate the following execution
09:25:13.006 STDOUT tofu: plan. Resource actions are indicated with the following symbols:
09:25:13.006 STDOUT tofu:   ~ update in-place (current -> planned)
09:25:13.006 STDOUT tofu: OpenTofu will perform the following actions:
09:25:13.006 STDOUT tofu:   # meshstack_building_block_definition.this will be updated in-place
09:25:13.006 STDOUT tofu:   ~ resource "meshstack_building_block_definition" "this" {
09:25:13.006 STDOUT tofu:       ~ spec                   = {
09:25:13.006 STDOUT tofu:           ~ symbol                    = "https://raw.githubusercontent.com/meshcloud/meshstack-hub/32698080a28bce13ba224334ad5bfbb2233236ae/modules/aws/route53-dns-record/buildingblock/logo.png" -> "https://raw.githubusercontent.com/meshcloud/meshstack-hub/ce07c0a83c58ab924fc4ab3e62907dde1a44edf3/modules/aws/route53-dns-record/buildingblock/logo.png"
09:25:13.006 STDOUT tofu:             # (9 unchanged attributes hidden)
09:25:13.006 STDOUT tofu:         }
09:25:13.006 STDOUT tofu:       ~ version_latest         = {
09:25:13.006 STDOUT tofu:           ~ content_hash = "v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1" -> "v1:e7341f272bec8cfd64bee5102871be079ed127c577a210a3a1b3bf1942727d72"
09:25:13.006 STDOUT tofu:           ~ number       = 7 -> 8
09:25:13.006 STDOUT tofu:           ~ state        = "RELEASED" -> "DRAFT"
09:25:13.006 STDOUT tofu:           ~ uuid         = "2a5d041d-477c-4899-91e1-e26bb04b822b" -> (known after apply)
09:25:13.006 STDOUT tofu:         }
09:25:13.006 STDOUT tofu:       ~ version_spec           = {
09:25:13.006 STDOUT tofu:           ~ draft                      = false -> true
09:25:13.006 STDOUT tofu:           ~ implementation             = {
09:25:13.006 STDOUT tofu:               ~ terraform = {
09:25:13.006 STDOUT tofu:                   ~ ref_name                       = "907eac2bb306d1e65eba034d93df1290eb699955" -> "ce07c0a83c58ab924fc4ab3e62907dde1a44edf3"
09:25:13.006 STDOUT tofu:                     # (5 unchanged attributes hidden)
09:25:13.007 STDOUT tofu:                 }
09:25:13.007 STDOUT tofu:             }
09:25:13.007 STDOUT tofu:           ~ inputs                     = {
09:25:13.007 STDOUT tofu:               ~ "record" = {
09:25:13.007 STDOUT tofu:                   ~ updateable_by_consumer = true -> false
09:25:13.007 STDOUT tofu:                     # (5 unchanged attributes hidden)
09:25:13.007 STDOUT tofu:                 },
09:25:13.007 STDOUT tofu:                 # (8 unchanged elements hidden)
09:25:13.007 STDOUT tofu:             }
09:25:13.007 STDOUT tofu:           ~ state                      = "RELEASED" -> "DRAFT"
09:25:13.007 STDOUT tofu:           ~ version_number             = 7 -> 8
09:25:13.007 STDOUT tofu:             # (6 unchanged attributes hidden)
09:25:13.007 STDOUT tofu:         }
09:25:13.007 STDOUT tofu:       ~ versions               = [
09:25:13.007 STDOUT tofu:           + {
09:25:13.007 STDOUT tofu:               + content_hash = "v1:e7341f272bec8cfd64bee5102871be079ed127c577a210a3a1b3bf1942727d72"
09:25:13.007 STDOUT tofu:               + number       = 8
09:25:13.007 STDOUT tofu:               + state        = "DRAFT"
09:25:13.007 STDOUT tofu:               + uuid         = (known after apply)
09:25:13.007 STDOUT tofu:             },
09:25:13.007 STDOUT tofu:             # (7 unchanged elements hidden)
09:25:13.007 STDOUT tofu:         ]
09:25:13.007 STDOUT tofu:         # (3 unchanged attributes hidden)
09:25:13.007 STDOUT tofu:     }
09:25:13.007 STDOUT tofu: Plan: 0 to add, 1 to change, 0 to destroy.
09:25:13.007 STDOUT tofu:
09:25:13.007 STDOUT tofu: Changes to Outputs:
09:25:13.007 STDOUT tofu:   ~ building_block_definition = {
09:25:13.007 STDOUT tofu:       ~ version_ref = {
09:25:13.007 STDOUT tofu:           ~ content_hash = "v1:50ee5f8e8f72d63e9de984dc876bb845229fba46bbb8855c1ab33bf95fd70acd" -> "v1:e7341f272bec8cfd64bee5102871be079ed127c577a210a3a1b3bf1942727d72"
09:25:13.007 STDOUT tofu:           ~ number       = 2 -> 8
09:25:13.007 STDOUT tofu:           ~ state        = "RELEASED" -> "DRAFT"
09:25:13.007 STDOUT tofu:           ~ uuid         = "91c320ab-d2ec-4b92-8b68-a633951437f3" -> (known after apply)
09:25:13.007 STDOUT tofu:         }
09:25:13.007 STDOUT tofu:         # (1 unchanged attribute hidden)
09:25:13.007 STDOUT tofu:     }
09:25:13.007 STDOUT tofu:
09:25:13.007 STDOUT tofu: Do you want to perform these actions?
09:25:13.007 STDOUT tofu:   OpenTofu will perform the actions described above.
09:25:13.007 STDOUT tofu:   Only 'yes' will be accepted to approve.
09:25:13.007 STDOUT tofu:   Enter a value:
yes
09:25:18.285 STDOUT tofu: meshstack_building_block_definition.this: Modifying...
09:25:18.811 STDERR tofu: ╷
09:25:18.811 STDERR tofu: │ Error: Provider produced inconsistent result after apply
09:25:18.812 STDERR tofu: │
09:25:18.812 STDERR tofu: │ When applying changes to meshstack_building_block_definition.this, provider
09:25:18.812 STDERR tofu: │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
09:25:18.812 STDERR tofu: │ unexpected new value: .version_latest_release.content_hash: was
09:25:18.812 STDERR tofu: │ cty.StringVal("v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"),
09:25:18.812 STDERR tofu: │ but now
09:25:18.812 STDERR tofu: │ cty.StringVal("v1:463bea4346d4bd7c5700d53081e9c47026262541e7a0a69ec9f32a05508fe99c").
09:25:18.812 STDERR tofu: │
09:25:18.812 STDERR tofu: │ This is a bug in the provider, which should be reported in the provider's
09:25:18.812 STDERR tofu: │ own issue tracker.
09:25:18.812 STDERR tofu: ╵
09:25:18.813 STDERR tofu: ╷
09:25:18.813 STDERR tofu: │ Error: Provider produced inconsistent result after apply
09:25:18.813 STDERR tofu: │
09:25:18.813 STDERR tofu: │ When applying changes to meshstack_building_block_definition.this, provider
09:25:18.813 STDERR tofu: │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
09:25:18.813 STDERR tofu: │ unexpected new value: .versions[6].content_hash: was
09:25:18.813 STDERR tofu: │ cty.StringVal("v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"),
09:25:18.813 STDERR tofu: │ but now
09:25:18.813 STDERR tofu: │ cty.StringVal("v1:463bea4346d4bd7c5700d53081e9c47026262541e7a0a69ec9f32a05508fe99c").
09:25:18.813 STDERR tofu: │
09:25:18.813 STDERR tofu: │ This is a bug in the provider, which should be reported in the provider's
09:25:18.813 STDERR tofu: │ own issue tracker.
09:25:18.814 STDERR tofu: ╵
09:25:18.880 ERROR  error occurred:

* Failed to execute "tofu apply" in ./.terragrunt-cache/UX-vaNdv_kc4pYrPBS2vM6NlU7U/iSx1lOB6E4BzUFMTYqngunlVpW4/modules/aws/route53-dns-record
  ╷
  │ Error: Provider produced inconsistent result after apply
  │
  │ When applying changes to meshstack_building_block_definition.this, provider
  │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
  │ unexpected new value: .version_latest_release.content_hash: was
  │ cty.StringVal("v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"),
  │ but now
  │ cty.StringVal("v1:463bea4346d4bd7c5700d53081e9c47026262541e7a0a69ec9f32a05508fe99c").
  │
  │ This is a bug in the provider, which should be reported in the provider's
  │ own issue tracker.
  ╵
  ╷
  │ Error: Provider produced inconsistent result after apply
  │
  │ When applying changes to meshstack_building_block_definition.this, provider
  │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
  │ unexpected new value: .versions[6].content_hash: was
  │ cty.StringVal("v1:a29a1a283a8eda054562c865606388290871fe766c1efeb1fe0f9b5a9c816ec1"),
  │ but now
  │ cty.StringVal("v1:463bea4346d4bd7c5700d53081e9c47026262541e7a0a69ec9f32a05508fe99c").
  │
  │ This is a bug in the provider, which should be reported in the provider's
  │ own issue tracker.
  ╵

  exit status 1

[malhussan]

also reported in https://support.meshcloud.io/agent/tickets/2465

[henryde]

Another example.

10:14:25.941 STDOUT tofu: meshstack_building_block_definition.aks_github_connector: Refreshing state...
10:14:26.175 STDOUT tofu: OpenTofu used the selected providers to generate the following execution
10:14:26.175 STDOUT tofu: plan. Resource actions are indicated with the following symbols:
10:14:26.175 STDOUT tofu:   ~ update in-place (current -> planned)
10:14:26.175 STDOUT tofu: OpenTofu will perform the following actions:
10:14:26.175 STDOUT tofu:   # meshstack_building_block_definition.aks_github_connector will be updated in-place
10:14:26.175 STDOUT tofu:   ~ resource "meshstack_building_block_definition" "aks_github_connector" {
10:14:26.176 STDOUT tofu:       ~ spec                   = {
10:14:26.176 STDOUT tofu:           ~ readme                    = <<-EOT
10:14:26.176 STDOUT tofu:             EOT
10:14:26.176 STDOUT tofu:           ~ symbol                    = "https://raw.githubusercontent.com/meshcloud/meshstack-hub/6e1db6139d2c4d53761a0dd3a8d25aa61b6406c7/modules/aks/github-connector/buildingblock/logo.png" -> "https://raw.githubusercontent.com/meshcloud/meshstack-hub/41e7bc0be341ac4b182bf4bcfd4615cd8fc559df/modules/aks/github-connector/buildingblock/logo.png"
10:14:26.176 STDOUT tofu:             # (7 unchanged attributes hidden)
10:14:26.176 STDOUT tofu:         }
10:14:26.176 STDOUT tofu:       ~ version_latest         = {
10:14:26.176 STDOUT tofu:           ~ content_hash = "v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c" -> (known after apply)
10:14:26.176 STDOUT tofu:           ~ number       = 3 -> 4
10:14:26.176 STDOUT tofu:           ~ state        = "RELEASED" -> "DRAFT"
10:14:26.176 STDOUT tofu:           ~ uuid         = "1c0a2b06-45c6-4a39-8f05-5cd1358c45fe" -> (known after apply)
10:14:26.176 STDOUT tofu:         }
10:14:26.176 STDOUT tofu:       ~ version_spec           = {
10:14:26.176 STDOUT tofu:           ~ draft                      = false -> true
10:14:26.176 STDOUT tofu:           ~ implementation             = {
10:14:26.176 STDOUT tofu:               ~ terraform = {
10:14:26.176 STDOUT tofu:                   ~ ref_name                       = "6e1db6139d2c4d53761a0dd3a8d25aa61b6406c7" -> "41e7bc0be341ac4b182bf4bcfd4615cd8fc559df"
10:14:26.176 STDOUT tofu:                     # (5 unchanged attributes hidden)
10:14:26.176 STDOUT tofu:                 }
10:14:26.176 STDOUT tofu:             }
10:14:26.176 STDOUT tofu:           ~ inputs                     = {
10:14:26.176 STDOUT tofu:               ~ "GITHUB_APP_PEM_FILE" = {
10:14:26.176 STDOUT tofu:                   ~ sensitive              = {
10:14:26.176 STDOUT tofu:                       ~ argument = {
10:14:26.176 STDOUT tofu:                           ~ secret_hash    = "sha256:8052b43d3374ebdf92824fdabfdbe5663c883fd5af1748329f442f5548c8cc8a" -> (known after apply)
10:14:26.176 STDOUT tofu:                           ~ secret_value   = (write-only attribute)
10:14:26.176 STDOUT tofu:                           ~ secret_version = "839e567b50f22d273dd5b565e56adc71bb360cbdf1c1dc5c0ab116068d710a4a" -> "5c24373d226cba43c281dcda4c13e94ea8f2819822ecd7cc337defc603f3984e"
10:14:26.177 STDOUT tofu:                         }
10:14:26.177 STDOUT tofu:                     }
10:14:26.177 STDOUT tofu:                     # (6 unchanged attributes hidden)
10:14:26.177 STDOUT tofu:                 },
10:14:26.177 STDOUT tofu:                 # (8 unchanged elements hidden)
10:14:26.177 STDOUT tofu:             }
10:14:26.177 STDOUT tofu:           ~ state                      = "RELEASED" -> "DRAFT"
10:14:26.177 STDOUT tofu:           ~ version_number             = 3 -> 4
10:14:26.177 STDOUT tofu:             # (6 unchanged attributes hidden)
10:14:26.177 STDOUT tofu:         }
10:14:26.177 STDOUT tofu:       ~ versions               = [
10:14:26.177 STDOUT tofu:           + {
10:14:26.177 STDOUT tofu:               + content_hash = (known after apply)
10:14:26.177 STDOUT tofu:               + number       = 4
10:14:26.177 STDOUT tofu:               + state        = "DRAFT"
10:14:26.177 STDOUT tofu:               + uuid         = (known after apply)
10:14:26.177 STDOUT tofu:             },
10:14:26.177 STDOUT tofu:             # (3 unchanged elements hidden)
10:14:26.177 STDOUT tofu:         ]
10:14:26.177 STDOUT tofu:         # (3 unchanged attributes hidden)
10:14:26.177 STDOUT tofu:     }
10:14:26.177 STDOUT tofu: Plan: 0 to add, 1 to change, 0 to destroy.
10:14:26.177 STDOUT tofu:
10:14:26.177 STDOUT tofu: Changes to Outputs:
10:14:26.177 STDOUT tofu:   ~ building_block_definition = {
10:14:26.177 STDOUT tofu:       ~ version_ref = {
10:14:26.177 STDOUT tofu:           ~ content_hash = "v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c" -> (known after apply)
10:14:26.177 STDOUT tofu:           ~ number       = 3 -> 4
10:14:26.177 STDOUT tofu:           ~ state        = "RELEASED" -> "DRAFT"
10:14:26.177 STDOUT tofu:           ~ uuid         = "1c0a2b06-45c6-4a39-8f05-5cd1358c45fe" -> (known after apply)
10:14:26.177 STDOUT tofu:         }
10:14:26.177 STDOUT tofu:         # (1 unchanged attribute hidden)
10:14:26.177 STDOUT tofu:     }
10:14:26.177 STDOUT tofu:
10:14:26.177 STDOUT tofu: Do you want to perform these actions?
10:14:26.177 STDOUT tofu:   OpenTofu will perform the actions described above.
10:14:26.177 STDOUT tofu:   Only 'yes' will be accepted to approve.
10:14:26.177 STDOUT tofu:   Enter a value:
yes
10:14:31.456 STDOUT tofu: meshstack_building_block_definition.aks_github_connector: Modifying...
10:14:31.870 STDERR tofu: ╷
10:14:31.870 STDERR tofu: │ Error: Provider produced inconsistent result after apply
10:14:31.870 STDERR tofu: │
10:14:31.870 STDERR tofu: │ When applying changes to
10:14:31.870 STDERR tofu: │ meshstack_building_block_definition.aks_github_connector, provider
10:14:31.870 STDERR tofu: │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
10:14:31.870 STDERR tofu: │ unexpected new value: .version_latest_release.content_hash: was
10:14:31.870 STDERR tofu: │ cty.StringVal("v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c"),
10:14:31.870 STDERR tofu: │ but now
10:14:31.870 STDERR tofu: │ cty.StringVal("v1:1064f3f13a252eb4feb46b8abecc53a912e1dba2c746111c086cd3ffb4add94a").
10:14:31.870 STDERR tofu: │
10:14:31.870 STDERR tofu: │ This is a bug in the provider, which should be reported in the provider's
10:14:31.870 STDERR tofu: │ own issue tracker.
10:14:31.870 STDERR tofu: ╵
10:14:31.870 STDERR tofu: ╷
10:14:31.870 STDERR tofu: │ Error: Provider produced inconsistent result after apply
10:14:31.870 STDERR tofu: │
10:14:31.870 STDERR tofu: │ When applying changes to
10:14:31.870 STDERR tofu: │ meshstack_building_block_definition.aks_github_connector, provider
10:14:31.870 STDERR tofu: │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
10:14:31.870 STDERR tofu: │ unexpected new value: .versions[2].content_hash: was
10:14:31.870 STDERR tofu: │ cty.StringVal("v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c"),
10:14:31.870 STDERR tofu: │ but now
10:14:31.870 STDERR tofu: │ cty.StringVal("v1:1064f3f13a252eb4feb46b8abecc53a912e1dba2c746111c086cd3ffb4add94a").
10:14:31.870 STDERR tofu: │
10:14:31.870 STDERR tofu: │ This is a bug in the provider, which should be reported in the provider's
10:14:31.870 STDERR tofu: │ own issue tracker.
10:14:31.870 STDERR tofu: ╵
10:14:31.951 INFO   TIP (debugging-docs): For help troubleshooting errors, visit https://docs.terragrunt.com/troubleshooting/debugging
10:14:31.951 ERROR  error occurred:

* Failed to execute "tofu apply" in ./.terragrunt-cache/9gqQz5hIJnPEJT1jUvAt12YA8Q4/iSx1lOB6E4BzUFMTYqngunlVpW4/modules/aks/github-connector
  ╷
  │ Error: Provider produced inconsistent result after apply
  │
  │ When applying changes to
  │ meshstack_building_block_definition.aks_github_connector, provider
  │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
  │ unexpected new value: .version_latest_release.content_hash: was
  │ cty.StringVal("v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c"),
  │ but now
  │ cty.StringVal("v1:1064f3f13a252eb4feb46b8abecc53a912e1dba2c746111c086cd3ffb4add94a").
  │
  │ This is a bug in the provider, which should be reported in the provider's
  │ own issue tracker.
  ╵
  ╷
  │ Error: Provider produced inconsistent result after apply
  │
  │ When applying changes to
  │ meshstack_building_block_definition.aks_github_connector, provider
  │ "provider[\"registry.opentofu.org/meshcloud/meshstack\"]" produced an
  │ unexpected new value: .versions[2].content_hash: was
  │ cty.StringVal("v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c"),
  │ but now
  │ cty.StringVal("v1:1064f3f13a252eb4feb46b8abecc53a912e1dba2c746111c086cd3ffb4add94a").
  │
  │ This is a bug in the provider, which should be reported in the provider's
  │ own issue tracker.
  ╵

  exit status 1

hdettmer@sbot⟫terragrunt apply                               (main) ~/trial-cloudfoundation/foundations/meshstack-trial/platforms/aks/idp/buildingblocks/connector
10:15:27.190 STDOUT tofu: ╷
10:15:27.190 STDOUT tofu: │ Warning: Provider development overrides are in effect
10:15:27.190 STDOUT tofu: │
10:15:27.190 STDOUT tofu: │ The following provider development overrides are set in the CLI
10:15:27.190 STDOUT tofu: │ configuration:
10:15:27.190 STDOUT tofu: │  - registry.terraform.io/meshcloud/meshstack in /home/hdettmer/.local/share/go/bin
10:15:27.190 STDOUT tofu: │  - meshcloud/meshstack in /home/hdettmer/.local/share/go/bin
10:15:27.190 STDOUT tofu: │
10:15:27.190 STDOUT tofu: │ The behavior may therefore not match any released version of the provider
10:15:27.190 STDOUT tofu: │ and applying changes may cause the state to become incompatible with
10:15:27.190 STDOUT tofu: │ published releases.
10:15:27.190 STDOUT tofu: ╵
10:15:27.951 STDOUT tofu: meshstack_building_block_definition.aks_github_connector: Refreshing state...
10:15:28.194 STDOUT tofu: Changes to Outputs:
10:15:28.194 STDOUT tofu:   ~ building_block_definition = {
10:15:28.194 STDOUT tofu:       ~ version_ref = {
10:15:28.194 STDOUT tofu:           ~ content_hash = "v1:4f2b15e85f07df1e737c465acaf948c12052d6e7547d148cc23675ebf6e0608c" -> "v1:f8ebf93dfb408ea44c6f4e8a48b27bffbcae3b781cc21be15bdcf1cdd21c72c2"
10:15:28.194 STDOUT tofu:           ~ number       = 3 -> 4
10:15:28.194 STDOUT tofu:           ~ state        = "RELEASED" -> "DRAFT"
10:15:28.194 STDOUT tofu:           ~ uuid         = "1c0a2b06-45c6-4a39-8f05-5cd1358c45fe" -> "db04c008-9828-4050-befe-848842b11968"
10:15:28.194 STDOUT tofu:         }
10:15:28.194 STDOUT tofu:         # (1 unchanged attribute hidden)
10:15:28.194 STDOUT tofu:     }
10:15:28.194 STDOUT tofu: You can apply this plan to save these new output values to the OpenTofu
10:15:28.194 STDOUT tofu: state, without changing any real infrastructure.
10:15:28.194 STDOUT tofu:
10:15:28.194 STDOUT tofu: Do you want to perform these actions?
10:15:28.194 STDOUT tofu:   OpenTofu will perform the actions described above.
10:15:28.194 STDOUT tofu:   Only 'yes' will be accepted to approve.
10:15:28.194 STDOUT tofu:   Enter a value:
10:15:48.092 STDOUT tofu: Interrupt received.
10:15:48.092 STDOUT tofu: Please wait for OpenTofu to exit or data loss may occur.
10:15:48.092 STDOUT tofu: Gracefully shutting down...
10:15:48.092 INFO   Interrupt signal received. Gracefully shutting down...
10:15:48.092 STDERR tofu: ╷
10:15:48.092 STDERR tofu: │ Error: error asking for approval: interrupted
10:15:48.092 STDERR tofu: │
10:15:48.092 STDERR tofu: │
10:15:48.092 STDERR tofu: ╵
10:15:48.168 INFO   TIP (debugging-docs): For help troubleshooting errors, visit https://docs.terragrunt.com/troubleshooting/debugging
10:15:48.168 ERROR  error occurred:

* Failed to execute "tofu apply" in ./.terragrunt-cache/9gqQz5hIJnPEJT1jUvAt12YA8Q4/iSx1lOB6E4BzUFMTYqngunlVpW4/modules/aks/github-connector
  ╷
  │ Error: error asking for approval: interrupted
  │
  │
  ╵

  exit status 1

[henryde]

content_hash is computed from two different version_spec shapes:

1. Plan/update path uses ToClientDto()
   Path: internal/provider/building_block_definition_resource_model.go
   It injects default runner_ref when missing:
   • if dto.RunnerRef == nil { dto.RunnerRef = getSharedBuildingBlockRunnerRef(...) }
2. Read/list path hashes raw API version.Spec
   Path: SetFromVersionClientDtos() in same file
   It does not inject that default before hashing.

versionContentHash() only normalizes:

• VersionNumber = nil
• State = nil
• BuildingBlockDefinitionRef = nil

It does not normalize runner_ref.
So semantically unchanged version can hash differently when one side has runner_ref = null/omitted and the other has explicit shared runner ref.

Where this bites:

• internal/provider/building_block_definition_resource.go around Update() non-draft guard (versionSpecDtoContentHash vs state.VersionLatest.ContentHash).

Short: hash logic is not fully canonical. Defaulted runner_ref is treated as content change.