fix: prevent inconsistent final plan for prevent_self_review in github_repository_environment

[kishaningithub]

Fixes an issue where Terraform reports "Provider produced inconsistent final plan" for the prevent_self_review attribute on github_repository_environment resources that have no reviewers configured.

Resolves a missed edge case in #1967

Problem

When an environment has no reviewers, the GitHub API does not return a required_reviewers protection rule. The read function only set prevent_self_review inside the case "required_reviewers" branch, so the attribute was never written to state—leaving it as null. Terraform's plan expected false (the schema default), causing the following mismatch:

Error: Provider produced inconsistent final plan .prevent_self_review: was cty.False, but now null.

Root Cause

1. prevent_self_review was only set in state when a required_reviewers protection rule existed in the API response.
2. pr.PreventSelfReview (a *bool) was passed directly to d.Set() without nil-checking, which could also store null in state.

Fix

• Set prevent_self_review to false before iterating protection rules, ensuring it always has a value in state.
• Safely dereference pr.PreventSelfReview with a nil guard, defaulting to false.

Testing

Environments without reviewers (the failing case) are already exercised by the create_with_id_separator_in_name and update_to_add_reviewers acceptance tests which create environments with no initial reviewers.

Pull request checklist

• Schema migrations have been created if needed (example)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

• Yes
• No

---

[github-actions]

👋 Hi, and thank you for this contribution!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions.

---

_{🤖 This is an automated message.}

[deiga]

Nice, thanks! Could you add a regression acceptance test case as well?

[Copilot]

Pull request overview

These provider review instructions are being used.

Fixes prevent_self_review state normalization when GitHub omits reviewer protection data.

Changes:

• Defaults prevent_self_review state to false.
• Safely handles a nil API value.

[kishaningithub]

@deiga Have added the test. Can you kindly review?

[kishaningithub]

@deiga Have resolved your PR review feedback. Can you kindly check once?

[deiga]

@kishaningithub I ran your test without any other code changes and the test doesn't fail. Can you please provide DEBUG level logs of the issue you are trying to resolve here?

[kishaningithub]

@deiga The issue was with the test

The original test did not reproduce the issue because it asserted the value immediately after creation. At that point, the schema default had already populated prevent_self_review = false, so the test passed even without the read-path fix.

The failing scenario is a refresh/read from imported or legacy state where prevent_self_review is absent and the GitHub API returns no required_reviewers protection rule.

I replaced the test with a read-path regression test that starts with the attribute absent from state and mocks that API response.

The corrected test fails without the production change and passes with it. I also removed prevent_self_review from ImportStateVerifyIgnore so the import test verifies this state value.

[deiga]

issue: no mocked tests inside TestAcc functions.

We need an acceptance test against the real API to verify the behaviour you mention.

[kishaningithub]

@deiga The code now much simpler. The acceptance test "import_without_reviewers" fails when the fix is not present

[kishaningithub]

@deiga This is the exact scenario.. I have a state which is like this

Result of terraform show (redacted)

resource "github_repository_environment" "repo_environment" {
    can_admins_bypass = true
    environment       = "dev_bot"
    id                = "example-repo:dev_bot"
    repository        = "example-repo"
    repository_id     = 123456789
    wait_timer        = 0

    reviewers {}
}

Result of terraform plan (redacted)

Then we have a plan run where prevent_self_review is being set explicitly

~ resource "github_repository_environment" "repo_environment" {
      id                  = "example-repo:dev_bot"
    + prevent_self_review = false
      # (5 unchanged attributes hidden)
    ~ reviewers {
        + teams = (known after apply)
      }
  }

Result of `terraform apply (redacted)

The apply fails with the below error

Error: Provider produced inconsistent final plan

When expanding the plan for
github_repository_environment.repo_environment["dev_bot"]
to include new values learned so far during apply, provider
"registry.terraform.io/integrations/github" produced an invalid new value for
.prevent_self_review: was cty.False, but now null.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

[kishaningithub]

@deiga Given the above context. Which route do you think i must take for the fix? Any suggestions?

[deiga]

@kishaningithub Please provide a testcase that reproduces your error-case and/or DEBUG level logs if the apply run