Add deletion_protection field to workflow resource (#12116) (#20106)

[upstream:bbe23795e1cb45ace6cfe630774af7d09fe57173]

Signed-off-by: Modular Magician <magic-modules@google.com>

.changelog/12116.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+workflows: added `deletion_protection` field to `google_workflows_workflow` resource
+```

google/services/workflows/resource_workflows_workflow.go

@@ -164,6 +164,17 @@ Modifying this field for an existing workflow results in a new workflow revision
 				Computed:    true,
 				Description: `The timestamp of when the workflow was last updated in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.`,
 			},
+			"deletion_protection": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Description: `Whether Terraform will be prevented from destroying the workflow. Defaults to true.
+When a'terraform destroy' or 'terraform apply' would delete the workflow,
+the command will fail if this field is not set to false in Terraform state.
+When the field is set to true or unset in Terraform state, a 'terraform apply'
+or 'terraform destroy' that would delete the workflow will fail.
+When the field is set to false, deleting the workflow is allowed.`,
+				Default: true,
+			},
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -352,6 +363,12 @@ func resourceWorkflowsWorkflowRead(d *schema.ResourceData, meta interface{}) err
 		return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("WorkflowsWorkflow %q", d.Id()))
 	}
 
+	// Explicitly set virtual fields to default values if unset
+	if _, ok := d.GetOkExists("deletion_protection"); !ok {
+		if err := d.Set("deletion_protection", true); err != nil {
+			return fmt.Errorf("Error setting deletion_protection: %s", err)
+		}
+	}
 	if err := d.Set("project", project); err != nil {
 		return fmt.Errorf("Error reading Workflow: %s", err)
 	}
@@ -573,6 +590,9 @@ func resourceWorkflowsWorkflowDelete(d *schema.ResourceData, meta interface{}) e
 	}
 
 	headers := make(http.Header)
+	if d.Get("deletion_protection").(bool) {
+		return fmt.Errorf("cannot destroy workflow without setting deletion_protection=false and running `terraform apply`")
+	}
 
 	log.Printf("[DEBUG] Deleting Workflow %q", d.Id())
 	res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{

google/services/workflows/resource_workflows_workflow_generated_test.go

@@ -68,6 +68,7 @@ resource "google_workflows_workflow" "example" {
   user_env_vars = {
     url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
   }
+  deletion_protection = false
   source_contents = <<-EOF
   # This is a sample workflow. You can replace it with your source code.
   #

google/services/workflows/resource_workflows_workflow_test.go

@@ -45,6 +45,7 @@ resource "google_workflows_workflow" "example" {
   user_env_vars = {
     url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
   }
+  deletion_protection = false
   source_contents = <<-EOF
   # This is a sample workflow, feel free to replace it with your source code
   #
@@ -86,6 +87,126 @@ resource "google_workflows_workflow" "example" {
   user_env_vars = {
     url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
   }
+  deletion_protection = false
+  source_contents = <<-EOF
+  # This is a sample workflow, feel free to replace it with your source code
+  #
+  # This workflow does the following:
+  # - reads current time and date information from an external API and stores
+  #   the response in CurrentDateTime variable
+  # - retrieves a list of Wikipedia articles related to the day of the week
+  #   from CurrentDateTime
+  # - returns the list of articles as an output of the workflow
+  # FYI, In terraform you need to escape the $$ or it will cause errors.
+
+  - getCurrentTime:
+      call: http.get
+      args:
+          url: $${sys.get_env("url")}
+      result: CurrentDateTime
+  - readWikipedia:
+      call: http.get
+      args:
+          url: https:/fi.wikipedia.org/w/api.php
+          query:
+              action: opensearch
+              search: $${CurrentDateTime.body.dayOfTheWeek}
+      result: WikiResult
+  - returnOutput:
+      return: $${WikiResult.body[1]}
+EOF
+}
+`, name)
+}
+
+func TestAccWorkflowsWorkflow_UpdateDeletionProtectionFalseToTrue(t *testing.T) {
+	// Custom test written to test diffs
+	t.Parallel()
+
+	workflowName := fmt.Sprintf("tf-test-acc-workflow-%d", acctest.RandInt(t))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckWorkflowsWorkflowDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWorkflowsWorkflow_Basic_DeletionProtectionFalse(workflowName),
+			},
+			{
+				Config: testAccWorkflowsWorkflow_Basic_DeletionProtectionTrue(workflowName),
+			},
+			{
+				Config: testAccWorkflowsWorkflow_Basic_DeletionProtectionFalse(workflowName),
+			},
+		},
+	})
+}
+
+func TestAccWorkflowsWorkflow_UpdateDeletionProtectionTrueToFalse(t *testing.T) {
+	// Custom test written to test diffs
+	t.Parallel()
+
+	workflowName := fmt.Sprintf("tf-test-acc-workflow-%d", acctest.RandInt(t))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckWorkflowsWorkflowDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWorkflowsWorkflow_Basic_DeletionProtectionTrue(workflowName),
+			},
+			{
+				Config: testAccWorkflowsWorkflow_Basic_DeletionProtectionFalse(workflowName),
+			},
+		},
+	})
+}
+
+func testAccWorkflowsWorkflow_Basic_DeletionProtectionFalse(name string) string {
+	return fmt.Sprintf(`
+resource "google_workflows_workflow" "example" {
+  name           = "%s"
+  region         = "us-central1"
+  deletion_protection = false
+  source_contents = <<-EOF
+  # This is a sample workflow, feel free to replace it with your source code
+  #
+  # This workflow does the following:
+  # - reads current time and date information from an external API and stores
+  #   the response in CurrentDateTime variable
+  # - retrieves a list of Wikipedia articles related to the day of the week
+  #   from CurrentDateTime
+  # - returns the list of articles as an output of the workflow
+  # FYI, In terraform you need to escape the $$ or it will cause errors.
+
+  - getCurrentTime:
+      call: http.get
+      args:
+          url: $${sys.get_env("url")}
+      result: CurrentDateTime
+  - readWikipedia:
+      call: http.get
+      args:
+          url: https://en.wikipedia.org/w/api.php
+          query:
+              action: opensearch
+              search: $${CurrentDateTime.body.dayOfTheWeek}
+      result: WikiResult
+  - returnOutput:
+      return: $${WikiResult.body[1]}
+EOF
+}
+`, name)
+}
+
+func testAccWorkflowsWorkflow_Basic_DeletionProtectionTrue(name string) string {
+	return fmt.Sprintf(`
+resource "google_workflows_workflow" "example" {
+  name           = "%s"
+  region         = "us-central1"
+  deletion_protection = true
   source_contents = <<-EOF
   # This is a sample workflow, feel free to replace it with your source code
   #
@@ -190,6 +311,7 @@ resource "google_workflows_workflow" "example" {
   name          = "%s"
   region        = "us-central1"
   description   = "Magic"
+  deletion_protection = false
   crypto_key_name = "%s"
   source_contents = <<-EOF
   # This is a sample workflow, feel free to replace it with your source code

website/docs/r/workflows_workflow.html.markdown

@@ -54,6 +54,7 @@ resource "google_workflows_workflow" "example" {
   user_env_vars = {
     url = "https://timeapi.io/api/Time/current/zone?timeZone=Europe/Amsterdam"
   }
+  deletion_protection = false
   source_contents = <<-EOF
   # This is a sample workflow. You can replace it with your source code.
   #
@@ -146,6 +147,13 @@ The following arguments are supported:
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
+* `deletion_protection` - (Optional) Whether Terraform will be prevented from destroying the workflow. Defaults to true.
+When a`terraform destroy` or `terraform apply` would delete the workflow,
+the command will fail if this field is not set to false in Terraform state.
+When the field is set to true or unset in Terraform state, a `terraform apply`
+or `terraform destroy` that would delete the workflow will fail.
+When the field is set to false, deleting the workflow is allowed.
+
 * `name_prefix` - (Optional) Creates a unique name beginning with the
  specified prefix. If this and name are unspecified, a random value is chosen for the name.