Fix: approve_plan_automatically attribute fails for sub_environment

env0/resource_environment.go

@@ -415,7 +415,8 @@ func setEnvironmentSchema(ctx context.Context, d *schema.ResourceData, environme
 		d.Set("output", string(environment.LatestDeploymentLog.Output))
 	}
 
-	if environment.RequiresApproval != nil {
+	// Don't update this value for workflow environments - this value should always be 'false'.
+	if _, isWorkflow := d.GetOk("sub_environment_configuration"); !isWorkflow && environment.RequiresApproval != nil {
 		d.Set("approve_plan_automatically", !*environment.RequiresApproval)
 	}
 
@@ -976,9 +977,20 @@ func getCreatePayload(d *schema.ResourceData, apiClient client.ApiClientInterfac
 		payload.AutoDeployOnPathChangesOnly = boolPtr(val.(bool))
 	}
 
+	_, isWorkflow := d.GetOk("sub_environment_configuration")
+
 	//lint:ignore SA1019 reason: https://github.com/hashicorp/terraform-plugin-sdk/issues/817
 	if val, exists := d.GetOkExists("approve_plan_automatically"); exists {
 		payload.RequiresApproval = boolPtr(!val.(bool))
+
+		if isWorkflow && *payload.RequiresApproval {
+			return client.EnvironmentCreate{}, diag.Errorf("approve_plan_automatically cannot be 'false' for workflows")
+		}
+	}
+
+	// For 'Workflows', the 'root' environment should never require an approval.
+	if isWorkflow {
+		payload.RequiresApproval = boolPtr(false)
 	}
 
 	//lint:ignore SA1019 reason: https://github.com/hashicorp/terraform-plugin-sdk/issues/817
@@ -1179,6 +1191,11 @@ func getDeployPayload(d *schema.ResourceData, apiClient client.ApiClientInterfac
 		payload.BlueprintRevision = revision.(string)
 	}
 
+	// For 'Workflows', the 'root' environment should never require a user approval.
+	if _, ok := d.GetOk("sub_environment_configuration"); ok {
+		payload.UserRequiresApproval = boolPtr(false)
+	}
+
 	if isRedeploy {
 		if revision, ok := d.GetOk("without_template_settings.0.revision"); ok {
 			payload.BlueprintRevision = revision.(string)

env0/resource_environment_test.go

@@ -2888,11 +2888,11 @@ func TestUnitEnvironmentWithSubEnvironment(t *testing.T) {
 	subEnvrionmentWithId.Id = workflowSubEnvironment.EnvironmentId
 
 	environment := client.Environment{
-		Id:          "id",
-		Name:        "environment",
-		ProjectId:   "project-id",
-		BlueprintId: "template-id",
-
+		Id:               "id",
+		Name:             "environment",
+		ProjectId:        "project-id",
+		BlueprintId:      "template-id",
+		RequiresApproval: boolPtr(false),
 		LatestDeploymentLog: client.DeploymentLog{
 			WorkflowFile: &client.WorkflowFile{
 				Environments: map[string]client.WorkflowSubEnvironment{
@@ -2912,8 +2912,9 @@ func TestUnitEnvironmentWithSubEnvironment(t *testing.T) {
 	}
 
 	environmentCreatePayload := client.EnvironmentCreate{
-		Name:      environment.Name,
-		ProjectId: environment.ProjectId,
+		Name:             environment.Name,
+		ProjectId:        environment.ProjectId,
+		RequiresApproval: boolPtr(false),
 		ConfigurationChanges: &client.ConfigurationChanges{
 			{
 				Name:        "n1",
@@ -2929,7 +2930,8 @@ func TestUnitEnvironmentWithSubEnvironment(t *testing.T) {
 			},
 		},
 		DeployRequest: &client.DeployRequest{
-			BlueprintId: environment.BlueprintId,
+			BlueprintId:          environment.BlueprintId,
+			UserRequiresApproval: boolPtr(false),
 			SubEnvironments: map[string]client.SubEnvironment{
 				subEnvironment.Alias: {
 					Workspace:            subEnvironment.Workspace,
@@ -2946,8 +2948,9 @@ func TestUnitEnvironmentWithSubEnvironment(t *testing.T) {
 	}
 
 	deployRequest := client.DeployRequest{
-		BlueprintId:       environment.BlueprintId,
-		BlueprintRevision: environment.LatestDeploymentLog.BlueprintRevision,
+		BlueprintId:          environment.BlueprintId,
+		BlueprintRevision:    environment.LatestDeploymentLog.BlueprintRevision,
+		UserRequiresApproval: boolPtr(false),
 		SubEnvironments: map[string]client.SubEnvironment{
 			subEnvironment.Alias: {
 				Revision:             subEnvironment.Revision,
@@ -2958,6 +2961,39 @@ func TestUnitEnvironmentWithSubEnvironment(t *testing.T) {
 		},
 	}
 
+	t.Run("Fail when approve plan automatically is false", func(t *testing.T) {
+		testCase := resource.TestCase{
+			Steps: []resource.TestStep{
+				{
+					Config: fmt.Sprintf(`
+					resource "%s" "%s" {
+						name = "%s"
+						project_id = "%s"
+						template_id = "%s"
+						force_destroy = true
+						approve_plan_automatically = false
+						sub_environment_configuration {
+							alias = "%s"
+							revision = "%s"
+							workspace = "%s"
+						}
+					}`,
+						resourceType, resourceName,
+						environmentCreatePayload.Name,
+						environmentCreatePayload.ProjectId,
+						environment.BlueprintId,
+						subEnvironment.Alias,
+						subEnvironment.Revision,
+						subEnvironment.Workspace,
+					),
+					ExpectError: regexp.MustCompile("approve_plan_automatically cannot be 'false' for workflows"),
+				},
+			},
+		}
+
+		runUnitTest(t, testCase, func(mock *client.MockApiClientInterface) {})
+	})
+
 	t.Run("Success in create", func(t *testing.T) {
 		testCase := resource.TestCase{
 			Steps: []resource.TestStep{

tests/integration/012_environment/main.tf

@@ -257,7 +257,6 @@ resource "env0_environment" "workflow-environment" {
   name                       = "environment-workflow-${random_string.random.result}"
   project_id                 = env0_project.test_project.id
   template_id                = env0_template.workflow_template.id
-  approve_plan_automatically = true
 
   configuration {
     name  = "n1"
@@ -269,7 +268,7 @@ resource "env0_environment" "workflow-environment" {
   sub_environment_configuration {
     alias                      = "rootService1"
     revision                   = "master"
-    approve_plan_automatically = var.second_run ? true : false
+    approve_plan_automatically = var.second_run ? false : true 
     configuration {
       name  = "sub_env1_var1"
       value = "hello"