fix(terraform): stop provider Configure mutating the global http.DefaultClient

[byron-lambda]

Why

The generated terraform provider's Configure does:

httpClient := http.DefaultClient
httpClient.Transport = NewProviderHTTPTransport(providerHTTPTransportOpts)

http.DefaultClient is a *http.Client, so the first line aliases the package-global rather than copying it, and the second line rewrites the global's Transport on every Configure. A normal provider process configures once, so this goes unnoticed, but it has two real consequences: any other user of http.DefaultClient in the process silently inherits the provider's transport, and when several provider instances share one process (in-process testing with terraform-plugin-testing's ProtoV6ProviderFactories) concurrent Configures are a data race on the global, which fails any test run under -race.

What changed

templates/templates/terraform/provider/provider.go.stmpl builds a dedicated client instead:

httpClient := &http.Client{Transport: NewProviderHTTPTransport(providerHTTPTransportOpts)}

Review flagged the sibling bug in the same wiring: when a generator config opts into a tlsSkipVerify provider attribute, the generated block mutates the TLS configuration of the transport it is handed, which was http.DefaultTransport, leaking InsecureSkipVerify to every other user of that global in the process. Rather than cloning at the mutation site, Configure now takes ownership of its transport at the single point the default enters: it clones http.DefaultTransport (guarded, so a process that replaced the global with a custom RoundTripper keeps today's behavior) and wires the clone into the transport opts, so every downstream helper mutates state Configure owns. Each provider instance gets its own connection pool, the correct trade for never writing configuration into process globals.

Generated output changes by a few lines in every terraform provider's Configure. Behavior is identical for a single provider instance; the globals http.DefaultClient and http.DefaultTransport are simply no longer touched. Changeset added via make changelog core terraform.

Testing

Applied the same one-line change to the generated provider.go of an existing Speakeasy-generated terraform provider and ran its terraform-plugin-testing e2e suite (17 resource lifecycle tests, t.Parallel, against a local test server) under go test -race: the suite fails with a data race report on http.DefaultClient.Transport before the change and passes after it. For the transport clone, verified the emitted Go by reading the template output (the terraform target has no per-change test harness for this block). Did not run TARGET=review make build-terraform.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[byron-lambda]

I have read the CLA Document and I hereby sign the CLA

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Confidence score: 4/5

• The committed review-SDK fixtures in zSDKs/sdk-terraform/internal/provider/provider.go and zSDKs/terraform-provider-testing/internal/provider/provider.go remain stale and still mutate http.DefaultTransport, so the fixtures may not reflect the updated provider behavior—refresh them to match templates/templates/terraform/includes/provider.ts.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="templates/templates/terraform/includes/provider.ts">

<violation number="1" location="templates/templates/terraform/includes/provider.ts:776">
P2: The committed review-SDK fixtures for this template change are stale. zSDKs/sdk-terraform/internal/provider/provider.go and zSDKs/terraform-provider-testing/internal/provider/provider.go still mutate http.DefaultTransport directly (no Clone) and still rewire http.DefaultClient, so they keep the exact global-mutation/data-race behavior this PR eliminates and don't demonstrate the intended generated-output change. Per CONTRIBUTING.md, the relevant zSDKs should be regenerated (e.g. TARGET=review make build-terraform) and included in this PR.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The committed review-SDK fixtures for this template change are stale. zSDKs/sdk-terraform/internal/provider/provider.go and zSDKs/terraform-provider-testing/internal/provider/provider.go still mutate http.DefaultTransport directly (no Clone) and still rewire http.DefaultClient, so they keep the exact global-mutation/data-race behavior this PR eliminates and don't demonstrate the intended generated-output change. Per CONTRIBUTING.md, the relevant zSDKs should be regenerated (e.g. TARGET=review make build-terraform) and included in this PR.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At templates/templates/terraform/includes/provider.ts, line 776:

<comment>The committed review-SDK fixtures for this template change are stale. zSDKs/sdk-terraform/internal/provider/provider.go and zSDKs/terraform-provider-testing/internal/provider/provider.go still mutate http.DefaultTransport directly (no Clone) and still rewire http.DefaultClient, so they keep the exact global-mutation/data-race behavior this PR eliminates and don't demonstrate the intended generated-output change. Per CONTRIBUTING.md, the relevant zSDKs should be regenerated (e.g. TARGET=review make build-terraform) and included in this PR.</comment>

<file context>
@@ -770,12 +770,17 @@ function templateProviderHTTPTransportTlsSkipVerify(
+  // Clone before mutating: the transport here is http.DefaultTransport, and
+  // writing its TLS configuration would leak InsecureSkipVerify to every
+  // other user of the global in the process.
+  result.push(`transport = transport.Clone()`);
   result.push(`if transport.TLSClientConfig == nil {`);
   result.push(`transport.TLSClientConfig = &tls.Config{}`);
</file context>

[byron-lambda]

A possible follow-up worth a maintainer opinion: the transport clone could instead be cleanhttp.DefaultPooledTransport() from hashicorp/go-cleanhttp, which is already an indirect dependency of every generated provider via the terraform-plugin stack. It returns a concrete *http.Transport (no type assertion or guard needed), never reads process globals by design, and matches what hand-written terraform providers typically use, at the cost of tracking stdlib transport defaults in that library rather than inheriting them via Clone(). Happy to switch this PR to it if you prefer that direction for the terraform target.