bug: any update to a template with a private repo fails with "A template with private repo cannot be made public"

Provider version

1.12.1

Terraform / OpenTofu version

Terraform v1.14.9 on darwin_arm64

Which API region?

Other / self-hosted (internal QA environment); reported by customers on production as well

Affected resources or data sources

stackguardian_workflow_template, stackguardian_stack_template

Terraform configuration

resource "stackguardian_workflow_template" "example" {
  template_name      = "my-template"
  source_config_kind = "TERRAFORM"
  is_public          = "0"
  description        = "changed"   # any change at all

  runtime_source = {
    source_config_dest_kind = "GITHUB_COM"
    config = {
      repo       = "https://github.com/example/private-repo"
      is_private = true
      auth       = "/integrations/my-github-connector"
    }
  }
}

What did you expect to happen?

An in-place update of the description. terraform plan shows exactly that, with no diff on is_public.

What actually happened?

Every update to a template whose repository is private fails:

Error: Error updating workflow template

Error in updating workflow template API call: 400: {"msg":"A template with private repo cannot be made public"}

Hard-coding is_public = "0" does not help. The plan is clean for that attribute, yet apply still fails.

Root cause: the provider sends every configured attribute on each PATCH, including IsPublic: "0", and the API rejects any update body that carries the IsPublic key when the repository is private, regardless of the value. Verified directly against the API:

The API check needs fixing separately, but the provider can avoid the failure for the common case by only sending IsPublic when the value actually changes.

Before submitting

• I have removed all credentials and org-identifying values from the above.

Start with the update handling for stackguardian_workflow_template and stackguardian_stack_template, then trace how configured attributes become the PATCH body. Ensure IsPublic is sent only when its value changes, and verify that changing another attribute on a private-repository template succeeds without that key in the request.