test(monitor-alert): add = and != operator test coverage for alert v2 resources (#709)

## Summary

Investigated #707 and found the reported behavior is **not
reproducible**. The Sysdig API (`us2.app.sysdig.com`) accepts
`conditionOperator: "="` and returns it unchanged — there is no
normalization to `"=="`.

Curl testing confirmed:
- `conditionOperator: "="` → **200 OK**, stored and returned as `=`
- `conditionOperator: "=="` → **422 "Wrong grammar for condition"**
(only valid for PromQL/form_based_prometheus alerts)

This PR adds acceptance test coverage for the `=` and `!=` operators
across all three affected alert types (metric, change, event) to prevent
regressions and document the expected behavior.

Closes #707

Author: tembleking

sysdig/resource_sysdig_monitor_alert_v2_change_test.go

@@ -57,6 +57,18 @@ func TestAccAlertV2Change(t *testing.T) {
 			{
 				Config: alertV2ChangeWithUnreportedAlertNotificationsRetentionSec(rText()),
 			},
+			{
+				Config: alertV2ChangeWithNotEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_change.sample", "operator", "!="),
+				),
+			},
+			{
+				Config: alertV2ChangeWithEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_change.sample", "operator", "="),
+				),
+			},
 			{
 				Config: alertV2ChangeWithWarningThreshold(rText()),
 			},
@@ -314,6 +326,36 @@ resource "sysdig_monitor_alert_v2_change" "sample" {
 `, name)
 }
 
+func alertV2ChangeWithNotEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_change" "sample" {
+	name = "TERRAFORM TEST - CHANGE %s"
+	metric = "sysdig_container_cpu_used_percent"
+	group_aggregation = "avg"
+	time_aggregation = "avg"
+	operator = "!="
+	threshold = 50
+	shorter_time_range_seconds = 300
+	longer_time_range_seconds = 3600
+}
+`, name)
+}
+
+func alertV2ChangeWithEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_change" "sample" {
+	name = "TERRAFORM TEST - CHANGE %s"
+	metric = "sysdig_container_cpu_used_percent"
+	group_aggregation = "avg"
+	time_aggregation = "avg"
+	operator = "="
+	threshold = 50
+	shorter_time_range_seconds = 300
+	longer_time_range_seconds = 3600
+}
+`, name)
+}
+
 func alertV2ChangeWithWarningThreshold(name string) string {
 	return fmt.Sprintf(`
 resource "sysdig_monitor_notification_channel_email" "nc_email1" {

sysdig/resource_sysdig_monitor_alert_v2_event_test.go

@@ -36,6 +36,18 @@ func TestAccAlertV2Event(t *testing.T) {
 			{
 				Config: alertV2EventWithScrambledSources(rText()),
 			},
+			{
+				Config: alertV2EventWithNotEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_event.sample", "operator", "!="),
+				),
+			},
+			{
+				Config: alertV2EventWithEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_event.sample", "operator", "="),
+				),
+			},
 			{
 				Config: alertV2EventWithWarningThreshold(rText()),
 			},
@@ -138,6 +150,50 @@ resource "sysdig_monitor_alert_v2_event" "sample" {
 `, name)
 }
 
+func alertV2EventWithNotEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_event" "sample" {
+
+	name = "TERRAFORM TEST - EVENTV2 %s"
+	filter = "xxx"
+	operator = "!="
+	threshold = 50
+
+	scope {
+		label = "kube_cluster_name"
+		operator = "in"
+		values = ["thom-cluster1", "demo-env-prom"]
+	}
+
+	range_seconds = 600
+
+}
+
+`, name)
+}
+
+func alertV2EventWithEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_event" "sample" {
+
+	name = "TERRAFORM TEST - EVENTV2 %s"
+	filter = "xxx"
+	operator = "="
+	threshold = 50
+
+	scope {
+		label = "kube_cluster_name"
+		operator = "in"
+		values = ["thom-cluster1", "demo-env-prom"]
+	}
+
+	range_seconds = 600
+
+}
+
+`, name)
+}
+
 func alertV2EventWithWarningThreshold(name string) string {
 	return fmt.Sprintf(`
 resource "sysdig_monitor_alert_v2_event" "sample" {

sysdig/resource_sysdig_monitor_alert_v2_metric_test.go

@@ -84,6 +84,18 @@ func TestAccAlertV2Metric(t *testing.T) {
 			{
 				Config: alertV2MetricWithLabels(rText()),
 			},
+			{
+				Config: alertV2MetricWithNotEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_metric.sample", "operator", "!="),
+				),
+			},
+			{
+				Config: alertV2MetricWithEqualOperator(rText()),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("sysdig_monitor_alert_v2_metric.sample", "operator", "="),
+				),
+			},
 			{
 				Config: alertV2MetricWithWarningThreshold(rText()),
 			},
@@ -530,6 +542,38 @@ resource "sysdig_monitor_alert_v2_metric" "sample" {
 `, name)
 }
 
+func alertV2MetricWithNotEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_metric" "sample" {
+
+	name = "TERRAFORM TEST - METRICV2 %s"
+	metric = "sysdig_container_cpu_used_percent"
+	group_aggregation = "avg"
+	time_aggregation = "avg"
+	operator = "!="
+	threshold = 50
+	range_seconds = 600
+
+}
+`, name)
+}
+
+func alertV2MetricWithEqualOperator(name string) string {
+	return fmt.Sprintf(`
+resource "sysdig_monitor_alert_v2_metric" "sample" {
+
+	name = "TERRAFORM TEST - METRICV2 %s"
+	metric = "sysdig_container_cpu_used_percent"
+	group_aggregation = "avg"
+	time_aggregation = "avg"
+	operator = "="
+	threshold = 50
+	range_seconds = 600
+
+}
+`, name)
+}
+
 func alertV2MetricWithWarningThreshold(name string) string {
 	return fmt.Sprintf(`
 resource "sysdig_monitor_notification_channel_email" "nc_email1" {