diff --git a/README.md b/README.md index 44a22673162cd066e52450e75c70f1a0d3d68de5..919043a04d5be9738a77b5705da578611e07a005 100644 --- a/README.md +++ b/README.md @@ -182,6 +182,7 @@ Have a look at the individual template spec to learn about the available inputs. | `state_name` | `default` | Remote OpenTofu state name. | | `auto_apply` | `false` | Whether the apply job is manual or automatically run. | | `auto_destroy` | `false` | Whether the destroy job is manual or automatically run. | +| `plan_artifacts_access` | `none` | Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values. | ### Available OpenTofu Versions diff --git a/templates/full-pipeline.yml b/templates/full-pipeline.yml index ccc7b46364e39f027785b70f0dd9f0622d1bd3d1..f0e4dd4afa7ae63549b65f206a31e5963a84a878 100644 --- a/templates/full-pipeline.yml +++ b/templates/full-pipeline.yml @@ -67,6 +67,9 @@ spec: default: false type: boolean description: 'Whether the destroy job is manual or automatically run.' + plan_artifacts_access: + default: 'none' + description: 'Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values.' --- @@ -113,6 +116,7 @@ include: image_name: $[[ inputs.image_name ]] root_dir: $[[ inputs.root_dir ]] state_name: $[[ inputs.state_name ]] + artifacts_access: $[[ inputs.plan_artifacts_access ]] - local: '/templates/apply.yml' inputs: as: 'apply' diff --git a/templates/plan.yml b/templates/plan.yml index a28b9c614cf3439d695691141beacf8a40ddcfbf..08d0110eed6be150b7a36120788b6665ba4f4935 100644 --- a/templates/plan.yml +++ b/templates/plan.yml @@ -57,6 +57,9 @@ spec: default: false type: boolean description: 'Indicate if the plan should be a destroy plan. You may want to change the `plan_name` input to `destroy-plan` which is the default for the destroy job.' + artifacts_access: + default: 'none' + description: 'Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values.' --- @@ -70,10 +73,8 @@ spec: # Terraform's cache files can include secrets which can be accidentally exposed. # Please exercise caution when utilizing secrets in your Terraform infrastructure and # consider limiting access to artifacts or take other security measures to protect sensitive information. - # - # The next line, which disables public access to pipeline artifacts, is not available on GitLab.com. - # See: https://docs.gitlab.com/ee/ci/yaml/#artifactspublic - public: false + # See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values. + access: '$[[ inputs.artifacts_access ]]' paths: - $TF_ROOT/$[[ inputs.plan_name ]].cache reports: diff --git a/templates/validate-plan-apply.yml b/templates/validate-plan-apply.yml index 5d670f5a4e3fe9dbef9fae153a692730faa82b2f..7608be908dd444e97e6c41eaafde10b72ffc6d16 100644 --- a/templates/validate-plan-apply.yml +++ b/templates/validate-plan-apply.yml @@ -57,6 +57,9 @@ spec: default: false type: boolean description: 'Whether the apply job is manual or automatically run.' + plan_artifacts_access: + default: 'none' + description: 'Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values.' --- @@ -90,6 +93,7 @@ include: image_name: $[[ inputs.image_name ]] root_dir: $[[ inputs.root_dir ]] state_name: $[[ inputs.state_name ]] + artifacts_access: $[[ inputs.plan_artifacts_access ]] - local: '/templates/apply.yml' inputs: as: 'apply' diff --git a/templates/validate-plan-destroy.yml b/templates/validate-plan-destroy.yml index b94fc546fab0e98a9456fa4df5b7b354669a86ac..35c51a92ba7feb2f87e6738e8faaaf51095c6a6e 100644 --- a/templates/validate-plan-destroy.yml +++ b/templates/validate-plan-destroy.yml @@ -56,6 +56,9 @@ spec: plan_name: default: 'destroy-plan' description: 'Destroy plan file name.' + plan_artifacts_access: + default: 'none' + description: 'Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values.' auto_destroy: default: false type: boolean @@ -94,6 +97,7 @@ include: root_dir: $[[ inputs.root_dir ]] state_name: $[[ inputs.state_name ]] plan_name: $[[ inputs.plan_name ]] + artifacts_access: $[[ inputs.plan_artifacts_access ]] destroy: true - local: '/templates/destroy.yml' inputs: diff --git a/templates/validate-plan.yml b/templates/validate-plan.yml index 2bd9f334a125248f47eb469d745da37c78967376..145e858aaabc926bd87de2f6a020022037e856e7 100644 --- a/templates/validate-plan.yml +++ b/templates/validate-plan.yml @@ -50,6 +50,9 @@ spec: state_name: default: default description: 'Remote OpenTofu state name.' + artifacts_access: + default: 'none' + description: 'Access level for the plan artifact. See https://docs.gitlab.com/ee/ci/yaml/#artifactsaccess for possible values.' --- @@ -83,3 +86,4 @@ include: image_name: $[[ inputs.image_name ]] root_dir: $[[ inputs.root_dir ]] state_name: $[[ inputs.state_name ]] + artifacts_access: $[[ inputs.artifacts_access ]]