Skip to content

tofu-module-publish

Publishes the repository as a module to the GitLab Terraform Module Registry on release tags:

<api>/projects/<id>/packages/terraform/modules/<name>/<system>/<version>/file

Consumers then reference it as:

source  = "gitlab.com/<namespace>/<name>/<system>"
version = "X.Y.Z"

Auth defaults to $CI_JOB_TOKEN, which carries write access to its own project's package registry — publishing needs no personal/group access token and works on GitLab Free. The job picks the right auth header automatically (JOB-TOKEN for the job token, PRIVATE-TOKEN otherwise).

Runs only on tags matching tag_pattern (strict semver vX.Y.Z by default); the published version is the tag with the leading v stripped. A re-run over an already-published version is treated as success (idempotent retry).

stage must be a stage you declare — never .pre/.post

On a release tag every other tofu job self-excludes (tofu-lint / tofu-security / tofu-validate all carry if: $CI_COMMIT_TAG → when: never), so this is typically the only job in the tag pipeline. GitLab does not create a pipeline whose jobs are all in .pre / .post, so a built-in stage means no tag pipeline is created at all — and the failure is silent: the Release MR merges green, the tag exists, the Release page appears, the registry receives nothing, and nothing goes red.

The default is release (it was .post before v0.34.1, which caused exactly that — see issue #8). Add release to your stages: list, or pass a normal stage you already declare. Fixing the stage does not retroactively publish an already-created tag — a tag's .gitlab-ci.yml is frozen at the tagged commit, so a repo that lost a release needs a fresh one.

Jobs

Job What it runs
tofu-module-publish git archive the tagged tree (tracked files only), curl --request PUT to the module registry endpoint with the chosen auth header.

Inputs

Input Type Default Description
image_version string "v0.1.1" ci-base image tag — this component only needs git + curl, so it does not carry the Tofu toolchain.
stage string release Stage to assign the job to. Must be one your stages: declares, and must not be .pre/.post (see the warning above).
module_name string (required) Module name in the registry path, e.g. bootstrap. Unique within the top-level namespace.
module_system string "aws" Module system / target segment of the registry path, e.g. aws, azure, google.
tag_pattern string '^v[0-9]+\.[0-9]+\.[0-9]+$' RE2 pattern a tag must match to publish. Rejects prereleases, build metadata, arbitrary tags.
token string "$CI_JOB_TOKEN" Token authenticating the upload. Override with a PAT carrying api/write_package_registry only for cross-project publishing.

Usage

stages:
  - lint
  - security
  - test
  - release      # the component's default stage — must be declared

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      module_name: bootstrap
      module_system: aws

See also