[wiseelf]

Why

The module keys each CI variable by owner and key only: <namespace>-<project>-<KEY> for projects and <group path>-<KEY> for groups.
If a project or group has one key in two environment_scope values, the plan fails with Duplicate object key.
Thus a consumer cannot manage per-environment variables, for example UI_BUCKET in ui-uat and in ui-production.

What

Key rule (main.tf): a new ci_variables local builds the for_each maps for gitlab_project_variable and gitlab_group_variable (this and this_sensitive).

Key occurs in its resource	Project key	Group key
Once	<namespace>-<project>-<KEY>	<group path>-<KEY>
More than once	<namespace>-<project>-<KEY>:<environment_scope>	<group path>-<KEY>:<environment_scope>

A key that occurs once keeps its current address, so current state does not move. No moved blocks are necessary. The module counts keys per resource (masked or unmasked), not per owner. Today a config can have a key masked in one scope and unmasked in another scope, and that config plans. A count per owner gives both variables new addresses, and Terraform destroys and creates them again.

The rule "add the scope when the scope is not *" was rejected. With that rule, a unique variable with a scope other than * gets a new address.

Validation (variables.tf): gitlab_groups and gitlab_projects fail at plan if one owner has two variables with the same key and environment_scope. This also includes a masked/unmasked pair. Before this change, such a pair passed the plan and failed at apply.

Tests (tests/ci_variables.tftest.hcl): 5 terraform test runs with a mock provider. They check the addresses of unique keys, the scope suffix for repeated keys, the failure on duplicate pairs, and the example config.

Example and docs: project-beta in examples/terraform/projects/alpha_projects.yaml has DEPLOY_ROLE_ARN in uat and production. Readme.md describes the key rule and the address change.

Caution for consumers: if you add a second scope to a key that occurs once, the address of the first variable changes. The same occurs when you remove scopes until a key occurs once. Add a moved block in the root module before you apply. Readme.md shows an example.

Checks

• terraform validate: Success.
• terraform test: 5 passed, 0 failed.
• terraform test with the old main.tf and variables.tf: the first run fails with Duplicate object key, so the tests detect the defect.
• pre-commit run -a (all hooks, including terraform_tflint): Passed.

Notes for reviewers

• If two owners produce the same for_each key, the plan now fails. Before, merge() silently dropped one variable. Example: namespace a-b with project c, and namespace a with project b-c.
• A variable whose masked is not true or false (for example null) now goes to this. Before, the module dropped it.
• A consumer plan with "No changes" was not run yet.

[sirantd]

LGTM

[github-actions]

This PR is included in version 2.2.0 🎉