[sirantd]

Why

Groups can only be two levels deep: gitlab_group.subgroups sets parent_id = gitlab_group.parent_groups[each.value.parent].id, so parent must be a top-level group. A layout such as infra/terraform/terraform-aws-modules (a mirror per upstream GitHub org, with projects like infra/terraform/terraform-aws-modules/terraform-aws-vpc) can't be expressed: parent = "infra/terraform" is not a key of parent_groups and plan fails.

What

• New gitlab_group.nested_subgroups resource for groups whose parent is a subgroup key ("<top>/<name>"). parent matches the subgroup's name, not its path.
• gitlab_group.subgroups now only takes groups whose parent has no /. No existing config has a slash in parent, so no existing address moves.
• local.group_ids maps every managed group (all three levels) to its ID. All per-group resources (memberships, shares, variables, access/deploy tokens, labels, badges, boards, SAML links, push rules and others) and gitlab_project.namespace_id resolve through it instead of the parent_groups/subgroups ternaries.
• gitlab_groups validation rejects a parent deeper than one subgroup.
• New output nested_subgroups_group_ids.
• tests/nested_subgroups.tftest.hcl: subgroup stays in subgroups, nested group lands in nested_subgroups, a nested group works as share target and project namespace, too-deep parent is rejected.

Verification

• terraform test: 11 passed, 0 failed.
• A real Terragrunt unit with ~110 existing groups planned against this branch: no changes to infrastructure (only the new empty output). With infra/terraform plus 7 nested groups added: 9 to add, 0 to change, 0 to destroy.

🤖 Generated with Claude Code

[sirantd]

Opened by mistake: this branch name was already taken by an older branch (3f1793f), so the PR picked up that commit instead of the intended one. Replaced by a PR from feat/nested-subgroups-v2.