[grubmeshi]

What

The STACKIT Landing Zone can put everything it creates into one folder at the organization root, so a STACKIT organization can serve several meshStacks (for example dev, demo and trial) without mixing their folders and projects.

• New optional input Root Folder Name (root_folder_name, STRING, updateable). Set: the building block creates a folder with that name at the organization root; the landing-zone folder and the foundation project go inside it.
• Playground mode always creates a root folder, named playground-<platform identifier> (the identifier already carries the random suffix).
• Empty and no playground: the landing-zone folder stays at the organization root, and the foundation project moves into the landing-zone folder.
• New output root_container_id: the root folder, or the organization without one. Foundations place their other projects (bootstrap, metering) there.

<organization>
└── <root folder name>
    ├── <platform identifier>              tenant projects
    ├── <platform identifier>-foundation
    └── projects of the meshStack that are no tenants

Existing installs

parent_container_id of stackit_resourcemanager_folder and stackit_resourcemanager_project has no RequiresReplace; the provider sends it in the PATCH. Tested live with provider 0.117.0: a folder with a child folder moved under another folder in place, with the same folder id, and the next plan was empty. So setting the root folder moves the landing-zone folder and the foundation project without replacing them or touching tenant projects.

Breaking

• imports.folder takes only container_id; the folder is renamed to the platform identifier (in place).
• imports.foundation_project drops parent_container_id; the parent follows the rule above.

Not covered

• No imports.root_folder: every live install gets a new root folder, so nothing needs adopting yet.

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit e448e3ec127b24e82c07328b64810d68ddccc0ef relative to origin/main

📊 meshstack-hub Reference Architecture Scorecard

Generated: 2026-11-04 | Reference Architectures scanned: 1 | Categories: 3

📋 Per-Reference Architecture Category Summary

Score per category per reference architecture. n/a = category does not apply to this reference architecture.
Included modules are scored by the module scorecard, and only summarized here.

Reference Architecture	Overall	Shared Practices	Reference Architecture	Testing	Included modules
stackit-landingzone	🟡 73%	🟢 80%	🟡 75%	🟡 50%	6 modules; 6 with failures: stackit/network 97%, stackit/network-area 94%, stackit/project 86%, stackit/service-account 97%, stackit/service-account-federation 97%, stackit/stackit-project-starterkit 93%; not scored: modules/stackit

⚠️ 1 reference architecture has failing checks — failing categories are expanded below.

Shared Practices — some checks failing

Practices modules and reference architectures share — applies to 1 reference architectures

Reference Architecture	Score	🎯	🔐	🫥	🧾	🪞
stackit-landingzone	🟢 80%	❌	✅	✅	✅	✅

Shared Practices — Summary

Emoji	Criterion	Coverage	Status
🎯	meshStack *_ref attributes take a ref, never an object built from a uuid	0/1	🔴 0%
🔐	no building block output carries a secret	1/1	🟢 100%
🫥	Sensitive building block variables are ephemeral	1/1	🟢 100%
🧾	User-facing BBD inputs backed by an object or map variable are JSON with a json_schema	1/1	🟢 100%
🪞	BBD inputs do not repeat the variable's default in default_value	1/1	🟢 100%

Reference Architecture — some checks failing

How a reference architecture orders and documents its building blocks — applies to 1 reference architectures

Reference Architecture	Score	🆕	📌	🛂	🗺️
stackit-landingzone	🟡 75%	❌	✅	✅	✅

Reference Architecture — Summary

Emoji	Criterion	Coverage	Status
🆕	Children are ordered with, and outputs hand out, version_latest	0/1	🔴 0%
📌	Hub sources, ref_name and assets follow var.hub.git_ref	1/1	🟢 100%
🛂	The definition takes its approval policies from a variable	1/1	🟢 100%
🗺️	README.md shows a committed diagram (.dot + .svg)	1/1	🟢 100%

Testing — some checks failing

End-to-end test coverage — applies to 1 reference architectures

Reference Architecture	Score	🚫	🎭	🧪
stackit-landingzone	🟡 50%	✅	➖	❌

Testing — Summary

Emoji	Criterion	Coverage	Status
🚫	no .tftest.hcl outside e2e/	1/1	🟢 100%
🎭	every .tftest.hcl runs against real infrastructure	n/a	—
🧪	e2e/main.tf with a .tftest.hcl	0/1	🔴 0%

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-424.d1o16zfeoh2slu.amplifyapp.com

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud