new

    - '/usr/bin/env'

    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

cache:

  paths:

    - .terraform

variables:

  YC_SERVICE_ACCOUNT_KEY_FILE: /tmp/sa-key.json

before_script:

  - terraform init -input=false

  - |

    cat <<EOF >> ~/.terraformrc

    provider_installation {

      network_mirror {

        url = "https://terraform-mirror.yandexcloud.net/"

        include = ["registry.terraform.io/*/*"]

      }

      direct {

        exclude = ["registry.terraform.io/*/*"]

      }

    }

    EOF

  - terraform init

  - echo "$YC_KEY" > /tmp/sa-key.json

stages:

  - validate

  stage: validate

  script:

    - terraform validate

  rules:

    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH' 

    - when: never

plan:

  stage: plan

  script:

    - terraform plan -input=false

  dependencies:

    - validate

  except:

    - master

    - terraform plan -out="planfile"

  artifacts:

    paths:

      - planfile

  rules:

    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH' 

    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

    - when: never

apply:

  stage: apply

  script:

    - terraform apply -input=false -auto-approve

  dependencies:

    - validate

  only:

    - master

    - terraform apply -auto-approve "planfile"

  rules:

    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

      when: manual

    - when: never