Platform/3833 add non root group capabilities

[Stevesibilia]

PR Type

Enhancement

---

Description

• Add new operate_at_root_group_level variable to simplify configuration

• Support for enabling GitLab Agent on specific groups/projects

• Auto-detect parent group when no targets specified

• Deprecate old variables with backward compatibility

---

Changes walkthrough 📝

	Relevant files
Enhancement	main.tf Enhanced GitLab Agent configuration with multi-target support main.tf Add backward compatibility logic for deprecated variables Implement auto-detection of parent group functionality Add dynamic configuration file generation based on enabled groups/projects Create new resources for group and project variables +99/-3    outputs.tf Extended outputs for new configuration modes                          outputs.tf Add new outputs for enabled groups and projects Add output for auto-detected parent group status Modify root namespace output to be conditional +22/-2    variables.tf New variables for flexible agent configuration                      variables.tf Add operate_at_root_group_level variable to replace deprecated ones Add groups_enabled and projects_enabled variables Mark old variables as deprecated with updated descriptions +17/-5
Documentation	CHANGELOG.md Document new features and deprecations                                      CHANGELOG.md Document new variables and features in unreleased section List deprecated variables and their replacements Describe new auto-detection and multi-target capabilities +21/-0    README.md Enhanced documentation with configuration examples              README.md Add comprehensive configuration examples for different modes Document root group, auto-detect, and specific targets usage Update module description with new capabilities +49/-1

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[sparkfabrik-ai-bot]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Logic Complexity The complex conditional logic for determining groups and projects to enable, along with the nested ternary operators, makes the code difficult to understand and maintain. The auto-detection logic and backward compatibility handling should be simplified or broken into smaller, more readable functions. # Backward compatibility: map old variables to new operate_at_root_group_level operate_at_root_group_level_computed = var.operate_at_root_group_level != null ? var.operate_at_root_group_level : ( var.gitlab_agent_grant_user_access_to_root_namespace != null ? var.gitlab_agent_grant_user_access_to_root_namespace : true ) # Determine the parent group of the project project_path_parts = split("/", var.gitlab_project_path_with_namespace) parent_group_path = length(local.project_path_parts) > 1 ? join("/", slice(local.project_path_parts, 0, length(local.project_path_parts) - 1)) : local.project_root_namespace # Determine if we are in auto-parent mode auto_detect_parent = !local.operate_at_root_group_level_computed && length(concat(var.groups_enabled, var.projects_enabled)) == 0 # Final list of groups to enable groups_to_enable = local.operate_at_root_group_level_computed ? [local.project_root_namespace] : ( local.auto_detect_parent ? [local.parent_group_path] : var.groups_enabled ) # Final list of projects to enable projects_to_enable = local.operate_at_root_group_level_computed ? [] : ( local.auto_detect_parent ? [] : var.projects_enabled ) # Gitlab Agent configuration file final_configuration_file_content = var.gitlab_agent_custom_config_file_content != "" ? var.gitlab_agent_custom_config_file_content : ( local.operate_at_root_group_level_computed ? templatefile("${path.module}/files/config.yaml.tftpl", { root_namespace = data.gitlab_group.root_namespace.path, gitlab_agent_append_to_config_file = var.gitlab_agent_append_to_config_file, gitlab_agent_grant_user_access_to_root_namespace = var.gitlab_agent_grant_user_access_to_root_namespace }) : ( length(local.groups_to_enable) > 0 || length(local.projects_to_enable) > 0 ? yamlencode({ ci_access = merge( length(local.groups_to_enable) > 0 ? { groups = [for g in local.groups_to_enable : { id = g }] } : {}, length(local.projects_to_enable) > 0 ? { projects = [for p in local.projects_to_enable : { id = p }] } : {} ) }) : "" ) ) Resource Naming The resource gitlab_group_variable.root_namespace has inconsistent naming compared to the old resource gitlab_group_variable.this. This could cause issues during state migration and makes the code less consistent. resource "gitlab_group_variable" "root_namespace" { for_each = local.operate_at_root_group_level_computed ? local.gitlab_agent_kubernetes_context_variables : {} group = data.gitlab_group.root_namespace.group_id key = each.key value = each.value protected = false masked = false Data Source Efficiency Multiple data sources are created conditionally which could lead to unnecessary API calls. The for_each loops in data sources with complex conditions may cause performance issues when dealing with large numbers of groups/projects. data "gitlab_group" "parent_group" { count = local.auto_detect_parent ? 1 : 0 full_path = local.parent_group_path } # Data source for the specified groups data "gitlab_group" "enabled_groups" { for_each = !local.operate_at_root_group_level_computed && !local.auto_detect_parent ? toset(var.groups_enabled) : toset([]) full_path = each.value } # Data source for the specified projects data "gitlab_project" "enabled_projects" { for_each = !local.operate_at_root_group_level_computed && !local.auto_detect_parent ? toset(var.projects_enabled) : toset([]) path_with_namespace = each.value }

[Copilot]

Pull Request Overview

This PR enhances the GitLab Agent Terraform module to support non-root group capabilities by adding flexible configuration options. The enhancement allows users to operate the agent at different levels (root group, auto-detected parent group, or specific groups/projects) while maintaining backward compatibility with existing configurations.

• Add new operate_at_root_group_level variable to replace deprecated variables and simplify configuration
• Implement auto-detection of parent group when no specific targets are provided
• Support for enabling GitLab Agent on specific groups and projects with dynamic configuration generation

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
variables.tf	Add new variables for flexible configuration and deprecate old ones
main.tf	Implement core logic for multi-target support and backward compatibility
outputs.tf	Add new outputs for enabled targets and configuration status
README.md	Document new configuration modes with practical examples
CHANGELOG.md	Record new features, changes, and deprecations

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Stevesibilia]

/help

[sparkfabrik-ai-bot]

PR Agent Walkthrough 🤖

Welcome to the PR Agent, an AI-powered tool for automated pull request analysis, feedback, suggestions and more.

Here is a list of tools you can use to interact with the PR Agent:

Tool	Description	Trigger Interactively 💎
DESCRIBE	Generates PR description - title, type, summary, code walkthrough and labels	Run
REVIEW	Adjustable feedback about the PR, possible issues, security concerns, review effort and more	Run
IMPROVE	Code suggestions for improving the PR	Run
UPDATE CHANGELOG	Automatically updates the changelog	Run
HELP DOCS	Answers a question regarding this repository, or a given one, based on given documentation path	Run
ADD DOCS 💎	Generates documentation to methods/functions/classes that changed in the PR	Run
TEST 💎	Generates unit tests for a specific component, based on the PR code change	Run
IMPROVE COMPONENT 💎	Code suggestions for a specific component that changed in the PR	Run
ANALYZE 💎	Identifies code components that changed in the PR, and enables to interactively generate tests, docs, and code suggestions for each component	Run
ASK	Answering free-text questions about the PR	[*]
GENERATE CUSTOM LABELS 💎	Automatically retrieves and presents similar issues	[*]
CI FEEDBACK 💎	Generates custom labels for the PR, based on specific guidelines defined by the user	[*]
CUSTOM PROMPT 💎	Generates feedback and analysis for a failed CI job	[*]
IMPLEMENT 💎	Generates custom suggestions for improving the PR code, derived only from a specific guidelines prompt defined by the user	[*]

(1) Note that each tool can be triggered automatically when a new PR is opened, or called manually by commenting on a PR.

(2) Tools marked with [*] require additional parameters to be passed. For example, to invoke the /ask tool, you need to comment on a PR: /ask "<question content>". See the relevant documentation for each tool for more details.

[Stevesibilia]

/improve

[Stevesibilia]

/improve

[Stevesibilia]

/improve

[sparkfabrik-ai-bot]

PR Code Suggestions ✨

Latest suggestions up to b56fc7d

Category	Suggestion	Impact
Possible issue	Prevent data source failure on empty path The data source will fail if parent_group_path is empty or invalid. Add a condition to ensure the path is not empty before attempting to fetch the group data. main.tf [69-72] data "gitlab_group" "parent_group" { - count = local.auto_detect_parent ? 1 : 0 + count = local.auto_detect_parent && local.parent_group_path != "" ? 1 : 0 full_path = local.parent_group_path } Suggestion importance[1-10]: 8 __ Why: This is a critical improvement that prevents Terraform from attempting to fetch a group with an empty path, which would cause a runtime error. The additional condition ensures the data source only runs when the path is valid.	Medium
	Add validation for group path existence The conditional logic assumes that when auto_detect_parent is true, the group path will always match parent_group_path. However, this may not be guaranteed if the groups_to_enable list contains different paths. Add validation to ensure the group path exists in the appropriate data source. main.tf [151] -group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id +group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : ( + contains(keys(data.gitlab_group.enabled_groups), each.value.group_path) ? + data.gitlab_group.enabled_groups[each.value.group_path].group_id : + null +) Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies a potential issue where the conditional logic could fail if group_path doesn't exist in the data source. The improved code adds proper validation to prevent runtime errors.	Medium
General	Handle empty parent group path correctly When the project path has only one part (root-level project), the parent group path falls back to project_root_namespace. This could cause issues if the root namespace itself doesn't exist as a group or if permissions are insufficient. main.tf [24] -parent_group_path = length(local.project_path_parts) > 1 ? join("/", slice(local.project_path_parts, 0, length(local.project_path_parts) - 1)) : local.project_root_namespace +parent_group_path = length(local.project_path_parts) > 1 ? join("/", slice(local.project_path_parts, 0, length(local.project_path_parts) - 1)) : "" Suggestion importance[1-10]: 6 __ Why: The suggestion addresses a valid edge case where a root-level project might not have a meaningful parent group. Setting an empty string is more appropriate than using project_root_namespace as fallback.	Low

---

Previous suggestions

Suggestions up to commit 213df83

Category	Suggestion	Impact
Possible issue	Add explicit data source dependencies Add explicit dependency on data sources to ensure they exist before accessing their attributes. The current code may fail if the data sources are not yet available when the resource is created. main.tf [151-167] # Variables for specific groups (when operate_at_root_group_level is false) resource "gitlab_group_variable" "enabled_groups" { for_each = !var.operate_at_root_group_level && length(local.groups_to_enable) > 0 ? { for pair in setproduct(keys(local.gitlab_agent_kubernetes_context_variables), local.groups_to_enable) : "${pair[1]}_${pair[0]}" => { group_path = pair[1] key = pair[0] value = local.gitlab_agent_kubernetes_context_variables[pair[0]] } } : {} group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id key = each.value.key value = each.value.value protected = false masked = false + depends_on = [ + data.gitlab_group.parent_group, + data.gitlab_group.enabled_groups + ] } Suggestion importance[1-10]: 6 __ Why: The suggestion adds explicit depends_on to ensure data sources are available before resource creation. While Terraform usually handles implicit dependencies correctly, explicit dependencies can help in edge cases and improve clarity.	Low
General	Add data source existence validation The conditional logic accessing data.gitlab_group.parent_group[0] could fail if the data source doesn't exist. Add validation to ensure the data source is available before accessing it. main.tf [161] resource "gitlab_group_variable" "enabled_groups" { ... - group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id + group = local.auto_detect_parent && each.value.group_path == local.parent_group_path && length(data.gitlab_group.parent_group) > 0 ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id ... } Suggestion importance[1-10]: 4 __ Why: The suggestion adds a length check for data.gitlab_group.parent_group, but this is unnecessary since the data source already has count = local.auto_detect_parent ? 1 : 0, ensuring it only exists when needed. The conditional logic is already safe.	Low

Suggestions up to commit c802bfe

Category	Suggestion	Impact
Possible issue	Fix backward compatibility variable reference The backward compatibility logic incorrectly references gitlab_agent_grant_user_access_to_root_namespace instead of the deprecated gitlab_agent_grant_access_to_entire_root_namespace. This will cause the fallback to always use the default true value instead of the intended deprecated variable. main.tf [22-25] # Backward compatibility: map old variables to new operate_at_root_group_level operate_at_root_group_level_computed = var.operate_at_root_group_level != null ? var.operate_at_root_group_level : ( - var.gitlab_agent_grant_user_access_to_root_namespace != null ? var.gitlab_agent_grant_user_access_to_root_namespace : true + var.gitlab_agent_grant_access_to_entire_root_namespace != null ? var.gitlab_agent_grant_access_to_entire_root_namespace : true ) Suggestion importance[1-10]: 9 __ Why: This is a critical bug that breaks backward compatibility. The code references gitlab_agent_grant_user_access_to_root_namespace instead of the deprecated gitlab_agent_grant_access_to_entire_root_namespace, causing the fallback logic to fail.	High
General	Simplify group ID conditional logic This complex conditional logic for determining the group ID could fail if data.gitlab_group.parent_group[0] doesn't exist when auto_detect_parent is false. The logic should be simplified and made more robust to prevent potential runtime errors. main.tf [166] -group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id +group = local.auto_detect_parent ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id Suggestion importance[1-10]: 6 __ Why: The suggestion simplifies the conditional logic, but the original code correctly handles the case where auto_detect_parent is true but the group path doesn't match parent_group_path. The simplification could introduce bugs in edge cases.	Low

Suggestions up to commit d7eb67a

Category	Suggestion	Impact
Possible issue	Fix backward compatibility variable reference The backward compatibility logic references var.gitlab_agent_grant_user_access_to_root_namespace but this variable is deprecated and should reference the correct deprecated variable. Based on the context, it should reference var.gitlab_agent_create_variables_in_root_namespace for proper backward compatibility. main.tf [22-25] # Backward compatibility: map old variables to new operate_at_root_group_level operate_at_root_group_level_computed = var.operate_at_root_group_level != null ? var.operate_at_root_group_level : ( - var.gitlab_agent_grant_user_access_to_root_namespace != null ? var.gitlab_agent_grant_user_access_to_root_namespace : true + var.gitlab_agent_create_variables_in_root_namespace != null ? var.gitlab_agent_create_variables_in_root_namespace : true ) Suggestion importance[1-10]: 9 __ Why: This fixes a critical backward compatibility issue where the wrong deprecated variable is referenced, which could break existing configurations during migration.	High
	Add data source existence check The resource accesses data.gitlab_group.parent_group[0] without checking if the data source exists. This will cause an error when local.auto_detect_parent is false but the condition evaluates to true. Add proper conditional logic to ensure the data source exists before accessing it. main.tf [155-172] # Variabili per gruppi specifici (quando operate_at_root_group_level è false) resource "gitlab_group_variable" "enabled_groups" { for_each = !local.operate_at_root_group_level_computed && length(local.groups_to_enable) > 0 ? { for pair in setproduct(keys(local.gitlab_agent_kubernetes_context_variables), local.groups_to_enable) : "${pair[1]}_${pair[0]}" => { group_path = pair[1] key = pair[0] value = local.gitlab_agent_kubernetes_context_variables[pair[0]] } } : {} - group = local.auto_detect_parent && each.value.group_path == local.parent_group_path ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id + group = local.auto_detect_parent && each.value.group_path == local.parent_group_path && length(data.gitlab_group.parent_group) > 0 ? data.gitlab_group.parent_group[0].group_id : data.gitlab_group.enabled_groups[each.value.group_path].group_id key = each.value.key value = each.value.value protected = false masked = false } Suggestion importance[1-10]: 8 __ Why: This addresses a critical runtime error where data.gitlab_group.parent_group[0] could be accessed when the data source doesn't exist. The suggested fix prevents potential Terraform crashes.	Medium
General	Use template for consistent YAML formatting The yamlencode() function generates YAML with proper formatting, but the generated configuration may not match GitLab Agent's expected format. Consider using a template file or ensuring the YAML structure matches GitLab's requirements exactly. main.tf [45-62] final_configuration_file_content = var.gitlab_agent_custom_config_file_content != "" ? var.gitlab_agent_custom_config_file_content : ( local.operate_at_root_group_level_computed ? templatefile("${path.module}/files/config.yaml.tftpl", { root_namespace = data.gitlab_group.root_namespace.path, gitlab_agent_append_to_config_file = var.gitlab_agent_append_to_config_file, gitlab_agent_grant_user_access_to_root_namespace = var.gitlab_agent_grant_user_access_to_root_namespace }) : ( - length(local.groups_to_enable) > 0 || length(local.projects_to_enable) > 0 ? yamlencode({ - ci_access = merge( - length(local.groups_to_enable) > 0 ? { - groups = [for g in local.groups_to_enable : { id = g }] - } : {}, - length(local.projects_to_enable) > 0 ? { - projects = [for p in local.projects_to_enable : { id = p }] - } : {} - ) + length(local.groups_to_enable) > 0 || length(local.projects_to_enable) > 0 ? templatefile("${path.module}/files/non_root_config.yaml.tftpl", { + groups_to_enable = local.groups_to_enable, + projects_to_enable = local.projects_to_enable }) : "" ) ) Suggestion importance[1-10]: 4 __ Why: While using templates could improve consistency, the current yamlencode() approach is valid and functional. This suggestion assumes a template file exists without evidence from the PR.	Low