Apply/Destroy Plans Between Pipelines
This may be more of a question than an issue, but I suspect it is an issue...
Currently my understanding is that when used in a MR, the Terraform image, scripts, and CI helpers store the plan as an artifact in the pipeline so it can be used by later jobs in the pipeline. This works fine post-merge, as the examples I've seen re-run the build (terraform plan) and re-create the artifacts, using the plan cache: terraform "${TF_CHDIR_OPT}" "${@}" -input=false "${TF_PLAN_CACHE}". However, this plan may not be the same plan as the plan shown in the MR. And, my understanding is that the pre-MR pipeline and post-MR pipeline are in fact two separate pipelines, and that you can not share artifacts between jobs in different pipelines. So we can not use the plan cache from the pre-merge pipeline in the post-merge pipeline. This is likely why the post-merge pipeline includes jobs for the fmt, validate, and build, when they really only need deploy (and we really only need to run the SAST once also).
So, is there a way to use the plan cache from pre-merge pipeline in the post-merge apply? And if not, that is the request: find a way to save the pre-merge plan so that it can be used in the post-merge apply so you are applying exactly what was approved in the merge.
Could we perhaps use needs:project or needs:pipeline:job, or is there a way to access specifically the pipeline for the MR that was approved? needs_project might point to the same project and the name of the job for the "plan" that created the plan cache files, but there could be two MRs for the same project, so that might not be referring to the right job run, as it uses the latest run of the job name. This might also not work with dynamic CI downstream / child pipelines. Thoughts?