如何在CI流水线中采用Terraform推荐方式跟踪模板版本？

Great question! Manual version comments like # Version 1.0.0 are error-prone and hard to automate—luckily, the Terraform ecosystem has established best practices for versioning that integrate smoothly with CI/CD pipelines. Let’s walk through what’s recommended and how to implement your workflow:

1. Ditch Manual Comment Versions: Use Terraform Module + Git Tagging #

Terraform itself doesn’t enforce a single versioning standard, but the official ecosystem (including the Terraform Registry) leans heavily on Git tags paired with modularized Terraform code. Here’s why this works better:

• Modules encapsulate your Terraform logic into reusable units, making versioning more granular and meaningful.
• Git tags (e.g., v1.0.0, v1.1.0) act as immutable version markers, eliminating manual comment updates and keeping version history tied directly to your code’s state.

How to structure your code: #

Wrap each Terraform template into a module with a standard structure:

my-terraform-module/
├── main.tf
├── variables.tf
├── outputs.tf
└── versions.tf  # Defines required Terraform provider versions

2. Automate Version Bumps in CI #

To automatically upgrade versions when Terraform code changes, use semantic versioning (SemVer) paired with tooling that reads your commit history. Here’s a typical CI workflow:

• Enforce conventional commits: Use commit messages like feat: add new S3 bucket (triggers a minor version bump), fix: correct security group rules (patch bump), or BREAKING CHANGE: rename variable x (major bump).
• Auto-generate versions: In your CI pipeline, use tools like semantic-release or git-semver to calculate the next version based on commits.
• Tag the repo: Automatically create a Git tag for the new version (e.g., v1.0.1) once the version is determined.

Example CI step (GitLab CI snippet):

version-bump:
  stage: versioning
  only:
    changes:
      - my-terraform-module/**/*
  script:
    - npm install -g semantic-release @semantic-release/git
    - semantic-release  # Automatically calculates and tags new version

3. Upload Terraform Snapshots to Nexus #

Nexus supports raw repositories, which are perfect for storing packaged Terraform modules. Here’s how to automate this:

• Package the module: Zip up your module directory with the version in the filename (e.g., my-terraform-module-v1.0.0.zip).
• Upload to Nexus: Use Nexus’ REST API or a CLI tool like nexus-cli to push the zip file to your Nexus raw repo. Organize paths by module name and version for easy retrieval:

  nexus-cli upload \
    --repository terraform-modules \
    --source my-terraform-module-v1.0.0.zip \
    --destination /my-module/v1.0.0/my-terraform-module-v1.0.0.zip
  

4. Reference Versioned Modules in Terraform #

When you need to use your module elsewhere, pull the specific version directly from Nexus:

module "my_module" {
  source = "https://your-nexus-url/repository/terraform-modules/my-module/v1.0.0/my-terraform-module-v1.0.0.zip"
  
  # Pass variables here as needed
  environment = "production"
}

This approach aligns with Terraform’s official best practices, eliminates manual work, and ensures your versioning is tightly integrated with your CI pipeline.

内容的提问来源于stack exchange，提问作者James