feat: Implements Approval Config for apply Cloud Build Trigger for tf_cloudbuild_workspace

modules/tf_cloudbuild_workspace/README.md

@@ -37,6 +37,7 @@ This module creates:
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| apply\_approval\_required | Whether or not to require approval for the `apply` Cloud Build trigger. | `bool` | `false` | no |
 | artifacts\_bucket\_name | Custom bucket name for Cloud Build artifacts. | `string` | `""` | no |
 | buckets\_force\_destroy | When deleting the bucket for storing CloudBuild logs/TF state, this boolean option will delete all contained objects. If false, Terraform will fail to delete buckets which contain objects. | `bool` | `false` | no |
 | cloudbuild\_apply\_filename | Optional Cloud Build YAML definition used for terraform apply. Defaults to using inline definition. | `string` | `null` | no |

modules/tf_cloudbuild_workspace/cb.tf

@@ -131,6 +131,14 @@ resource "google_cloudbuild_trigger" "triggers" {
     }
   }
 
+  dynamic "approval_config" {
+    # only enable approval for apply and only if apply_approval_required is true
+    for_each = each.key == "apply" ? [1] : []
+    content {
+      approval_required = var.apply_approval_required
+    }
+  }
+
   substitutions   = merge(local.default_subst, var.substitutions)
   service_account = local.cloudbuild_sa
   filename        = local.default_triggers_explicit[each.key]

modules/tf_cloudbuild_workspace/variables.tf

@@ -31,6 +31,12 @@ variable "trigger_location" {
   default     = "global"
 }
 
+variable "apply_approval_required" {
+  description = "Whether or not to require approval for the `apply` Cloud Build trigger."
+  type        = bool
+  default     = false
+}
+
 variable "create_cloudbuild_sa" {
   description = "Create a Service Account for use in Cloud Build. If false `cloudbuild_sa` has to be specified."
   type        = bool