A DevOps Project whose Pushes Build, on Your Network
The project, repository and pipeline are separate resources and none reacts to a commit until a trigger ties a push to the pipeline; builds run as the DevOps service and fail on the first step without a dynamic group and policy; and the runner is on Oracle's network unless given a subnet. Trigger created, runner attached to your subnet, and the IAM rule and statements exported.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "devops" {
source = "www.iac-bazaar.com/iac-bazaar/oci-devops/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/oci-devops?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A DevOps Project whose Pushes Build, on Your Network](https://www.iac-bazaar.com/catalog/oci-devops?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "devops" {
source = "www.iac-bazaar.com/iac-bazaar/oci-devops/oci"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-devops
A DevOps project with a repository, a build pipeline, and the trigger that
makes a push build. Works with Terraform and OpenTofu (>= 1.6), oci
provider >= 8.0, < 9.0.
A pipeline with no trigger builds when somebody clicks Run. The trigger
is created here; a pipeline without one needs accept_manual_builds.
The build runner needs a dynamic group and a policy. policy_required
exports the rule and statements; without them the first run fails on the
first step.
The runner has public network access unless told otherwise. A runner
that must reach a private registry or database needs runner_subnet_id;
none needs accept_public_runner.
Notifications are required by the API: every project event goes to an ONS topic.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
ansible-oci-cli
The Oracle Cloud Infrastructure CLI pinned in /opt/oci-cli, a virtual environment apart from the system Python, linked into the PATH. No package exists; the documented installs are a script piped into bash or pip into the system Python. The live test runs pip check and an API call, and asserts the system Python cannot import the SDK. Original role, live-tested on Rocky Linux 10.
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
gcp-cloud-deploy
require_approval defaults to false on every target, so a release rolls into production the moment somebody promotes it with nobody signing off; the verify flag defaults off, so skaffold verify has never run. Treats the last stage as production and refuses a pipeline whose last target skips approval, verifies after every rollout, and refuses the Compute default service account as the runner.
ibm-devops
An IBM Cloud CD toolchain, Tekton pipeline, definition and triggers. Without a definition the pipeline is enabled and has no tasks while everything looks finished. enable_events_from_forks runs the pipeline with its own credentials for anyone who can open a pull request, so it is off and refused by name, and omitting a concurrency limit disables it entirely.
azure-devops
Bootstraps an Azure DevOps project with an initialized Git repository and a YAML build pipeline - repeatable team setup as code.
gcp-cloud-build
A trigger with no service account runs every step - including code from the pull request under test - as the broadest identity in the project; a trigger that deploys on push deploys whatever lands; the shared default pool has external IPs. A dedicated runner with the defaults refused, a private worker pool with no external addresses, and approval required on any trigger marked as deploying.