Add TF_TARGETS variable to scope Terraform CI runs to specific targets

What

Adds an optional TF_TARGETS pipeline variable to .gitlab-ci-trg-terraform.yml, so a web-triggered run can be limited to a subset of resources instead of always covering the whole configuration.

How

• New TF_TARGETS variable, prefilled in the web pipeline form. Accepts resource addresses separated by space, comma or newline, e.g. module.aks module.network. Empty means the whole configuration, so existing usage is unchanged.
• before_script now also generates targets.sh next to init.sh. It expands TF_TARGETS into -target= flags, exports them as TF_TARGET_ARGS and logs what the run is limited to. The script is sourced (. ./targets.sh), not executed.
• Flags are applied in plan, destroy-plan and destroy. destroy does not read a plan cache, so without the flags it would tear down the entire state.
• apply is intentionally left untouched: the targets are already recorded in plan.cache, and passing -target alongside a saved plan is rejected by Terraform.

Notes

${TF_TARGET_ARGS} is expanded unquoted on purpose, otherwise several targets would be passed as a single argument. As a side effect, addresses containing spaces (indexes such as module.x["a b"]) cannot be passed this way; those still need TF_CLI_ARGS_plan.

Verification

YAML parses cleanly. Not executed against a real state yet, so the first targeted run should be a plan to confirm the flags land as expected.

🤖 Generated with Claude Code