Tag-driven Terraform module release flow

policy.rego

package spacelift

sample := true

module_version := version {
    version := trim_prefix(input.push.tag, "v")
    not propose
}

propose { 
  not is_null(input.pull_request) 
}

track { 
  module_version != ""
  input.push.branch == ""
 }