Add Global Run Task support

[glennsarti]

Description

This PR;

• Updates the workspace run task resource and datasource to deprecate the stage attribute
  in favour of the new stages attribute. This also includes a state version update
• Adds a new organization_run_task_global_settings resource and datasource for managing the
  global settings of a Run task. This does require the HCP Terraform/TFE instance to support
  global run tasks. The provider does attempt to error gracefully if a user is trying to use
  this feature if it's unsupported.

Remember to:

• Update the Change Log
• Update the Documentation

Testing plan

Handled by acceptance tests

External links

• go-tfe documentation
• API documentation

Output from acceptance tests

In this PR.

[glennsarti]

Added compliance team for review as a once-over.

[brandonc]

The code looks healthy, but let's start with a high level question 👇

[brandonc]

Can you help me understand why this schema was not added to organization_run_task?

In the case of tfe_organization_default_settings, it's very common to not manage the organization itself with the provider... and in the case of tfe_workspace_settings, the primary issue was breaking the circular dependency between agent pools and workspaces but it was also a convenient symmetry with organization_settings because it overrides 'inheritability' of those settings.

In the case of organization run tasks, neither problem seems to appear so it seems like it would be much straightforward to put all schema within the same resource. Is there a concept I am overlooking?

[brandonc]

Another concern is "enabled" schema would appear to be managing the same thing on both resources

[glennsarti]

So there a couple of things that forced me down this path;

1. Global Run Tasks are entitlement based.
   So it's possible for their functionality to be removed/added outside of the provider.

   • Imagine the run task resource includes global information in it's state.
   • A run task resource is created without global run tasks being available.
   • An admin comes along and upgrades their TFC subscription to premium
   • Now the next run the resource will be out of sync because its state has changed. (from null to something)

Same applies when a resource wants to manage a global run task, but the subscription was demoted. (from something to null).

2. We are still using Plugin Protocol v5 so I don't have have access to nested attributes. I tried so many different combinations of hacks but I could never get it quite right.

---

I originally did have it all in one resource ala;

org_run_task "thing" {
  ...
  global = {
    enabled = true
    enforcement-level = "advisory"
  }
}

And it worked perfectly, until I started testing changing the subscription, and everything broke.
I desperately wanted to use a nested block syntax, but I just couldn't, given the dynamic nature of the subscription turning on/off the global run task feature.

[ctrombley]

Looks good! 👌

[brandonc]

Can you provide the whole example where tfe_organization_run_task.example is included as well?

Does enabled need to be an argument in both resources?

[glennsarti]

Added the missing example, and set enabled to true in both to avoid confusion.

Does enabled need to be an argument in both resources?

Yes.

[glennsarti]

@brandonc or @ctrombley Am I ok to merge?

[glennsarti]

Rebased due to changelog