Unable to Publish a Module in Terraform Enterprise Private Registry

Problem

When you attempt to publish a module to the Terraform Enterprise Private Registry, the repository picklist may be empty. If you manually enter a repository name and select Publish module, you may receive an Error publishing module message.

The raw logs may contain the following errors, indicating a failure to create the necessary VCS webhook.

[WARN] VCS webhook creation failure: <Repository name>/terraform-<provider>-<provider name>s: 404 Not Found
[DEBUG] Failed to create webhook on repository excluded from capture: DSN not set
[ERROR] {:error=>"RuntimeError", :id=>2692340, :message=>"Failed to create webhook on repository"}
[DEBUG] {:error=>"RuntimeError", :id=>2692340, :message=>"Failed to create webhook on repository", :backtrace=>["/app/app/models/vcs/<repo>:in `rescue in create_webhook'",

Cause

This issue typically occurs when the ownership of the repository changes within your Version Control System (VCS) provider. Terraform Enterprise is not automatically aware of this change and continues to use the previous owner's OAuth token to connect to the repository, which is no longer valid.

To resolve this, you must manually revoke and re-establish the VCS connection in your Terraform Enterprise organization settings to refresh the OAuth token with the new repository owner's credentials.

Solution

Follow these steps to revoke and reconnect the VCS provider to refresh the OAuth connection.

1. Navigate to the version control settings for the organization where the workspace is located.
   • For Terraform Enterprise, the URL is https://<TFE_HOSTNAME>/app/<ORGANIZATION_NAME>/settings/version-control.
   • For HCP Terraform, the URL is https://app.terraform.io/app/<ORGANIZATION_NAME>/settings/version-control.
2. Locate the VCS provider that requires the connection refresh and select Revoke Connection.
3. Confirm the action in the pop-up dialog to disconnect the provider.
4. After the connection is revoked, the Connect Organization button will become available for that VCS provider. Select it.
5. You will be redirected to your VCS provider to authorize the connection. Authenticate as the new repository owner.
6. Ensure the user has the appropriate permissions as outlined in the VCS provider documentation and authorize access.
7. On the next page, select Add SSH key if your VCS connection requires it. You may need to recreate the SSH key due to the ownership change. Otherwise, select Skip and finish.

After completing these steps, the VCS connection and its associated OAuth token are refreshed with the new repository owner's credentials.

Outcome

After refreshing the VCS connection, verify that you can now publish the module. When you navigate to the module publishing page, the repositories matching the terraform-<PROVIDER>-<NAME> format should now correctly populate in the Choose the Repository picklist.