Skip to content

chore(terraform): refine state lock semantics (skip on plan, wait on apply) #997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
olepg wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(terraform): refine state lock semantics (skip on plan, wait on apply) #997

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b76d3df
chore(terraform): skip state lock on plan, wait up to 20m on apply
olepg Apr 24, 2026
31379d5
feat(terraform): add lock_timeout_minutes input (default 0 = fail fast)
olepg Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions .github/workflows/terraform.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,12 @@ on:
required: false
default: true

lock_timeout_minutes:
description: Number of minutes `terraform apply` will wait to acquire the state lock if it is held. Set to `0` to fail immediately on contention (Terraform's default).
type: number
required: false
default: 0

secrets:
AZURE_CLIENT_ID:
description: The client ID of the service principal to use for authenticating to Azure.
Expand Down Expand Up @@ -227,7 +233,7 @@ jobs:
if [[ -n "$VAR_FILE" ]]; then
optional_args+=(-var-file="$VAR_FILE")
fi
terraform plan -out="$PLAN_FILE" -input=false -detailed-exitcode "${optional_args[@]}"
terraform plan -out="$PLAN_FILE" -input=false -detailed-exitcode -lock=false "${optional_args[@]}"
exitcode=$?
if [[ "$exitcode" == 1 ]]; then
exit "$exitcode"
Expand Down Expand Up @@ -347,4 +353,11 @@ jobs:
rm "$TARBALL"

- name: Run Terraform Apply
run: terraform apply -input=false "$PLAN_FILE"
env:
LOCK_TIMEOUT_MINUTES: ${{ inputs.lock_timeout_minutes }}
run: |
optional_args=()
if [[ "$LOCK_TIMEOUT_MINUTES" -gt 0 ]]; then
optional_args+=(-lock-timeout="${LOCK_TIMEOUT_MINUTES}m")
fi
terraform apply -input=false "${optional_args[@]}" "$PLAN_FILE"
4 changes: 4 additions & 0 deletions docs/workflows/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,10 @@ Run `terraform plan`? Defaults to `false` if the workflow was triggered by Depen

Run `terraform apply` for the saved plan file? Defaults to `true`.

### (*Optional*) `lock_timeout_minutes`

Number of minutes `terraform apply` will wait to acquire the state lock if it is held. Set to `0` to fail immediately on contention (Terraform's default). Defaults to `0`.

## Secrets

### `ENCRYPTION_PASSWORD`
Expand Down
Loading