fix(ci): non-interactive drift/plan/apply workflows; surface tofu errors

jfraeys commented

2026-10-02 20:16:15 -04:00

Owner

The scheduled drift job hung at 'Refresh-only plan' until the job timeout: init_terraform only passes -backend-config when OBJECT_STORAGE_*/TF_VAR_tf_state_bucket are set (the workflow never sets them; terraform-plan.yml's comment assumes the runner has them), root_pass/user_password have no defaults, and nothing set TF_INPUT=0, so tofu waited for typed input.

Changes: TF_INPUT=0 on drift-check, terraform-plan and terraform-apply; backend settings on drift-check (bucket/region/endpoint non-secret, key pair from repo secrets OBJECT_STORAGE_ACCESS_KEY_ID / OBJECT_STORAGE_SECRET_ACCESS_KEY, which must be added in Settings -> Actions -> Secrets); placeholder root_pass/user_password for the refresh-only plan; the step now fails on tofu exit 1 (previously swallowed, so a failed run looked green).

Not tested: tofu isn't available locally, so TF_INPUT=0 behavior is per OpenTofu's documented semantics, not observed. The ovh and ovh-dr matrix jobs still lack OVH credentials in this workflow and will now fail fast instead of hanging.

🤖 Generated with Claude Code

The scheduled drift job hung at 'Refresh-only plan' until the job timeout: init_terraform only passes -backend-config when OBJECT_STORAGE_*/TF_VAR_tf_state_bucket are set (the workflow never sets them; terraform-plan.yml's comment assumes the runner has them), root_pass/user_password have no defaults, and nothing set TF_INPUT=0, so tofu waited for typed input. Changes: TF_INPUT=0 on drift-check, terraform-plan and terraform-apply; backend settings on drift-check (bucket/region/endpoint non-secret, key pair from repo secrets OBJECT_STORAGE_ACCESS_KEY_ID / OBJECT_STORAGE_SECRET_ACCESS_KEY, which must be added in Settings -> Actions -> Secrets); placeholder root_pass/user_password for the refresh-only plan; the step now fails on tofu exit 1 (previously swallowed, so a failed run looked green). Not tested: tofu isn't available locally, so TF_INPUT=0 behavior is per OpenTofu's documented semantics, not observed. The ovh and ovh-dr matrix jobs still lack OVH credentials in this workflow and will now fail fast instead of hanging. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-02 20:16:15 -04:00

fix(ci): make drift/plan/apply workflows non-interactive and surface tofu errors acaee9b1f0

The drift job ran tofu init/plan with no TF_INPUT=0, no backend credentials and no values for
root_pass/user_password, so tofu waited for typed input until the job timeout. Set TF_INPUT=0,
pass the state backend settings (bucket/region/endpoint non-secret, key pair from repo secrets),
use placeholders for the refresh-only plan, and fail the step on tofu exit 1 (previously
swallowed, so a failed run looked green).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit

2026-10-02 20:19:24 -04:00

ci(drift): schedule only the permanently-provisioned linode workspace 6d49fc1a73

ovh needs OVH credentials this workflow doesn't pass; ovh-dr isn't permanently provisioned, so a
scheduled refresh-only plan has nothing to compare and bills a runner VM every 6h.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit

2026-10-02 20:23:19 -04:00

Merge branch 'main' into fix/drift-check-noninteractive

Lint / lint (pull_request) Successful in 1m16s

Details

443469a97e

jfraeys merged commit 6410980d40 into main

2026-10-02 20:23:25 -04:00

jfraeys referenced this pull request from a commit

2026-10-02 20:23:26 -04:00

Merge pull request 'fix(ci): non-interactive drift/plan/apply workflows; surface tofu errors' (#11) from fix/drift-check-noninteractive into main

Rows
Columns

fix(ci): non-interactive drift/plan/apply workflows; surface tofu errors #11