CI failure: terraform-plan-apply on claude/eager-albattani-c79914

[izzywdev]

@claude the deploy workflow terraform-plan-apply failed on claude/eager-albattani-c79914 (event: pull_request).

Run: https://github.com/izzywdev/FuzeInfra/actions/runs/28938269810

This is a deploy-path failure (not app CI). Diagnose from the run log. If it is a credential/permission problem (e.g. a token missing a scope), that is an operator action — say so plainly rather than attempting a code fix. Prod stays GitOps (edit repo -> Argo).

failed-step log (tail)

/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0771111Z includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0772191Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0777806Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0810073Z /home/runner/work/_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0821791Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path /home/runner/work/_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0853735Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0873626Z /home/runner/work/_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0891035Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0921989Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0943170Z /github/runner_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0951706Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.0983672Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1003284Z /github/runner_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1013477Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1052821Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1248404Z Removing credentials config '/home/runner/work/_temp/git-credentials-99f7ad1c-44d0-4a77-a59c-3bdbcfb9e455.config'
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1368472Z Cleaning up orphan processes
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T11:13:51.1622485Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/github-script@v7, dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590, hashicorp/setup-terraform@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[claude]

Claude finished @izzywdev's task in 1m 3s —— View job

---

Diagnosis: terraform-plan-apply on claude/eager-albattani-c79914 (PR #189)

• Pull the failed run log
• Identify the failing step
• Determine root cause (code / credential / expected)

This is not a failure — it's the drift gate firing by design ✅

Every real step succeeded. The job went green through init → validate → plan → save artifact → post PR comment. The credentials are all present and working (the plan refreshed live Contabo + Cloudflare state fine). The step that "failed" is the intentional one:

Step 13: Fail the check on a non-empty plan (drift)  → exit 1

The plan itself is:

# module.ci_workers.contabo_instance.node["fuzeinfra-ci-runner-1"] will be created
Plan: 1 to add, 0 to change, 0 to destroy.
plan has changes: true

The workflow (.github/workflows/terraform-plan-apply.yml:220‑224) deliberately exit 1s whenever has_changes == 'true', so that a green plan check means "state matches config, nothing to apply." A non-empty plan is supposed to go red. That red X is the signal, not a bug.

And this run's non-empty plan is exactly what the PR intends — the PR title is "retrigger apply to provision CI runner node" and it sets ci_worker_count = 1, whose only effect is adding one Contabo instance (fuzeinfra-ci-runner-1).

No code fix needed. This is an operator action.

Not a credential/scope problem — all TF_VAR_* / AWS backend secrets are wired and the plan ran cleanly. The reviewed plan (1 instance to add) has already been posted as a PR comment and uploaded as the tfplan-<head_sha> artifact.

To provision the runner, the operator should:

1. Review the plan comment on PR chore(tf): retrigger apply to provision CI runner node #189 — confirm the single contabo_instance.node["fuzeinfra-ci-runner-1"] add is what's wanted (no destroys, no replaces — it's clean).
2. Merge PR chore(tf): retrigger apply to provision CI runner node #189 to main deliberately, past the red drift check. The apply job (push → main) then downloads the exact saved plan and runs terraform apply tfplan. That job already handles this case — it sets workflow_conclusion: "" (workflow line 271) specifically because the plan job intentionally fails on a non-empty plan, so the artifact is still recoverable.

This is terraform/'s own merge-to-apply CD (S3+DynamoDB backend) — not the k3s/Argo GitOps path, so this one legitimately applies on merge rather than via Argo sync. The CLAUDE.md "prod stays GitOps" rule is about the cluster (helm/Argo); the Contabo node itself is provisioned by this Terraform.

BLOCKED: operator action required — nothing to fix in code. Review PR #189's plan comment and merge it to main to apply the reviewed 1-node plan; the drift-gate red X is expected and should be merged past deliberately.

[izzywdev]

Recurred: https://github.com/izzywdev/FuzeInfra/actions/runs/28938459352