CI failure: terraform-plan-apply on claude/ci-runner-replan

[izzywdev]

@claude the deploy workflow terraform-plan-apply failed on claude/ci-runner-replan (event: pull_request).

Run: https://github.com/izzywdev/FuzeInfra/actions/runs/28942513849

This is a deploy-path failure (not app CI). Diagnose from the run log. If it is a credential/permission problem (e.g. a token missing a scope), that is an operator action — say so plainly rather than attempting a code fix. Prod stays GitOps (edit repo -> Argo).

failed-step log (tail)

/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0577460Z includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0578296Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0586833Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0609310Z /home/runner/work/_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0620682Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path /home/runner/work/_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0655878Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0676631Z /home/runner/work/_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0686461Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0729990Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0756834Z /github/runner_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0760223Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0788052Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0807983Z /github/runner_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0815591Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.0845833Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.1029400Z Removing credentials config '/home/runner/work/_temp/git-credentials-b47089b4-8949-42bd-b8c0-5c99577cd1ee.config'
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.1154846Z Cleaning up orphan processes
plan (terraform/contabo)	UNKNOWN STEP	2026-07-08T12:28:07.1406161Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/github-script@v7, dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590, hashicorp/setup-terraform@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[claude]

Claude finished @izzywdev's task in 1m 43s —— View job

---

terraform-plan-apply on claude/ci-runner-replan (PR #191) — diagnosis

• Pull the full run log for run 28942513849
• Locate the actual failing step
• Determine root cause (code bug vs. credential/permission vs. by-design)
• Report verdict + operator action

Verdict: not a bug, not a credential problem — the drift gate fired as designed. No code fix.

The log tail in the issue is just the post-job git-credential cleanup (a red herring). The real failure is the last step of the plan job:

##[error]terraform plan is NON-EMPTY — config and live state differ (drift or
unapplied changes). ... Reconcile/import until clean, or merge deliberately to
apply the reviewed plan.
##[error]Process completed with exit code 1.

Everything upstream succeeded:

• ✅ terraform init (S3 backend configured), validate, and plan all ran clean — the only diagnostics were deprecation warnings (dynamodb_table, cloudflare_worker_script, value→content), not errors.
• ✅ Plan result: Plan: 1 to add, 0 to change, 0 to destroy — it creates module.ci_workers.contabo_instance.node["fuzeinfra-ci-runner-1"] (driven by TF_VAR_ci_worker_count: "1").
• ✅ The saved plan was uploaded as artifact tfplan-7510db1… and posted as a PR comment.

The job then hit the intentional drift gate (terraform-plan-apply.yml:220-224): a non-empty plan on a PR fails the check on purpose, after the plan is saved + commented, so a green check can mean "state matches config." A PR that deliberately provisions infra is expected to show red here — and the apply job explicitly recovers artifacts from this intentionally-failed run (workflow_conclusion: "", lines 265-271).

What this means for claude/ci-runner-replan

This PR exists precisely to (re)provision the CI runner node, so a 1 to add plan is exactly the intended outcome. There is nothing to reconcile and nothing in the repo to fix. The credential wiring is fine — every TF_VAR_* / AWS backend secret was present and the plan authenticated to Contabo, Cloudflare, and the S3 backend without error.

Operator action (this is a human/merge decision, not a code change)

1. Review the terraform plan comment on PR chore(tf): replan CI runner node (stale plan refresh) #191 — confirm it's only the contabo_instance.node["fuzeinfra-ci-runner-1"] create (it is).
2. Merge PR chore(tf): replan CI runner node (stale plan refresh) #191 deliberately, past the red plan check. PR chore(tf): replan CI runner node (stale plan refresh) #191 is MERGEABLE but BLOCKED solely by this required-but-intentionally-red check — an admin merge (or a temporary bypass) is what applies the reviewed plan. Merge → push-to-main → the apply job downloads the exact saved plan and runs terraform apply tfplan, provisioning the runner.

No changes pushed to this branch — there's nothing to change. The "CI failure" is the drift gate doing its job; the fix is to merge the reviewed plan.

DONE: terraform-plan-apply "failure" is the intentional drift gate on a non-empty (expected) plan for the CI-runner-node create — not a bug or credential issue. Operator action: review + deliberately merge PR #191 to apply the saved plan.
· branch claude/issue-192-20260708-1228