CI failure: terraform-plan-apply on claude/issue-242-20260710-1457

[izzywdev]

@claude the deploy workflow terraform-plan-apply failed on claude/issue-242-20260710-1457 (event: pull_request).

Run: https://github.com/izzywdev/FuzeInfra/actions/runs/29102364778

This is a deploy-path failure (not app CI). Diagnose from the run log. If it is a credential/permission problem (e.g. a token missing a scope), that is an operator action — say so plainly rather than attempting a code fix. Prod stays GitOps (edit repo -> Argo).

failed-step log (tail)

/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3812897Z includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3813461Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3818722Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3840806Z /home/runner/work/_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3851115Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path /home/runner/work/_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3883824Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3907422Z /home/runner/work/_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3922062Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3958294Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3981658Z /github/runner_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.3988312Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4018627Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4042078Z /github/runner_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4048946Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4079860Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4266424Z Removing credentials config '/home/runner/work/_temp/git-credentials-c0a41597-a519-4735-824a-d8bbdb517f64.config'
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4386808Z Cleaning up orphan processes
plan (terraform/contabo)	UNKNOWN STEP	2026-07-10T15:06:32.4642590Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/github-script@v7, dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590, hashicorp/setup-terraform@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[claude]

Claude finished @izzywdev's task in 1m 19s —— View job

---

Diagnosis: terraform-plan-apply — working as designed (drift gate)

• Pulled the full run log for run 29102364778
• Traced the actual failing step
• Determined root cause

What actually happened

The log tail in the issue is just checkout cleanup noise. The real story is earlier: terraform plan succeeded cleanly. Init, validate, and plan all ran, the plan was saved (-out=tfplan), posted as a PR comment, and uploaded as an artifact. The plan result was:

Plan: 6 to add, 0 to change, 0 to destroy.

The job then failed on this intentional step:

##[error]terraform plan is NON-EMPTY — config and live state differ
(drift or unapplied changes). ... Reconcile/import until clean, or
merge deliberately to apply the reviewed plan.
##[error]Process completed with exit code 1.

That is the drift gate in .github/workflows/terraform-plan-apply.yml (the "Fail the check on a non-empty plan (drift)" step, lines 220‑224). By design, a non-empty plan turns the required check red — after saving + commenting the plan — so a green check guarantees "state matches config," and a red one flags that merging will change infrastructure.

This is not a credential or permission problem

Everything authenticated fine: the S3/DynamoDB backend initialized, providers installed, and the Cloudflare/Contabo APIs were reachable (state refreshed successfully). No token is missing a scope. No operator action and no code fix are required.

Why the plan is non-empty

PR #243 (issue-242) materializes the FuzePicker consumer — it modifies terraform/contabo/materialized/consumers.tfvars and adds argocd/applications/fuzepicker.yaml, argocd/projects/fuzepicker.yaml, and the sealed-secret. The 6 additions are the corresponding Cloudflare Zero Trust Access resources for FuzePicker:

• cloudflare_zero_trust_access_application.public_app["picker"] and ["api.fuzepicker"]
• cloudflare_zero_trust_access_policy.public_app_bypass["picker"] and ["api.fuzepicker"] (decision = "bypass", everyone = true — FuzePicker owns its own auth)
• plus the matching DNS/route entries

These are new, expected resources — genuine unapplied changes, not drift.

What to do

This is the normal flow for a PR that introduces new infra:

1. Review the terraform plan PR comment on claude/issue 242 20260710 1457 #243 — it is the apply approval. Confirm the 6 CF Access resources are what you intend for FuzePicker.
2. Merge claude/issue 242 20260710 1457 #243 deliberately. The red drift check is expected here; merge past it. On push to main, the apply job downloads the exact saved plan from this run (it explicitly matches workflow_conclusion: "", precisely so it can recover the plan from the intentionally-failed check — see lines 265‑271) and runs terraform apply tfplan.

Prod stays GitOps: the Helm/Argo side (fuzepicker Application/values) reconciles separately; this workflow only manages the Cloudflare + Contabo terraform layer.

DONE: No code change needed — the failure is the intended drift gate firing on a legitimately non-empty plan (6 new FuzePicker CF Access resources). Not a credential/scope issue. Review the plan comment on #243 and merge to apply.