Skip to content

Plan without taking the state lock #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oskarbarcz merged 1 commit into from
Nov 9, 2026
Merged

Plan without taking the state lock #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/drift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
- name: Plan (fails on drift)
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: tofu plan -input=false -lock-timeout=10m -detailed-exitcode -out=tfplan
run: tofu plan -input=false -lock=false -detailed-exitcode -out=tfplan

- name: Report the plan
if: always()
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/plan.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ jobs:
- name: Plan
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: tofu plan -input=false -lock-timeout=10m -out=tfplan
run: tofu plan -input=false -lock=false -out=tfplan

- name: Report the plan
if: always()
Expand Down
8 changes: 5 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,10 @@ on), next to the other MyPreflight buckets; `infra/backend.hcl` points the S3 ba
Spaces key `github-iac` can read and write only this bucket.

Spaces ignores conditional writes, so the lock file (`use_lockfile`) does not actually stop two runs
at once. Only `apply` writes state, and the apply workflow never runs twice in parallel (`concurrency`);
don't apply locally while it runs.
at once, and a run that overlaps another fails when it releases the lock. Only `apply` writes state, so
only the apply workflow takes the lock, and it never runs twice in parallel (`concurrency`). The plan
and drift workflows run `tofu plan -lock=false`; do the same locally, and don't apply locally while
the apply workflow runs.

State is encrypted client-side with a passphrase before upload. **Losing the passphrase means losing
the state.** The passphrase and the Spaces key are in the macOS login keychain (account
Expand Down Expand Up @@ -98,7 +100,7 @@ export TF_VAR_state_passphrase="$(security find-generic-password -a mypreflight-
export AWS_ACCESS_KEY_ID="$(security find-generic-password -a mypreflight-github-iac -s state-access-key-id -w)"
export AWS_SECRET_ACCESS_KEY="$(security find-generic-password -a mypreflight-github-iac -s state-secret-access-key -w)"
tofu init -backend-config=backend.hcl
tofu plan
tofu plan -lock=false
```

The committed `config/*.yaml` and `infra/imports.tf` were already generated this way, and
Expand Down