CI failure: terraform-plan-apply on claude/issue-255-20260714-1357

[izzywdev]

@claude the deploy workflow terraform-plan-apply failed on claude/issue-255-20260714-1357 (event: pull_request).

Run: https://github.com/izzywdev/FuzeInfra/actions/runs/29338841883

This is a deploy-path failure (not app CI). Diagnose from the run log. If it is a credential/permission problem (e.g. a token missing a scope), that is an operator action — say so plainly rather than attempting a code fix. Prod stays GitOps (edit repo -> Argo).

failed-step log (tail)

/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0095711Z includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0096121Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0102146Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0120454Z /home/runner/work/_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0128586Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git.path /home/runner/work/_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0156153Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0173502Z /home/runner/work/_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0180973Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/FuzeInfra/FuzeInfra/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0212263Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0229600Z /github/runner_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0235625Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0260669Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0277706Z /github/runner_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0285592Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0310290Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0474124Z Removing credentials config '/home/runner/work/_temp/git-credentials-b8922f37-11e2-425c-983e-a839129c232b.config'
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0594127Z Cleaning up orphan processes
plan (terraform/contabo)	UNKNOWN STEP	2026-07-14T13:59:58.0822967Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/github-script@v7, dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590, hashicorp/setup-terraform@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[claude]

Claude finished @izzywdev's task in 1m 40s —— View job

---

Diagnosis: terraform-plan-apply on claude/issue-255-20260714-1357

• Read the failing workflow (terraform-plan-apply.yml)
• Fetch the actual failing-step error from run 29338841883
• Determine root cause (code vs credential/permission)
• Report findings

TL;DR — working as designed, no bug, no credential problem

The tail in the issue was just checkout post-cleanup. The real failing step is the last one in the plan job:

Plan: 0 to add, 0 to change, 1 to destroy.
##[error]terraform plan is NON-EMPTY — config and live state differ
         (drift or unapplied changes)... merge deliberately to apply the reviewed plan.
##[error]Process completed with exit code 1.

terraform plan succeeded (init/validate/plan all passed, creds were present and valid). The check went red because the drift gate (terraform-plan-apply.yml:220-224) intentionally exit 1s whenever a plan is non-empty. That's the designed behavior for a PR that changes terraform/**.

What the plan actually contains

# cloudflare_record.vanity["auth"] will be destroyed
# (because key ["auth"] is not in for_each map)
- resource "cloudflare_record" "vanity" { ... }
Plan: 0 to add, 0 to change, 1 to destroy.

This is the intended change of PR #268 itself — "feat(cloudflare): drop public auth.fuzefront.com tunnel route/DNS" (Closes #255). That PR removes "auth" from local.public_vanity_hosts, so Terraform plans to destroy cloudflare_record.vanity["auth"]. The single destroy is exactly what the PR is supposed to do — it is not phantom drift (no random_bytes/tunnel secret rotation, which is what the pinned TERRAFORM_VERSION 1.15.6 guards against).

This is not a FuzeInfra code defect and not an operator/credential action

• Not a token-scope/permission problem — every terraform init/validate/plan step ran clean.
• Not a workflow bug — the red check is the drift gate doing its job: a reviewable plan was posted as a PR comment on feat(cloudflare): drop public auth.fuzefront.com tunnel route/DNS #268 and saved as the tfplan-<head-sha> artifact for the apply job.

What to actually do (on PR #268, not here)

1. Review the plan comment on feat(cloudflare): drop public auth.fuzefront.com tunnel route/DNS #268. Confirm destroying cloudflare_record.vanity["auth"] is intended (it is — that's the point of the PR).
2. Merge feat(cloudflare): drop public auth.fuzefront.com tunnel route/DNS #268 deliberately past the red plan check. On push to main, the apply job downloads that exact reviewed plan and runs terraform apply tfplan (prod stays GitOps: edit-repo → apply/Argo). A green plan check only ever means "zero changes"; any real terraform change PR is expected to show red here.

Since the remaining action lives entirely on PR #268 (review + deliberate merge) and there is no FuzeInfra code/workflow fix to make, there is nothing to change on this issue's branch.

DONE: terraform-plan-apply did not malfunction — the drift gate correctly flagged PR #268's intended 1-resource destroy (cloudflare_record.vanity["auth"]). No code fix or credential change needed; review the plan on #268 and merge it deliberately to apply.
· branch claude/issue-269-20260714-1400

[izzywdev]

Closing — this was a CI failure on a branch that no longer exists (branch deleted or superseded). The failure was diagnosed at the time as expected behavior (drift gate) or the work was completed and merged. No action needed.