pal-e-docs

TODO: Use -lock=false for CI tofu plan (prevent state lock contention)

todo-tofu-plan-lock-false Todo

todo done
Project

Problem

CI tofu plan acquires a state lock on the Kubernetes backend. If a local tofu plan (e.g. from a worktree) is running concurrently, the CI step fails with "state is already locked by another tofu client."
Hit during PR #56 session — local plan from worktree held the lock, CI pipeline #26/#27/#28 all failed.

Fix

Add -lock=false to the CI tofu plan command in .woodpecker.yaml line 62. Plan is read-only and doesn't need the lock. Only tofu apply (the merge step) needs the lock.

Also document

Add to sop-platform-tf-changes: "Do not run local tofu plan while a PR CI pipeline is running. Use -lock=false for read-only plans."
  • sop-platform-tf-changes