From 65090ca9d6c43f12b662c611fad17068e5f86174 Mon Sep 17 00:00:00 2001
From: "Rasmus \"Pez\" Wejlgaard" <pez@pez.sh>
Date: Tue, 2 Jun 2026 19:39:13 +0100
Subject: [PATCH] ci: serialize terraform and deploy runs with concurrency
 guards (#114)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* ci: serialize infra runs and enable terraform state locking

Add concurrency guards to the terraform and deploy-on-merge workflows so
two merges in quick succession can't run against the same state or the
same hosts at once (queue, never cancel an in-flight run).

Enable native S3 state locking (use_lockfile) on the Backblaze B2 backend,
which needs OpenTofu 1.10+, so bump the CI tofu version 1.9.0 -> 1.10.10
and the required_version constraint to >= 1.10.0.

* ci: bump tofu to 1.10.10 in the validate workflow too

Missed this one in the last commit — the PR-time validate still pinned
1.9.0, which trips the new required_version >= 1.10.0 constraint.

* ci: drop use_lockfile — Backblaze B2 can't do native state locking

B2's S3 API returns 501 NotImplemented for the conditional PutObject that
use_lockfile relies on, so tofu plan/apply fails to acquire the lock.
Revert the lockfile and the 1.10 version bump it required; rely on the
concurrency guard to serialize applies instead. Left a note in the
backend block so this isn't re-attempted.
---
 .github/workflows/deploy-on-merge.yml | 6 ++++++
 .github/workflows/terraform.yml       | 7 +++++++
 terraform/providers.tf                | 4 ++++
 3 files changed, 17 insertions(+)

diff --git a/.github/workflows/deploy-on-merge.yml b/.github/workflows/deploy-on-merge.yml
index 15db35f..953f952 100644
--- a/.github/workflows/deploy-on-merge.yml
+++ b/.github/workflows/deploy-on-merge.yml
@@ -7,6 +7,12 @@ on:
     paths-ignore:
       - "terraform/**"
 
+# Serialize fleet deploys so two quick merges can't run Ansible against the
+# same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.
+concurrency:
+  group: deploy-on-merge
+  cancel-in-progress: false
+
 jobs:
   discover:
     name: Discover hosts
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 7d97dda..1e3071f 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -10,6 +10,13 @@ on:
 # Requires these repository secrets:
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
 
+# Serialize Terraform runs so two merges can't apply against the state
+# concurrently. Never cancel an in-flight run (an interrupted apply can
+# corrupt state) — queue instead.
+concurrency:
+  group: terraform-state
+  cancel-in-progress: false
+
 jobs:
   plan:
     name: Plan
diff --git a/terraform/providers.tf b/terraform/providers.tf
index 69f73a5..3260ffe 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -24,6 +24,10 @@ terraform {
     region                      = "eu-central-003"
     skip_credentials_validation = true
     skip_region_validation      = true
+    # NOTE: no state locking — Backblaze B2's S3 API doesn't implement the
+    # conditional PutObject that OpenTofu's use_lockfile needs (returns 501
+    # NotImplemented). Concurrent applies are instead prevented by the
+    # `concurrency` guard in .github/workflows/terraform.yml.
     # Credentials read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars
   }
 }