From 371f0918faa105b31adae15da2db1f557026ca45 Mon Sep 17 00:00:00 2001
From: Reece Holmdahl <3149587+reecelikesramen@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:21:00 -0600
Subject: [PATCH] fix(infra): don't fail the main plan while an apply is
 pending

Merging infra changes and then running Infra apply is the normal flow, so
the plan on the merge commit is always non-empty until the apply runs.
Report it as a notice with the plan in the job summary instead of failing.
Plan errors still fail, and the weekly drift check still opens an issue.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013n1oPa64gxZ6ELaFaMeo3X
---
 .github/workflows/infra-plan.yml | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/infra-plan.yml b/.github/workflows/infra-plan.yml
index b295073..c76fc29 100644
--- a/.github/workflows/infra-plan.yml
+++ b/.github/workflows/infra-plan.yml
@@ -83,13 +83,29 @@ jobs:
               await github.rest.issues.createComment({ ...context.repo, issue_number: context.issue.number, body });
             }
 
-      - name: Enforce converged state (push to main)
-        # On main, a non-empty plan means applied infra no longer matches the repo.
-        if: github.event_name == 'push' && steps.plan.outputs.exitcode != '0'
+      - name: Report plan on main (push)
+        # Merge first, apply second is the normal flow, so a non-empty plan
+        # right after a merge is pending work, not a failure. Only a plan
+        # that errors fails. Drift that lingers is caught by the weekly check.
+        if: github.event_name == 'push'
         run: |
+          code='${{ steps.plan.outputs.exitcode }}'
           cat plan.txt
-          echo "::error title=Infrastructure drift::main does not match applied state — run the 'Infra apply' workflow to converge."
-          exit 1
+          if [ "$code" = "0" ]; then
+            echo "Infrastructure matches main." >>"$GITHUB_STEP_SUMMARY"
+          elif [ "$code" = "2" ]; then
+            echo "::notice title=Infra changes pending::main has changes that are not applied yet. Run the 'Infra apply' workflow."
+            {
+              echo "### Infra changes pending"
+              echo "Run the **Infra apply** workflow to apply them."
+              echo '```hcl'
+              tail -c 50000 plan.txt
+              echo '```'
+            } >>"$GITHUB_STEP_SUMMARY"
+          else
+            echo "::error title=Terraform plan failed::See the plan output above."
+            exit 1
+          fi
 
       - name: Open drift issue (scheduled check)
         if: github.event_name == 'schedule' && steps.plan.outputs.exitcode != '0'