From 3880a9876c4aa3e9ac200724e41df3ed6ed86d68 Mon Sep 17 00:00:00 2001
From: Alexandr <a.dibrov@hh.ru>
Date: Wed, 25 Mar 2026 09:54:06 +0300
Subject: [PATCH] Persist and restore terraform state on runner

---
 .gitea/workflows/terraform-dev.yml | 63 +++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/terraform-dev.yml b/.gitea/workflows/terraform-dev.yml
index 61d88df..2009655 100644
--- a/.gitea/workflows/terraform-dev.yml
+++ b/.gitea/workflows/terraform-dev.yml
@@ -1,5 +1,6 @@
 # Все корни Terraform в environments/dev/<имя>/ (файл main.tf).
-# Новая организация = новая папка — workflow подхватит её без правки этого файла.
+# State на диске раннера: /var/lib/terraform-state/grafana-dev/<имя>/terraform.tfstate
+# (без S3; один persistent path на хосте act_runner).
 
 name: terraform-dev
 
@@ -27,6 +28,7 @@ env:
   TF_IN_AUTOMATION: "true"
   TF_INPUT: "false"
   TF_CLI_ARGS_init: "-backend=false -plugin-dir=/root/.terraform.d/plugins"
+  STATE_ROOT: "/var/lib/terraform-state/grafana-dev"
 
 jobs:
   validate:
@@ -47,11 +49,25 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
+            restore_state "$d"
             (cd "$d" && terraform init && terraform validate)
           done
           if [ "$found" -eq 0 ]; then
@@ -72,11 +88,25 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
+            restore_state "$d"
             (cd "$d" && terraform init && terraform plan -refresh=false -lock=false -out=tfplan)
           done
           if [ "$found" -eq 0 ]; then
@@ -98,12 +128,41 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
+          save_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${dir}/terraform.tfstate" ]; then
+              cp -f "${dir}/terraform.tfstate" "${sdir}/terraform.tfstate"
+              chmod 600 "${sdir}/terraform.tfstate" 2>/dev/null || true
+              echo "Saved state: ${dir} -> ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
-            (cd "$d" && terraform init && terraform apply -refresh=false -lock=false -auto-approve)
+            restore_state "$d"
+            rc=0
+            (cd "$d" && terraform init && terraform apply -refresh=false -lock=false -auto-approve) || rc=$?
+            save_state "$d"
+            [ "$rc" -eq 0 ] || exit "$rc"
           done
           if [ "$found" -eq 0 ]; then
             echo "No environments found under environments/dev/*/ with main.tf"