Persist and restore terraform state on runner

.gitea/workflows/terraform-dev.yml

@@ -1,5 +1,6 @@
 # Все корни Terraform в environments/dev/<имя>/ (файл main.tf).
-# Новая организация = новая папка — workflow подхватит её без правки этого файла.
+# State на диске раннера: /var/lib/terraform-state/grafana-dev/<имя>/terraform.tfstate
+# (без S3; один persistent path на хосте act_runner).
 
 name: terraform-dev
 
@@ -27,6 +28,7 @@ env:
   TF_IN_AUTOMATION: "true"
   TF_INPUT: "false"
   TF_CLI_ARGS_init: "-backend=false -plugin-dir=/root/.terraform.d/plugins"
+  STATE_ROOT: "/var/lib/terraform-state/grafana-dev"
 
 jobs:
   validate:
@@ -47,11 +49,25 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
+            restore_state "$d"
             (cd "$d" && terraform init && terraform validate)
           done
           if [ "$found" -eq 0 ]; then
@@ -72,11 +88,25 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
+            restore_state "$d"
             (cd "$d" && terraform init && terraform plan -refresh=false -lock=false -out=tfplan)
           done
           if [ "$found" -eq 0 ]; then
@@ -98,12 +128,41 @@ jobs:
           VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -euo pipefail
+          restore_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${sdir}/terraform.tfstate" ]; then
+              cp -f "${sdir}/terraform.tfstate" "${dir}/terraform.tfstate"
+              echo "Restored state: ${sdir} -> ${dir}"
+            else
+              echo "No saved state yet: ${sdir}"
+            fi
+          }
+          save_state() {
+            local dir="$1"
+            local name="${dir%/}"
+            name="${name##*/}"
+            local sdir="${STATE_ROOT}/${name}"
+            mkdir -p "$sdir"
+            if [ -f "${dir}/terraform.tfstate" ]; then
+              cp -f "${dir}/terraform.tfstate" "${sdir}/terraform.tfstate"
+              chmod 600 "${sdir}/terraform.tfstate" 2>/dev/null || true
+              echo "Saved state: ${dir} -> ${sdir}"
+            fi
+          }
           found=0
           for d in environments/dev/*/; do
             [ -f "${d}main.tf" ] || continue
             found=1
             echo "========== ${d} =========="
-            (cd "$d" && terraform init && terraform apply -refresh=false -lock=false -auto-approve)
+            restore_state "$d"
+            rc=0
+            (cd "$d" && terraform init && terraform apply -refresh=false -lock=false -auto-approve) || rc=$?
+            save_state "$d"
+            [ "$rc" -eq 0 ] || exit "$rc"
           done
           if [ "$found" -eq 0 ]; then
             echo "No environments found under environments/dev/*/ with main.tf"