deploy scripts: per-region TF_DATA_DIR isolation + demo-seed prompt#1287
Merged
Conversation
app_stack/ kept Terraform's working data in one shared .terraform, and each
env/region was selected via `init -reconfigure -backend-config=...`. So two runs
against different backends — e.g. an ap-south-1 deploy while us-east-1 was being
destroyed — clobbered each other's backend pointer mid-run: the deploy applied
fine but its closing `terraform output` then read the wrong region's state
("Output not found") and silently skipped the SPA publish.
Fix: deploy.sh/deploy.ps1/destroy.ps1 now set TF_DATA_DIR to an absolute
app_stack/.terraform/<env>-<region> before any terraform call, giving each
env/region its own backend pointer, providers, and modules. Concurrent runs
across regions can no longer collide — no "run them one at a time" caveat.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
deploy.sh/deploy.ps1 now ask "Seed demo tenants (acme/globex)?" before the apply. Skipped when already chosen (--seed-demo/-SeedDemo), not migrating (--skip-migrate), or unattended (--auto-approve / no TTY) so CI never blocks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
iammukeshm
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two deploy-script changes.
1. Isolate Terraform data dir per env/region (
TF_DATA_DIR)Problem
app_stack/keeps Terraform working data in a single shared.terraform/, and each env/region is selected per-run viaterraform init -reconfigure -backend-config=envs/<env>/<region>/backend.hcl. That makes concurrent runs against different backends unsafe: whichever runsinit -reconfigurelast repoints the shared backend pointer for both.Observed: an
ap-south-1deploy and aus-east-1destroy overlapped. The deploy'sapply+ migrator succeeded, but in the gap before its frontend step the destroy'sinitrepointed the backend to us-east-1. The deploy's closingterraform output dashboard_site/admin_site/api_urlthen read the wrong state → "Output not found" → the SPA publish was silently skipped (infra was fine; only the file publish was missed).Fix
deploy.sh,deploy.ps1,destroy.ps1setTF_DATA_DIRto an absoluteapp_stack/.terraform/<env>-<region>before any terraform call. Each env/region gets its own data dir (backend pointer, providers, modules), so two runs against different backends physically cannot share — and clobber — the same pointer..terraform/is already gitignored.Verification
Ran end-to-end against the live
dev/ap-south-1stack:initinto a fresh.terraform/dev-ap-south-1/,apply→No changes, both SPAs built/synced (dashboard 95 objects, admin 65) + CloudFront invalidated — the previously-skipped publish now completes.2. Prompt to seed demo tenants when not specified
deploy.sh/deploy.ps1now askSeed demo tenants (acme/globex)?before the apply. Skipped when already chosen (--seed-demo/-SeedDemo), not migrating (--skip-migrate), or unattended (--auto-approve/ no TTY), so CI never blocks.bash -n+ PowerShell parser checks pass on all scripts.🤖 Generated with Claude Code