We turned on auto-merge for Dependabot security PRs. Within a day, deploys started failing with a GCS 412 Precondition Failed on the Terraform state lock.

The cause is mechanical: the sweeper merges several PRs for the same service back to back, every merge pushes main , every push to main starts a deploy workflow, and every deploy runs terraform apply against the same state object. Two apply runs, one lock, one loser.

concurrency is the right tool. But the obvious way to apply it is wrong in three separate ways, and we hit all three before landing on an eleven-line block. This is what we learned.

The primitive

concurrency : group : <any string or expression> cancel-in-progress : false queue : single # default

Enter fullscreen mode

Exit fullscreen mode

Two facts about the runtime matter more than the syntax:

A concurrency group holds at most one running and one pending entry.…