Copy early variables into auto tfvars for apply command

Author: dflook

.github/zizmor.yml

@@ -3,4 +3,5 @@ rules:
     config:
       policies:
         dflook/terraform-apply: ref-pin
+        dflook/terraform-plan: ref-pin
         actions/*: ref-pin

image/entrypoints/apply.sh

@@ -29,7 +29,7 @@ exec 3>&1
 function apply() {
     local APPLY_EXIT
 
-    set +e
+
     if [[ -n "$PLAN_OUT" ]]; then
 
         # With Terrraform >= 1.10 Ephemeral variables must be specified again in the apply command.
@@ -46,9 +46,10 @@ function apply() {
         # We have to put them in an auto tfvars file as a workaround.
 
         if [[ "$TOOL_PRODUCT_NAME" == "OpenTofu" && -n "$EARLY_VARIABLE_ARGS" ]]; then
-            create-auto-vars
+            create-auto-tfvars
         fi
 
+        set +e
         # shellcheck disable=SC2086
         debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -lock-timeout=300s $PARALLEL_ARG $SAVED_PLAN_VARIABLES $PLAN_OUT
         # shellcheck disable=SC2086
@@ -58,15 +59,17 @@ function apply() {
             | tee "$STEP_TMP_DIR/terraform_apply.stdout"
         APPLY_EXIT=${PIPESTATUS[0]}
         >&2 cat "$STEP_TMP_DIR/terraform_apply.stderr"
+        set -e
 
         if [[ "$TOOL_PRODUCT_NAME" == "OpenTofu" && -n "$EARLY_VARIABLE_ARGS" ]]; then
-            delete-auto-vars
+            delete-auto-tfvars
         fi
 
     else
         # There is no plan file to apply, since the remote backend can't produce them.
         # Instead we need to do an auto approved apply using the arguments we would normally use for the plan
 
+        set +e
         # shellcheck disable=SC2086,SC2016
         debug_log $TOOL_COMMAND_NAME apply -input=false -no-color -auto-approve -lock-timeout=300s $PARALLEL_ARG $PLAN_ARGS "$(masked-deprecated-vars)" $VARIABLE_ARGS
         # shellcheck disable=SC2086
@@ -76,9 +79,9 @@ function apply() {
             | tee "$STEP_TMP_DIR/terraform_apply.stdout"
         APPLY_EXIT=${PIPESTATUS[0]}
         >&2 cat "$STEP_TMP_DIR/terraform_apply.stderr"
+        set -e
 
     fi
-    set -e
 
     if [[ "$TERRAFORM_BACKEND_TYPE" == "cloud" || "$TERRAFORM_BACKEND_TYPE" == "remote" ]]; then
         if remote-run-id "$STEP_TMP_DIR/terraform_apply.stdout" "$STEP_TMP_DIR/terraform_apply.stderr" >"$STEP_TMP_DIR/remote-run-id.stdout" 2>"$STEP_TMP_DIR/remote-run-id.stderr"; then

tests/workflows/test-early-eval/s3/main.tf

@@ -44,5 +44,5 @@ terraform {
     }
   }
 
-  required_version = "1.8.8"
+  required_version = "1.9.0"
 }