Add support for ephemeral variables in terraform >= 1.10.0

These must be specified again when applying a saved plan, but must not be specified in earlier versions of Terraform or OpenTofu

Author: dflook

.github/workflows/test-apply.yaml

@@ -934,6 +934,7 @@ jobs:
       pull-requests: write
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TERRAFORM_VERSION: "<1.10.0"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -980,6 +981,47 @@ jobs:
             exit 1
           fi
 
+  deprecated_var_ephemeral:
+    runs-on: ubuntu-24.04
+    name: Nice error message for ephemeral var
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TERRAFORM_VERSION: ">=1.10.0"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Plan
+        uses: ./terraform-plan
+        with:
+          label: test-apply deprecated_var_terraform_1_10
+          path: tests/workflows/test-apply/deprecated_var
+          var: my_var=hello
+          var_file: tests/workflows/test-apply/test.tfvars
+
+      - name: Apply
+        uses: ./terraform-apply
+        id: apply
+        with:
+          label: test-apply deprecated_var_terraform_1_10
+          path: tests/workflows/test-apply/deprecated_var
+          var: my_var=hello
+          var_file: tests/workflows/test-apply/test.tfvars
+
+      - name: Check failed to apply
+        env:
+          OUTCOME: ${{ steps.apply.outcome }}
+        run: |
+          if [[ "$OUTCOME" != "failure" ]]; then
+            echo "Apply did not fail correctly"
+            exit 1
+          fi
+
   apply_refresh:
     runs-on: ubuntu-24.04
     name: Apply changes are refresh
@@ -1474,7 +1516,7 @@ jobs:
         with:
           label: test-apply ephemeral 2
           path: tests/workflows/test-apply/ephemeral
-          variables:
+          variables: |
             region = "eu-west-1"
             mv = "hello"
 
@@ -1484,7 +1526,7 @@ jobs:
         with:
           label: test-apply ephemeral 2
           path: tests/workflows/test-apply/ephemeral
-          variables:
+          variables: |
             region = "eu-west-1"
             mv = "hello"
 
@@ -1504,7 +1546,7 @@ jobs:
         with:
           label: test-apply ephemeral 3
           path: tests/workflows/test-apply/ephemeral
-          variables:
+          variables: |
             region = "eu-west-2"
             mv = "goodbye"
 
@@ -1515,7 +1557,7 @@ jobs:
         with:
           label: test-apply ephemeral 3
           path: tests/workflows/test-apply/ephemeral
-          variables:
+          variables: |
             region = "eu-west-2"
             mv = "mismatch"
 

image/entrypoints/apply.sh

@@ -86,6 +86,10 @@ function apply() {
     elif [[ $APPLY_EXIT -eq 0 ]]; then
         output
         update_comment apply-complete "$STEP_TMP_DIR/terraform_output.json"
+    elif [[ "$TOOL_PRODUCT_NAME" == "Terraform" && -n "$DEPRECATED_VAR_ARGS" ]] && test-terraform-version ">=" "1.10.0" && grep -q "Error: Can't change variable"; then
+        error_log "The deprecated 'var' input does not work with ephemeral variables in Terraform >= 1.10.0. Use the 'variables' input instead."
+        update_comment error
+        exit 1
     else
         if lock-info "$STEP_TMP_DIR/terraform_apply.stderr"; then
             set_output failure-reason state-locked