---
title: "Comment by Tobias Dehn on \"Deploying Terraform at scale with GitHub Actions\" | Hashnode"
description: "Hi Facundo, Ty for your article. I'm currently testing GitHub actions with terraform. How would you handle it, if terraform apply fails after the pr is merg"
url: "https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de"
---

[Discussion](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631)

Comment [Deploying Terraform at scale with GitHub Actions](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631)

[Tobias Dehn](https://hashnode.com/@tdapoplex)

[Sep 27, 2022](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de)

Hi Facundo,

Ty for your article. I'm currently testing GitHub actions with terraform.

How would you handle it, if terraform apply fails after the pr is merged?

Best regards Tobi

[Facundo Gauna](https://hashnode.com/@gaunacode)

[Sep 27, 2022](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de#reply-63334283fa20fa4bc8e5051e)

Because trunk based development, I would treat a failed build like the most important thing to tackle and all other work is put aside. So I would create a branch, start another PR, and see if it plans again. Then merge the PR and continue until the issue is solved.

Sometimes, the issue is just a timeout in which case you can retry the GitHub action without opening PRs.

[Costis P](https://hashnode.com/@Costis)

[Oct 13, 2022](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de#reply-6347ec038213b93556f3152d)

The downside with applying after the PR is merged is that you end up 'polluting' the main branch with (possibly many) attempts to fix the problem. With that in mind, I do like the atlantis approach where you don't merge unless the branch has been applied successfully.

[Tobias Dehn](https://hashnode.com/@tdapoplex)

[Oct 13, 2022](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de#reply-634805ba8213b93556f31865)

Yes that is correct, but with terraform I like to have an approval step. Unfortunately, the only way to apply approval steps in Github Actions is via environment protection rules. And these are only available for private repositories with a Github Enterprise license.

[Diana Borbe](https://hashnode.com/@Dianab)

[Nov 22, 2022](https://hashnode.com/posts/deploying-terraform-at-scale-with-github-actions/6304cf503f9519428cceb631/comment/6332d10ffc1e3e483bf547de#reply-637c8dd0f3615bbe07eaf969)

[Tobias Dehn](https://hashnode.com/@tdapoplex) I'm already using Github environments and protection rules. The problem I have with the protection rules is that they prevent any job from running (any branch). I need to be able to see the terraform plan, then approve the apply step.