An HCP Terraform workspace is connected to a VCS repository. Each pull request gets a plan linked from the pull request, but reviewers with apply permission find no way to apply those plans. What explains this behaviour?
Select an answer to reveal the explanation.
Short Explanation
Pull request plans are a dress rehearsal, not the show. They let you see what would happen, but there's no button to apply them, by design. The real performance starts when the change merges into the branch the workspace tracks.
Full Explanation
In the VCS-driven workflow, HCP Terraform queues normal runs when commits land on the workspace's tracked branch and runs speculative plans when pull requests are opened or updated against that branch, posting a link in the pull request. Speculative plans are plan-only runs: they show proposed changes and the policies those changes affect, but they cannot apply anything, and because they do not affect real infrastructure they can run without waiting for other runs. Merging the pull request triggers a normal run from that commit, which can then be applied manually or automatically depending on the workspace's apply settings. Permissions are not the cause; even workspace administrators cannot apply a speculative plan. Auto-apply affects normal runs only and never turns a speculative plan into an applyable one. Policy results do appear on speculative plans, but overriding a soft-mandatory failure would not create an apply stage that speculative runs do not have. Exam caveat: speculative plans can also be started from the CLI-driven workflow or the API, with the same plan-only behaviour. Operational check: after merging, confirm a new non-speculative run appears in the workspace's run list for the merge commit.