HCP Terraform "workspace already locked" in CI
HCP Terraform serializes runs per workspace. If a run is already in progress, or someone locked the workspace manually, a new operation is rejected with a lock error rather than running concurrently.
What this error means
A plan or apply against HCP Terraform fails with "Error: workspace <name> is currently locked" or "is locked by run run-...". Overlapping CI jobs on the same workspace trigger it.
Error: workspace "network-prod" is currently locked by run "run-abc123"
Terraform Cloud will not queue another run until the current one finishes or the
workspace is unlocked.Common causes
Two CI runs target the same workspace at once
Parallel jobs (a merge queue, a re-run) both drive the same workspace; the second one hits the lock the first one holds.
A manual or stranded lock
Someone locked the workspace in the UI, or a prior run crashed without releasing its lock, so new runs are blocked.
How to fix it
Serialize runs on the workspace
- Use a concurrency group so only one CI job drives the workspace at a time.
- Let the in-progress run finish instead of forcing a second one.
concurrency:
group: tfc-network-prod
cancel-in-progress: falseUnlock a stranded workspace deliberately
If a crashed run left the workspace locked, an authorized user can unlock it in the UI or via the API. Confirm no run is actually active first.
How to prevent it
- Gate workspace operations with a CI concurrency group.
- Avoid manual locks that outlive the person who set them.
- Investigate crashed runs that fail to release their lock.