From edf0cd66ddea657f6e29773e4ce266f51ea2ceb6 Mon Sep 17 00:00:00 2001
From: Liam Cervante <liam.cervante@hashicorp.com>
Date: Tue, 21 Oct 2025 23:13:25 +0200
Subject: [PATCH] actions: fail invoke plans when action configurations are
 unknown (#37793)

---
 .../terraform/context_plan_actions_test.go    | 37 +++++++++++++++++++
 internal/terraform/node_action_invoke.go      | 14 +++++++
 2 files changed, 51 insertions(+)

diff --git a/internal/terraform/context_plan_actions_test.go b/internal/terraform/context_plan_actions_test.go
index ecb6d4386a..e3f0c50cb1 100644
--- a/internal/terraform/context_plan_actions_test.go
+++ b/internal/terraform/context_plan_actions_test.go
@@ -2726,6 +2726,43 @@ action "test_action" "one" {
 				},
 			},
 
+			"invoke action with partially applied configuration": {
+				module: map[string]string{
+					"main.tf": `
+resource "test_object" "a" {
+  name = "hello"
+}
+
+action "test_action" "one" {
+  config {
+    attr = test_object.a.name
+  }
+}
+`,
+				},
+				planOpts: &PlanOpts{
+					Mode: plans.RefreshOnlyMode,
+					ActionTargets: []addrs.Targetable{
+						addrs.AbsAction{
+							Action: addrs.Action{
+								Type: "test_action",
+								Name: "one",
+							},
+						},
+					},
+				},
+				expectPlanActionCalled: false,
+				assertPlanDiagnostics: func(t *testing.T, diagnostics tfdiags.Diagnostics) {
+					if len(diagnostics) != 1 {
+						t.Errorf("expected exactly one diagnostic but got %d", len(diagnostics))
+					}
+
+					if diagnostics[0].Description().Summary != "Partially applied configuration" {
+						t.Errorf("wrong diagnostic: %s", diagnostics[0].Description().Summary)
+					}
+				},
+			},
+
 			"non-referenced resource isn't refreshed during invoke": {
 				module: map[string]string{
 					"main.tf": `
diff --git a/internal/terraform/node_action_invoke.go b/internal/terraform/node_action_invoke.go
index af8928a250..7d9ef4c51f 100644
--- a/internal/terraform/node_action_invoke.go
+++ b/internal/terraform/node_action_invoke.go
@@ -165,6 +165,20 @@ func (n *nodeActionInvokeInstance) Execute(ctx EvalContext, _ walkOperation) tfd
 	}
 
 	unmarkedConfig, _ := actionInstance.ConfigValue.UnmarkDeepWithPaths()
+
+	if !unmarkedConfig.IsWhollyKnown() {
+		// we're not actually planning or applying changes from the
+		// configuration. if the configuration of the action has unknown values
+		// it means one of the resources that are referenced hasn't actually
+		// been created.
+		return diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Partially applied configuration",
+			Detail:   fmt.Sprintf("The action %s contains unknown values while planning. This means it is referencing resources that have not yet been created, please run a complete plan/apply cycle to ensure the state matches the configuration before using the -invoke argument.", n.Target.String()),
+			Subject:  n.Config.DeclRange.Ptr(),
+		})
+	}
+
 	resp := provider.PlanAction(providers.PlanActionRequest{
 		ActionType:         n.Target.Action.Action.Type,
 		ProposedActionData: unmarkedConfig,