Render web service doesn't read from the linked environment group on the first try

[ahmadabdelhalim]

Hello,

I'm trying to link an existing environment group (already linked to an existing service on render) to a new web service. The linking is indeed working as expected, but the web service fails the first time it gets deployed because it's missing the environment variables needed to be successful, even though the environment group is linked correctly when I check Render. However, when I re-deploy manually from Render, it works as expected. Is that a race condition, or do I need to handle things differently?

these are my services

data "render_env_group" "staging" {
  id = var.staging_env_group_id
}

resource "render_web_service" "pr_web_service" {
  name              = "pr-${var.pr_branch}-web"
  plan              = "starter"
  region            = "frankfurt"
  start_command     = "bundle exec puma -C config/puma.rb"
  health_check_path = "/health"

  runtime_source = {
    native_runtime = {
      auto_deploy   = false
      branch        = var.pr_branch
      build_command = "./bin/render-build.sh"
      repo_url      = "testing"
      runtime       = "ruby"
    }
  }

  maintenance_mode = {
    enabled = false
    uri     = ""
  }
}

resource "render_env_group_link" "pr_web_service_env_link" {
  env_group_id = data.render_env_group.staging.id
  service_ids  = [render_web_service.pr_web_service.id]
}

and that's my workflow

name: Create PR Environment

on:
  pull_request:
    types: [opened, reopened, synchronize]

jobs:
  create_pr_environment:
    runs-on: ubuntu-latest
    name: Create PR Environment
    env:
      RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
      RENDER_OWNER_ID: ${{ secrets.RENDER_OWNER_ID }}
      TF_VAR_pr_number: ${{ github.event.pull_request.number }}
      TF_VAR_pr_branch: ${{ github.head_ref }}
      TF_VAR_staging_env_group_id: ${{ secrets.RENDER_STAGING_ENV_GROUP_ID }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: terraform init
        working-directory: terraform
        run: terraform init

      - name: terraform import (env group link)
        working-directory: terraform
        run: terraform import render_env_group_link.pr_web_service_env_link $TF_VAR_staging_env_group_id || echo "Already imported"

      - name: terraform apply
        uses: dflook/terraform-apply@v1
        with:
          path: terraform
          auto_approve: true
          
      - name: Get Terraform Outputs
        id: terraform-outputs
        uses: dflook/terraform-output@v1
        with:
          path: terraform
          
      - name: Comment PR
        uses: actions/github-script@v7
        env:
          WEB_URL: ${{ steps.terraform-outputs.outputs.pr_web_service_url }}
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `PR Environment created successfully!
              
              Web Service URL: ${process.env.WEB_URL}
              
              You can view the full deployment details in the Actions tab.`
            })