Ensure running jobs run all the way when hitting cancel

As the title says: when cancelling the workflow run, I would like the jobs that have already started running to run until “the end”, independently of having received the cancel context. I considered using the if: always() condition in the job, but this would mean that, even if the workflow is canceled before this job has started, it will still run - this is not so much of the solution I would prefer.

The main reason for this is that I have a lot of terraform applies with lock state and, if we cancel runs midway, the terraform state gets locked and we risk corrupting state. Additionally, it means we have to police around the state lock and manually unlock it anytime the “next” pipeline fails because the previous one was shut down.

I am aware there is sometime grace period being given to jobs whenever the “cancel workflow” is hit, but it does not give me enough guarantees that it’s enough time for the terraform plan/apply to finish and state lock being naturally released.

Does workflow cancellation really have a grace period, or is it simply deferred because there’s a lot of stuff going on and it takes a moment until the service that controls this gets to the point where it actually terminates the run? There aren’t any details about this in the REST API docs at least: https://docs.github.com/en/rest/reference/actions#cancel-a-workflow-run

You should submit your idea via the feedback form.