Terraform GitHub Actions workflow locking state on merge to main

We’re trying to automate our CXone resource updates using the Genesys Cloud Terraform provider. The goal is a standard CI/CD flow: terraform plan runs on every PR, and terraform apply triggers only when the branch merges into main.

The plan step works fine. It outputs the diff correctly. The issue is the apply job. Every time a PR merges, the apply job fails immediately with this error:

Error: Error acquiring the state lock
Lock Info:
 ID: 8a9b7c6d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
 Path: cxone-infra/terraform.tfstate
 Operation: OperationTypeApply
 Who: actions-runner@github-host

It looks like the lock isn’t being released by the previous run, or the merge triggers two concurrent applies. Here is the relevant part of the workflow file:

apply:
 runs-on: ubuntu-latest
 needs: plan
 if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 steps:
 - uses: actions/checkout@v3
 - uses: hashicorp/setup-terraform@v2
 - run: terraform apply -auto-approve

We’re using S3 for backend state. The plan job doesn’t lock the state in a way that persists, right? Or is the merge event firing twice? We’ve tried adding a sleep but that feels wrong. Any ideas on how to handle the lock release in this specific GitHub Actions setup?