Pin the tool and provider versions

How to do it

Set required_version and a version for each provider in required_providers. Commit .terraform.lock.hcl, and fill in hashes for Linux and the laptops' platforms with providers lock. In CI, run init -lockfile=readonly, so a changed provider stops the build. Let a bot such as Renovate open the upgrade pull requests, as in automated dependency updates. Pulumi programs commit their package lock file instead.

Example

terraform {
  required_version = "~> 1.11"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

tofu providers lock -platform=linux_amd64 -platform=linux_arm64 -platform=darwin_arm64
git add .terraform.lock.hcl

How to check

git ls-files .terraform.lock.hcl prints the file. init -lockfile=readonly passes in CI. The terraform block sets required_version, and every provider block names a version.