From 292392a024cc0c944e690601aed03c002a1d99a4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Fri, 3 Jul 2026 21:48:57 +1000 Subject: [PATCH] fix(ci): clear stale provider locks before init The provider source moved from git.unkin.net/unkin/artifactapi to artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi. .terraform.lock.hcl is gitignored, so a CI runner reusing a workspace/cache keeps a lock pinning the old source; some OpenTofu versions then try to re-resolve git.unkin.net (which isn't a registry) instead of dropping it, failing init. Delete any .terraform.lock.hcl before `terragrunt run --all init -- -upgrade` so providers resolve purely from config. --- Makefile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Makefile b/Makefile index 5b986d7..56e74f8 100644 --- a/Makefile +++ b/Makefile @@ -16,6 +16,11 @@ define vault_env endef init: + @# Drop any stale dependency locks so provider sources are re-resolved + @# purely from config. Locks are gitignored and CI can reuse a workspace + @# carrying a lock from an earlier (old provider source) run, which -upgrade + @# on some OpenTofu versions tries to re-resolve instead of dropping. + @find . -name '.terraform.lock.hcl' -not -path '*/.git/*' -delete @$(call vault_env) && \ terragrunt run --all --non-interactive init -- -upgrade