From 9351ea30a9f8dbeeb792c9ba37a108a5ee62a6c0 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 3 Jul 2026 23:34:19 +1000
Subject: [PATCH] fix: declare provider requirement in the artifactapi module

pre-commit runs `tofu validate`/tflint on modules/artifactapi standalone, where
no required_providers was declared, so OpenTofu inferred hashicorp/artifactapi
and failed (and tflint flagged missing required_version/version constraint).

- add modules/artifactapi/versions.tf declaring required_version and the
  artifactapi provider (source = the registry, version >= 0.1.2)
- drop the now-duplicate required_providers from root.hcl's generated backend.tf;
  keep the provider config block + backend. Declaring it in both the module and
  the generated root would be a "Duplicate required providers" error at runtime.

Also revert the earlier init lock-cleanup: the CI failure was stale provider
references in state (fixed with `tofu state replace-provider`), not the lock.
---
 Makefile                        | 5 -----
 environments/root.hcl           | 6 ------
 modules/artifactapi/versions.tf | 9 +++++++++
 3 files changed, 9 insertions(+), 11 deletions(-)
 create mode 100644 modules/artifactapi/versions.tf

diff --git a/Makefile b/Makefile
index 56e74f8..5b986d7 100644
--- a/Makefile
+++ b/Makefile
@@ -16,11 +16,6 @@ define vault_env
 endef
 
 init:
-	@# Drop any stale dependency locks so provider sources are re-resolved
-	@# purely from config. Locks are gitignored and CI can reuse a workspace
-	@# carrying a lock from an earlier (old provider source) run, which -upgrade
-	@# on some OpenTofu versions tries to re-resolve instead of dropping.
-	@find . -name '.terraform.lock.hcl' -not -path '*/.git/*' -delete
 	@$(call vault_env) && \
 	terragrunt run --all --non-interactive init -- -upgrade
 
diff --git a/environments/root.hcl b/environments/root.hcl
index e8c3882..a1dd781 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -15,12 +15,6 @@ terraform {
     ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
   }
   required_version = ">= 1.10"
-  required_providers {
-    artifactapi = {
-      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi"
-      version = "0.1.2"
-    }
-  }
 }
 EOF
 }
diff --git a/modules/artifactapi/versions.tf b/modules/artifactapi/versions.tf
new file mode 100644
index 0000000..4ade0a3
--- /dev/null
+++ b/modules/artifactapi/versions.tf
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    artifactapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi"
+      version = ">= 0.1.2"
+    }
+  }
+}