Jun 9, 2025 · Jun 9, 2025 · Jun 9, 2025
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
 "sync"
 "time"

 "github.com/google/go-cmp/cmp"
 "github.com/hashicorp/go-version"
 tfjson "github.com/hashicorp/terraform-json"
 "go.opentelemetry.io/otel/attribute"
 e.mut.Lock()
 defer e.mut.Unlock()

 // Read .terraform.lock.hcl content before running terraform init
 lockFilePath := getTerraformLockFilePath(e.workdir)
 preInitLockFileContent, _ := os.ReadFile(lockFilePath)

 outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
 errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
 defer func() {
 }

 err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)

 // Check if .terraform.lock.hcl was modified after terraform init
 postInitLockFileContent, _ := os.ReadFile(lockFilePath)
 if !bytes.Equal(preInitLockFileContent, postInitLockFileContent) {
 diff := cmp.Diff(string(preInitLockFileContent), string(postInitLockFileContent))
 // Log warning message about lock file changes with diff
 warnMsg := "WARN: .terraform.lock.hcl was modified during 'terraform init'. " +
 "This may indicate that provider hashes are missing for your target architecture, " +
 "which can cause unnecessary provider downloads and slower workspace builds. " +
 "See https://developer.hashicorp.com/terraform/language/files/dependency-lock#understanding-lock-file-changes " +
 "for more information about lock file changes."

 // Write warning message to error stream for visibility
 if errWriter != nil {
 _, _ = errWriter.Write([]byte(warnMsg + "\n"))
 _, _ = errWriter.Write([]byte("\nLock file changes:\n" + diff + "\n"))
 }

 e.logger.Warn(ctx, "terraform lock file modified during init",
 slog.F("lock_file_path", lockFilePath),
 slog.F("diff", diff),
 )
 }

 var exitErr *exec.ExitError
 if xerrors.As(err, &exitErr) {
 if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
 return filepath.Join(workdir, "terraform.tfstate")
 }

 func getTerraformLockFilePath(workdir string) string {
 return filepath.Join(workdir, ".terraform.lock.hcl")
 }



 // revive:disable-next-line:flag-parameter
 func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, metadata *proto.Metadata) (*proto.PlanComplete, error) {
 ctx, span := e.server.startTrace(ctx, tracing.FuncName())
diff --git a/provisioner/terraform/executor_internal_test.go b/provisioner/terraform/executor_internal_test.go

 import (
 "encoding/json"
 "path/filepath"
 "testing"

 tfjson "github.com/hashicorp/terraform-json"
 })
 }
 }

 func TestGetTerraformLockFilePath(t *testing.T) {
 t.Parallel()

 workdir := "/tmp/test"
 expected := filepath.Join(workdir, ".terraform.lock.hcl")
 got := getTerraformLockFilePath(workdir)
 require.Equal(t, expected, got)
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -15,6 +15,7 @@ import (
		"sync"
		"time"

		"github.com/google/go-cmp/cmp"
		"github.com/hashicorp/go-version"
		tfjson "github.com/hashicorp/terraform-json"
		"go.opentelemetry.io/otel/attribute"
Expand DownExpand Up		@@ -222,6 +223,10 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
		e.mut.Lock()
		defer e.mut.Unlock()

		// Read .terraform.lock.hcl content before running terraform init
		lockFilePath := getTerraformLockFilePath(e.workdir)
		preInitLockFileContent, _ := os.ReadFile(lockFilePath)

		outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
		errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
		defer func() {
Expand All		@@ -242,6 +247,30 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
		}

		err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)

		// Check if .terraform.lock.hcl was modified after terraform init
		postInitLockFileContent, _ := os.ReadFile(lockFilePath)
		if !bytes.Equal(preInitLockFileContent, postInitLockFileContent) {
		diff := cmp.Diff(string(preInitLockFileContent), string(postInitLockFileContent))
		// Log warning message about lock file changes with diff
		warnMsg := "WARN: .terraform.lock.hcl was modified during 'terraform init'. " +
		"This may indicate that provider hashes are missing for your target architecture, " +
		"which can cause unnecessary provider downloads and slower workspace builds. " +
		"See https://developer.hashicorp.com/terraform/language/files/dependency-lock#understanding-lock-file-changes " +
		"for more information about lock file changes."

		// Write warning message to error stream for visibility
		if errWriter != nil {
		_, _ = errWriter.Write([]byte(warnMsg + "\n"))
		_, _ = errWriter.Write([]byte("\nLock file changes:\n" + diff + "\n"))
		}

		e.logger.Warn(ctx, "terraform lock file modified during init",
		slog.F("lock_file_path", lockFilePath),
		slog.F("diff", diff),
		)
		}

		var exitErr *exec.ExitError
		if xerrors.As(err, &exitErr) {
		if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
Expand All		@@ -259,6 +288,12 @@ func getStateFilePath(workdir string) string {
		return filepath.Join(workdir, "terraform.tfstate")
		}

		func getTerraformLockFilePath(workdir string) string {
		return filepath.Join(workdir, ".terraform.lock.hcl")
		}



		// revive:disable-next-line:flag-parameter
		func (e executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, metadata proto.Metadata) (*proto.PlanComplete, error) {
		ctx, span := e.server.startTrace(ctx, tracing.FuncName())
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2,6 +2,7 @@ package terraform

		import (
		"encoding/json"
		"path/filepath"
		"testing"

		tfjson "github.com/hashicorp/terraform-json"
Expand DownExpand Up		@@ -173,3 +174,14 @@ func TestOnlyDataResources(t *testing.T) {
		})
		}
		}

		func TestGetTerraformLockFilePath(t *testing.T) {
		t.Parallel()

		workdir := "/tmp/test"
		expected := filepath.Join(workdir, ".terraform.lock.hcl")
		got := getTerraformLockFilePath(workdir)
		require.Equal(t, expected, got)
		}