potiuk opened a new pull request, #83: URL: https://github.com/apache/airflow-ci-infra/pull/83
`terraform init` records only the provider checksum of the platform it runs on. A lock file generated on a Mac therefore fails the workflows' `terraform init -lockfile=readonly` on the Linux runners, and the other way round. The `terraform/runs-on-flex` lock file in #82 was nearly committed that way. `AGENTS.md` now says to lock every module for linux_amd64, darwin_arm64 and darwin_amd64 in the same pull request that adds a module or changes a provider. The new `terraform-lock-platforms` prek hook enforces it. On every commit that touches a module, and in the `prek` workflow, the hook fails when: - the lock file is missing; - a provider has fewer than three `h1:` checksums; - a provider in the module's own `required_providers` is not locked. Where `terraform` is installed, the hook runs `terraform providers lock` for the three platforms itself and fails the commit, so the regenerated file gets reviewed and committed. The check is offline, so it cannot tell which platform a checksum belongs to or see providers that only nested modules require. Changed version constraints are left to the workflows' `-lockfile=readonly` init. Checks run: the hook against the current lock files (pass), `pytest --noconftest tests/scripts` (4 passed; 3 fail without the comment handling), prek on the changed files, and roborev. --- Generated-by: Claude Code (Claude Opus 5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
