Pin Terraform to 1.16 in CI - #179
Merged
Merged
Conversation
1 task
|
Terraform plan in terraform No changes. Your infrastructure matches the configuration.✅ Plan applied in Apply Terraform changes on merge #41 |
ale210
added a commit
to hackforla/incubator
that referenced
this pull request
Aug 29, 2026
Terraform was never actually pinned in CI. `#38` asked for `required_version = "~> 1.12.1"` — three components, which fixes major and minor and allows patch. What landed in #109 was `"~> 1.12"`, one component short, and a two-part `~>` constraint pins only the major: it means `>= 1.12, < 2.0`, so every 1.x satisfies it. The dflook plan/apply actions have no version input — they resolve the constraint and take the newest release that matches. From today's plan run: ``` Using latest Terraform version that matches the required_version constraints Switched to Terraform v1.16.0 ``` `terraform_version` recorded in the state file, `s3://hfla-incubator-terraform-state`: | Date | Version | Serial | |---|---|---| | 2025-04-14 (pre-constraint) | 1.11.4 | 96 | | 2025-09-20 | 1.13.3 | 111 | | 2025-10-18 | 1.13.4 | 126 | | 2026-08-11 | 1.15.8 | 136 | | 2026-08-29 | 1.16.0 | 140 | It has never run a 1.12.x under the constraint — 1.13 was already out when #109 merged. **Pinning forward to 1.16 rather than back to 1.12.** State serial 140 was written by 1.16.0, and Terraform refuses to load a snapshot created by a newer version, so `~> 1.12.1` today would fail every plan and apply outright. 1.16 is what is already deployed; #38's intent is recoverable, its version target is not. `hackforla/devops-security` has the same defect in a stronger form — no `required_version` at all — and gets the matching change in hackforla/devops-security#179. ### Verification - [x] The plan run on this PR reports `Switched to Terraform v1.16.x` and succeeds. Confirmed: `Switched to Terraform v1.16.0`, plan green, `No changes.` ### Not in scope - `terraform/backend.tf` is not `terraform fmt` clean on `main` (`source` and `superuser` alignment); left alone. - `.terraform.lock.hcl` is gitignored, so provider versions float in CI too. Only `postgresql` is pinned; the `aws` provider has no constraint. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo's
terraform {}block has norequired_version, so the dflook plan/apply actions take whatever the newest Terraform release is on the day they run. CI has been silently upgrading itself since the repo was created.terraform_versionrecorded in the state file,s3://hfla-ops-terraform-state:Nothing chose any of those versions. From the most recent plan run:
Pinning at
~> 1.16.0fixes major and minor while still allowing patch releases. 1.16 rather than anything older because state serial 74 was written by 1.16.0 and Terraform refuses to load a snapshot created by a newer version — an older pin would fail every plan and apply.Same change as hackforla/incubator#182, where the constraint existed but was a component short (
~> 1.12instead of~> 1.12.1, which allows all of 1.x). Incubator's original ticket is hackforla/incubator#38; this repo never had an equivalent.Verification
Switched to Terraform v1.16.xand succeeds. Confirmed:Switched to Terraform v1.16.0, plan green,No changes.Not in scope
.terraform.lock.hclis gitignored, so provider versions float in CI too. Theawsprovider has no version constraint at all.