Updatecli
Docs

Terraform Lock

sourceconditiontarget

✗

✔

✔

Description

The terraform/lock resource maintains a .terraform.lock.hcl dependency lock file: for a given provider it updates the version, the version constraint, and the package checksums - without running terraform init. The checksums are fetched from the registry for the platforms you list.

condition

Tests that the lock file already records that version and its hashes for the provider.

target

Rewrites the provider’s version, constraints and hashes entries.

source

Not supported - a source fails with Source not supported for the plugin terraform/lock. Pair this resource with terraform/registry, which supplies the version.

Parameters

NameTypeDescriptionRequired
filestring

“file” defines the path of the Terraform lock file to use.

compatible:

  • condition
  • target

remark:

  • “file” and “files” are mutually exclusive.
  • the schemes “https://”, “http://” and “file://” are supported in a condition.
filesarray

“files” defines the list of Terraform lock file paths to use.

compatible:

  • condition
  • target

remark:

  • “file” and “files” are mutually exclusive.
  • a condition only supports one file.
  • the schemes “https://”, “http://” and “file://” are supported in a condition.
platformsarray

“platforms” defines the target platforms to request package checksums for.

compatible:

  • condition
  • target

remark:

  • “platforms” is required.

example:

  • platforms:
    • linux_amd64
    • darwin_arm64
providerstring

“provider” defines the Terraform provider to update.

compatible:

  • condition
  • target

remark:

  • “provider” is required.
  • it accepts a provider address with or without the registry hostname.

example:

  • provider: hashicorp/kubernetes
  • provider: registry.terraform.io/hashicorp/kubernetes
skipconstraintsboolean

“skipconstraints” defines whether the constraints of the lock file are left untouched.

compatible:

  • target

default: false

remark:

  • enabling it can break the lock file if the version from the source does not follow the constraints.
valuestring

“value” defines the version of the Terraform provider.

compatible:

  • condition
  • target

default: in a condition or a target, the output of the associated source.

file or files, provider and platforms are all mandatory - missing any of them aborts the run with wrong spec content, preceded by terraform/lock file undefined, terraform/lock provider undefined or terraform/lock platforms undefined. file and files are mutually exclusive, and a condition accepts only one file.

provider

Accepts the short form or the fully qualified one (hashicorp/kubernetes and registry.terraform.io/hashicorp/kubernetes both work).

platforms

The platforms to request checksums for, such as linux_amd64 or darwin_arm64. Only the platforms listed here end up in the lock file, exactly as with terraform providers lock -platform=…​. Omitting the platform your CI runs on will make terraform init fail there.

Warning

skipconstraints: true updates the version and the hashes but leaves the constraints line alone. That produces a lock file Terraform rejects whenever the new version falls outside the existing constraint. Leave it unset unless the constraint is managed elsewhere (for example by a terraform/provider target in the same pipeline).

Remote files

For a condition, file accepts https://, http:// and file://. A target must write locally and refuses a URL.

Example

The example uses an additional resource plugin: terraform/registry.

# updatecli.yaml
name: Terraform Lock

sources:
  kubernetes:
    name: Get version from registry
    kind: terraform/registry
    spec:
      type: provider
      namespace: hashicorp
      name: kubernetes

conditions:
  using-value:
    name: Condition using value
    kind: terraform/lock
    disablesourceinput: true
    spec:
      file: .terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64
      value: 2.22.0

  https:
    name: Condition using HTTP
    kind: terraform/lock
    disablesourceinput: true
    spec:
      file: https://raw.githubusercontent.com/updatecli-test/jenkins-infra-aws/main/.terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64
      value: 2.22.0


targets:
  update-file-from-source:
    name: Update files content from value
    kind: terraform/lock
    sourceid: kubernetes
    spec:
      file: .terraform.lock.hcl
      provider: hashicorp/kubernetes
      platforms:
        - linux_amd64

Links

Last updated on August 2, 2026
Prev
Terraform File
Next
Terraform Provider