ci: lock terraform providers for darwin_arm64 + linux_amd64

.github/workflows/terraform-lock.yml

@@ -0,0 +1,43 @@
+name: Verify Terraform Lock Files
+
+# Fails if any root's .terraform.lock.hcl is incomplete or stale for the
+# expected platforms (darwin_arm64 + linux_amd64). Re-runs `providers lock`
+# for both platforms and fails on any diff, so a lock missing EITHER
+# platform's hashes is caught regardless of the runner OS (a plain
+# `init -lockfile=readonly` on a linux runner would miss a darwin-only lock).
+# `providers lock` only talks to the provider registry, so no backend creds.
+
+on:
+  pull_request:
+    paths:
+      - '**/.terraform.lock.hcl'
+      - '**/version.tf'
+      - '.github/workflows/terraform-lock.yml'
+
+jobs:
+  lock-check:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        root:
+          - state-backend
+          - cluster/local
+          - cluster/scaleway
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          # Keep in sync with mise.toml [tools] terraform version.
+          terraform_version: "1.14"
+
+      - name: Re-lock providers for both platforms and assert no drift
+        run: |
+          terraform -chdir=${{ matrix.root }} providers lock \
+            -platform=darwin_arm64 -platform=linux_amd64
+          git diff --exit-code -- ${{ matrix.root }}/.terraform.lock.hcl

CLAUDE.md

@@ -16,10 +16,31 @@ mise install          # Install all tools (kubectl, minikube, terraform, helm, a
 mise run dev             # Full local env: start minikube + terraform init + apply
 mise run reset           # Destroy minikube cluster
 
+# Provider lock files
+mise run lock            # Re-generate all 3 roots' .terraform.lock.hcl for darwin_arm64 + linux_amd64
+
 # Linting
 actionlint .github/workflows/*.yml   # Lint GitHub Actions workflows (also runs as pre-push hook)
 ```
 
+### Re-running `providers lock`
+
+The `.terraform.lock.hcl` in each root must cover **both** `darwin_arm64` (local dev) and `linux_amd64` (CI). Re-run `mise run lock` whenever you:
+
+- bump a provider version constraint in any `version.tf`
+- add a new provider to a root
+- see a CI failure on the `Verify Terraform Lock Files` workflow
+
+`mise run lock` is equivalent to:
+
+```bash
+terraform -chdir=state-backend    providers lock -platform=darwin_arm64 -platform=linux_amd64
+terraform -chdir=cluster/local    providers lock -platform=darwin_arm64 -platform=linux_amd64
+terraform -chdir=cluster/scaleway providers lock -platform=darwin_arm64 -platform=linux_amd64
+```
+
+Commit the updated lock files alongside the version change.
+
 ## Architecture
 
 Two cluster environments, each its own Terraform root module:

cluster/local/main.tf

@@ -14,7 +14,7 @@ resource "helm_release" "argocd" {
   version    = "9.4.17"
 
   set_sensitive {
-    name  = "configs.secret.argocdServerAdminPassword"
+    name = "configs.secret.argocdServerAdminPassword"
     # ArgoCD require a `bcrypt()` hashed password here. But `bcrypt` generate a new hash at each execution
     # So instead, we store the hash directly, so terraform is not confused anymore by fake changes
     value = data.infisical_secrets.this.secrets["ArgoCD_admin_encrypted"].value
@@ -38,8 +38,8 @@ EOF
   ]
 }
 resource "helm_release" "argocd_apps" {
-  name       = "argocd-apps"
-  namespace  = "argocd"
+  name      = "argocd-apps"
+  namespace = "argocd"
 
   repository = "https://argoproj.github.io/argo-helm"
   chart      = "argocd-apps"

cluster/local/variables.tf

@@ -1,9 +1,9 @@
 variable "infisical_client_id" {
-    type = string
+  type = string
 }
 
 variable "infisical_client_secret" {
-    type = string
+  type = string
 }
 
 variable "gitops_revision" {

cluster/local/version.tf

@@ -10,7 +10,7 @@ terraform {
     }
     infisical = {
       version = "~> 0.16"
-      source = "infisical/infisical"
+      source  = "infisical/infisical"
     }
   }
 }

mise.toml

@@ -94,3 +94,13 @@ run = "terraform apply"
 description = "Tear down the Scaleway cluster (terraform destroy)"
 dir = "cluster/scaleway"
 run = "terraform destroy"
+
+# ── Provider locks ───────────────────────────────────────────────────────────
+
+[tasks.lock]
+description = "Re-generate all .terraform.lock.hcl files for darwin_arm64 + linux_amd64"
+run = """
+terraform -chdir=state-backend    providers lock -platform=darwin_arm64 -platform=linux_amd64
+terraform -chdir=cluster/local    providers lock -platform=darwin_arm64 -platform=linux_amd64
+terraform -chdir=cluster/scaleway providers lock -platform=darwin_arm64 -platform=linux_amd64
+"""