`terraform_providers_lock` produces error when `terraform_validate` is not called before

[jaygridley]

With introduction of mode support to terraform_providers_lock hooks it should be possible to run the hook without terraform_validate when mode=only-check-is-current-lockfile-cross-platform, but it is not working as advertised.

It works as advertised only when lockfile_contains_all_needed_sha returns 0 = when the lock file is valid. If it NOT valid, for example it is missing hash for some platform, the condition

pre-commit-terraform/hooks/terraform_providers_lock.sh

Line 150 in cba8773

lockfile_contains_all_needed_sha "$platforms_count"; then

fails and code continues and runs terraform providers lock on line

pre-commit-terraform/hooks/terraform_providers_lock.sh

Line 158 in cba8773

"$tf_path" providers lock "${args[@]}"

.

IMHO the condition could be rewritten to:

if [ "$mode" == "only-check-is-current-lockfile-cross-platform" ] ; then
    lockfile_contains_all_needed_sha "$platforms_count"

    exit_code=$?
    return $exit_code
  fi

In this case it could be executed in mode=only-check-is-current-lockfile-cross-platform without running terraform_validate which runs terraform init under the hood.

[yermulnik]

but it is not working as advertised.

Could you please share: 1) your config of this particular hook, 2) expected behavior and 3) actual behavior? Thanks.

[jaygridley]

1. Config

  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.96.3
    hooks:
      - id: terraform_providers_lock
        args:
          - --hook-config=--mode=only-check-is-current-lockfile-cross-platform
          - --args=-platform=darwin_amd64
          - --args=-platform=darwin_arm64
          - --args=-platform=linux_amd64

2. Expected behaviour

Lock terraform provider versions.........................................Failed
- hook id: terraform_providers_lock
- exit code: 152

| Error: <PATH TO THE LOCK FILE> missing checksum for platform X, Y, Z

3. Actual behaviour

Lock terraform provider versions.........................................Failed
- hook id: terraform_providers_lock
- exit code: 1

╷
│ Error: Module not installed
│ 
│   on grafana.tf line 1:
│    1: module "grafana" {
│ 
│ This module is not yet installed. Run "terraform init" to install all modules required by this configuration.
╵

[yermulnik]

Thanks for details.

IMHO the condition could be rewritten to:

I guess I see the point and I'm inclined to agree that the condition should look like:

if [ "$mode" == "only-check-is-current-lockfile-cross-platform" ]; then
  lockfile_contains_all_needed_sha "$platforms_count"
  exit_code=$?
  return $exit_code
fi

@MaxymVlasov Could you please take a look into this as I can't say for sure whether there is no other use case for lockfile_contains_all_needed_sha() here except for when $mode equals only-check-is-current-lockfile-cross-platform). Thanks.

[MaxymVlasov]

3. Actual behaviour

Lock terraform provider versions.........................................Failed
- hook id: terraform_providers_lock
- exit code: 1

╷
│ Error: Module not installed
│ 
│   on grafana.tf line 1:
│    1: module "grafana" {
│ 
│ This module is not yet installed. Run "terraform init" to install all modules required by this configuration.
╵

It's terraform behavior. You must run t init if you want to validate checksums as long as there at least 1 child module imported inside your root module

---

2. Expected behaviour

Lock terraform provider versions.........................................Failed
- hook id: terraform_providers_lock
- exit code: 152

| Error: <PATH TO THE LOCK FILE> missing checksum for platform X, Y, Z

Error: <PATH TO THE LOCK FILE> missing checksum for platform - that's can be done, but only after running t init

Before - that all you can get:

TF_LOG=trace terraform providers lock \
  -platform=darwin_amd64 \
  -platform=darwin_arm64
2025-11-26T16:46:55.656+0200 [INFO]  Terraform version: 1.10.5
2025-11-26T16:46:55.656+0200 [DEBUG] using github.com/hashicorp/go-tfe v1.70.0
2025-11-26T16:46:55.656+0200 [DEBUG] using github.com/hashicorp/hcl/v2 v2.23.0
2025-11-26T16:46:55.656+0200 [DEBUG] using github.com/hashicorp/terraform-svchost v0.1.1
2025-11-26T16:46:55.656+0200 [DEBUG] using github.com/zclconf/go-cty v1.16.2
2025-11-26T16:46:55.656+0200 [INFO]  Go runtime version: go1.23.3
2025-11-26T16:46:55.656+0200 [INFO]  CLI args: []string{"/home/vm/.asdf/installs/terraform/1.10.5/bin/terraform", "providers", "lock", "-platform=darwin_amd64", "-platform=darwin_arm64"}
2025-11-26T16:46:55.656+0200 [TRACE] Stdout is a terminal of width 96
2025-11-26T16:46:55.656+0200 [TRACE] Stderr is a terminal of width 96
2025-11-26T16:46:55.656+0200 [TRACE] Stdin is a terminal
2025-11-26T16:46:55.656+0200 [DEBUG] Attempting to open CLI config file: /home/vm/.terraformrc
2025-11-26T16:46:55.656+0200 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /home/vm/.terraform.d/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /home/vm/snap/code/214/.local/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /home/vm/snap/code/214/.local/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /home/vm/snap/code/214/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /snap/code/214/usr/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /home/vm/.local/share/flatpak/exports/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /var/lib/flatpak/exports/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /usr/local/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /usr/share/terraform/plugins
2025-11-26T16:46:55.656+0200 [DEBUG] ignoring non-existing provider search directory /var/lib/snapd/desktop/terraform/plugins
2025-11-26T16:46:55.657+0200 [INFO]  CLI command args: []string{"providers", "lock", "-platform=darwin_amd64", "-platform=darwin_arm64"}
╷
│ Error: Module not installed
│ 
│   on main.tf line 1:
│    1: module "environment" {
│ 
│ This module is not yet installed. Run "terraform init" to install all modules required by
│ this configuration.

If by X, Y, Z you want to have specific values, not generic extraction of provided args - it's not possible before t init too, but after - it could be extracted from regular logs

$ t init
  ...
$terraform providers lock \ 
  -platform=darwin_amd64 \
  -platform=linux_amd64
- Fetching hashicorp/aws 5.36.0 for darwin_amd64...
- Retrieved hashicorp/aws 5.36.0 for darwin_amd64 (signed by HashiCorp)
- Fetching hashicorp/template 2.2.0 for darwin_amd64...
- Retrieved hashicorp/template 2.2.0 for darwin_amd64 (signed by HashiCorp)
- Fetching hashicorp/random 3.6.0 for darwin_amd64...
- Retrieved hashicorp/random 3.6.0 for darwin_amd64 (signed by HashiCorp)
- Fetching hashicorp/null 3.2.2 for darwin_amd64...
- Retrieved hashicorp/null 3.2.2 for darwin_amd64 (signed by HashiCorp)
- Fetching hashicorp/archive 2.4.2 for darwin_amd64...
- Retrieved hashicorp/archive 2.4.2 for darwin_amd64 (signed by HashiCorp)
- Fetching hashicorp/random 3.6.0 for linux_amd64...
- Retrieved hashicorp/random 3.6.0 for linux_amd64 (signed by HashiCorp)
- Fetching hashicorp/null 3.2.2 for linux_amd64...
- Retrieved hashicorp/null 3.2.2 for linux_amd64 (signed by HashiCorp)
- Fetching hashicorp/archive 2.4.2 for linux_amd64...
- Retrieved hashicorp/archive 2.4.2 for linux_amd64 (signed by HashiCorp)
- Fetching hashicorp/aws 5.36.0 for linux_amd64...
- Retrieved hashicorp/aws 5.36.0 for linux_amd64 (signed by HashiCorp)
- Fetching hashicorp/template 2.2.0 for linux_amd64...
- Retrieved hashicorp/template 2.2.0 for linux_amd64 (signed by HashiCorp)
- Obtained hashicorp/null checksums for darwin_amd64; Additional checksums for this platform are now tracked in the lock file
- Obtained hashicorp/null checksums for linux_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/archive checksums for darwin_amd64; Additional checksums for this platform are now tracked in the lock file
- Obtained hashicorp/archive checksums for linux_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/aws checksums for darwin_amd64; Additional checksums for this platform are now tracked in the lock file
- Obtained hashicorp/aws checksums for linux_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/template checksums for darwin_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/template checksums for linux_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/random checksums for linux_amd64; All checksums for this platform were already tracked in the lock file
- Obtained hashicorp/random checksums for darwin_amd64; Additional checksums for this platform are now tracked in the lock file

Success! Terraform has updated the lock file.

Review the changes in .terraform.lock.hcl and then commit to your
version control system to retain the new checksums.

---

Do you actually asking about returning t init run inside terraform_providers_lock hook for cases when there is no valid ./terraform/ content AND do it w/o checking is terraform code is actually valid to produce valid ./terraform/ (done by terraform_validate)? Or do you suggest improve docs about this behavior?

[jaygridley]

I think if terraform_providers_lock requires t init in some cases there should be a way how to run it. Possibly adding terraform_init hook that can be used internally by terraform_validate and optionally with terraform_providers_lock?

Or just improving lockfile_contains_all_needed_sha function to return "more rich error" containing at least the lock file, it was checking? This is probably related to #54

[MaxymVlasov]

Improving lockfile_contains_all_needed_sha function to return "more rich error" containing at least the lock file

We can get it from

pre-commit-terraform/hooks/terraform_providers_lock.sh

Lines 94 to 95 in cba8773

	function per_dir_hook_unique_part {
	local -r dir_path="$1"

and post under if exist_code != 0 right before return

pre-commit-terraform/hooks/terraform_providers_lock.sh

Lines 158 to 162 in cba8773

	"$tf_path" providers lock "${args[@]}"
	# return exit code to common::per_dir_hook
	exit_code=$?
	return $exit_code

---

Possibly adding terraform_init hook that can be used internally by terraform_validate and optionally with terraform_providers_lock?

That's already in place, rn called function common::terraform_init

I think if terraform_providers_lock requires t init in some cases there should be a way how to run it.

Using terraform_validate hook? Can you please describe use case in which anyone will want to skip terraform validation step?

Technically, errors are the same, but it will be little weird to folks who don't know how TF works to see such errors from provider locks operation

14:38 Oslo/environment/qa git:(test $✘!+?) 
➜ terraform providers lock \                                         
  -platform=darwin_amd64 \
  -platform=linux_amd64
╷
│ Error: Unsupported block type
│ 
│   on providers.tf line 1:
│    1: provi der "aws" {
│ 
│ Blocks of type "provi" are not expected here.
╵


14:38 Oslo/environment/qa git:(test $✘!+?) 
✘1 ➜ t validate                                                         
╷
│ Error: Unsupported block type
│ 
│   on providers.tf line 1:
│    1: provi der "aws" {
│ 
│ Blocks of type "provi" are not expected here.
╵

14:38 Oslo/environment/qa git:(test $✘!+?) 
✘1 ➜ t init                                                             
Initializing the backend...
Initializing modules...
╷
│ Error: Unsupported block type
│ 
│   on providers.tf line 1:
│    1: provi der "aws" {
│ 
│ Blocks of type "provi" are not expected here.
╵

[jaygridley]

Using terraform_validate hook? Can you please describe use case in which anyone will want to skip terraform validation step?

Actually, we skip it because it needs t init which is slow for our use-case.

I am fine with my original suggestion and add extra output with lock file being checked as you suggested.

[MaxymVlasov]

@jaygridley please check is next works for you

- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: f74b9d750396da7ac2b40b99d72d80759576e1ba

PR - #950

[jaygridley]

Hi @MaxymVlasov, the #950 solves only part of the issue. I am still missing a way how to run lockfile_contains_all_needed_sha function without invoking Terraform whatsoever.

I could be achieved by changing the logic

if [ "$mode" == "only-check-is-current-lockfile-cross-platform" ] ; then
    lockfile_contains_all_needed_sha "$platforms_count"

    exit_code=$?
 
    if [[ $exit_code -ne 0 ]]; then
      common::colorify "red" "$dir_path/.terraform.lock.hcl missing all specified platforms"
    fi

    return $exit_code
  fi

[MaxymVlasov]

@jaygridley happy holidays!
Something like this?

- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: bf77b74b0e6c7c6ec01ce8f8d8e9a41d5b9b8833

Or do you want to have 3 modes?:

1. only-check-is-current-lockfile-cross-platform - exit if h1: in lockfile < than specified in hook
2. regenerate-lockfile-if-some-platform-missed - ~current only-check-is-current-lockfile-cross-platform behavior in main plus error msgs (that what we have in PR right now)
   

   pre-commit-terraform/hooks/terraform_providers_lock.sh

   Lines 79 to 175 in bf77b74

   	#######################################################################
   	# Unique part of `common::per_dir_hook`. The function is executed in loop
   	# on each provided dir path. Run wrapped tool with specified arguments
   	# Arguments:
   	# dir_path (string) PATH to dir relative to git repo root.
   	# Can be used in error logging
   	# change_dir_in_unique_part (string/false) Modifier which creates
   	# possibilities to use non-common chdir strategies.
   	# Availability depends on hook.
   	# parallelism_disabled (bool) if true - skip lock mechanism
   	# args (array) arguments that configure wrapped tool behavior
   	# tf_path (string) PATH to Terraform/OpenTofu binary
   	# Outputs:
   	# If failed - print out hook checks status
   	#######################################################################
   	function per_dir_hook_unique_part {
   	local -r dir_path="$1"
   	# shellcheck disable=SC2034 # Unused var.
   	local -r change_dir_in_unique_part="$2"
   	local -r parallelism_disabled="$3"
   	local -r tf_path="$4"
   	shift 4
   	local -a -r args=("$@")
   	local platforms_count=0
   	local platforms_names=()
   	for arg in "${args[@]}"; do
   	if grep -Eq '^-platform=' <<< "$arg"; then
   	platforms_count=$((platforms_count + 1))
   	platforms_names+=("${arg#*=}")
   	fi
   	done
   	local exit_code
   	#
   	# Get hook settings
   	#
   	local mode
   	IFS=";" read -r -a configs <<< "${HOOK_CONFIG[*]}"
   	for c in "${configs[@]}"; do
   	IFS="=" read -r -a config <<< "$c"
   	key=${config[0]}
   	value=${config[1]}
   	case $key in
   	--mode)
   	if [ "$mode" ]; then
   	common::colorify "yellow" 'Invalid hook config. Make sure that you specify not more than one "--mode" flag'
   	exit 1
   	fi
   	mode=$value
   	;;
   	esac
   	done
   	# Available options:
   	# only-check-is-current-lockfile-cross-platform (will be default)
   	# always-regenerate-lockfile
   	# TODO: Remove in 2.0
   	if [ ! "$mode" ]; then
   	common::colorify "yellow" "DEPRECATION NOTICE: We introduced '--mode' flag for this hook.
   	Check migration instructions at https://github.com/antonbabenko/pre-commit-terraform#terraform_providers_lock
   	"
   	common::terraform_init "$tf_path providers lock" "$dir_path" "$parallelism_disabled" "$tf_path" || {
   	exit_code=$?
   	return $exit_code
   	}
   	fi
   	if [ "$mode" == "only-check-is-current-lockfile-cross-platform" ]; then
   	if lockfile_contains_all_needed_sha "$platforms_count"; then
   	exit 0
   	fi
   	common::colorify "yellow" "\n$dir_path/.terraform.lock.hcl missing some of required platforms.
   	All required platforms: ${platforms_names[*]}."
   	fi
   	#? Don't require `tf init` for providers, but required `tf init` for modules
   	#? Mitigated by `function match_validate_errors` from terraform_validate hook
   	# pass the arguments to hook
   	"$tf_path" providers lock "${args[@]}"
   	exit_code=$?
   	if [[ $exit_code -ne 0 ]]; then
   	common::colorify "red" "$dir_path run failed. Detailed error above.
   	Most common issue is that required 'terraform init' command was likely not run before running this hook. It might be run for you automatically by 'terraform_validate' hook - see https://github.com/antonbabenko/pre-commit-terraform#terraform_validate for more details
   	"
   	fi
   	# return exit code to common::per_dir_hook
   	return $exit_code
   	}

3. always-regenerate-lockfile - just go straight forward to "$tf_path" providers lock operation

[jaygridley]

Hello @MaxymVlasov,

- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: bf77b74b0e6c7c6ec01ce8f8d8e9a41d5b9b8833

This is fine, but we need to exit right after common::colorify "yellow" "\n$dir_path/.terraform.lock.hcl missing some of required platforms. All required platforms: ${platforms_names[*]}." so the check does not continue further.

[MaxymVlasov]

I see, so we need to have 3 modes. I'll prepare changes shortly