Lock-file rules for .terraform.lock.hcl.
terraform_providers_lock regenerates the multi-platform lock file;
terraform_providers_lock_test catches drift against the module's
required_providers blocks; terraform_lock_diff_test structurally
diffs the init-aspect output against a checked-in golden.
External Terraform registry modules are resolved live by the
terraform.modules(...) bzlmod extension — no separate lock file, no
updater rule. See docs/src/index.md.
Rules
terraform_lock_diff_test
load("@rules_terraform//terraform:terraform_modules_lock.bzl", "terraform_lock_diff_test")
terraform_lock_diff_test(name, golden, regenerate_hint, target)
Diffs the init-aspect-generated .terraform.lock.hcl for
target against a checked-in golden produced by real
terraform init / tofu init. Verifies same provider set, same
version+constraints per provider, same zh: set, and at least one
h1: overlap.
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this target. | Name | required | |
| golden | A .terraform.lock.hcl produced by real terraform/tofu init. | Label | required | |
| regenerate_hint | Command shown in the failure message telling users how to refresh the golden. | String | optional | "" |
| target | A terraform_module target. The init aspect runs against it to produce the lock under test. | Label | required |
terraform_providers_lock
load("@rules_terraform//terraform:terraform_modules_lock.bzl", "terraform_providers_lock")
terraform_providers_lock(name, output, platforms, target)
Regenerates .terraform.lock.hcl for a terraform_module by running
real terraform providers lock -platform=<all> under the toolchain-fetched
terraform binary. bazel run writes the multi-platform result back to
source — the one path that produces hashes for platforms Bazel didn't
resolve for the current build.
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this target. | Name | required | |
| output | Where to write the multi-platform .terraform.lock.hcl, relative to this BUILD file's package. Diff-test companions should point golden = "<same-path>". | String | required | |
| platforms | os_arch platforms to record hashes for. Defaults to the common set. | List of strings | optional | [] |
| target | The terraform_module whose .tf sources drive the lock resolution. | Label | required |
terraform_providers_lock_test
load("@rules_terraform//terraform:terraform_modules_lock.bzl", "terraform_providers_lock_test")
terraform_providers_lock_test(name, lock, target)
Fails the test if .terraform.lock.hcl doesn't cover every provider
declared in terraform { required_providers { ... } } blocks reachable
from target (and vice versa). Network-free presence check.
ATTRIBUTES