Skip to content

Commit a86e1ca

Browse files
nickvigilantenickvigilante
authored
fix: pin Terraform 1.15.5 for all Nix platforms (#25799)
The terraform_1_15_5 derivation previously only handled linux/amd64, falling through to unstablePkgs.terraform on all other platforms. On macOS this meant a different Terraform version was used, which caused the version check in make pre-commit to trigger generate.sh, regenerating all testdata with the host platform's OS/arch (darwin/arm64) instead of the committed linux/amd64 values. Three changes: 1. `flake.nix`: add explicit linux_arm64, darwin_arm64, and darwin_amd64 cases with SHA256 hashes from the official HashiCorp release. Unknown platforms still fall back to unstablePkgs.terraform. 2. `provisioner/terraform/testdata/generate.sh`: guard full regeneration behind a Linux-only check. The committed testdata encodes linux/amd64 values from the coder_provisioner data source, so regenerating on macOS would permanently bake in darwin/arm64. The --check path still runs on all platforms so the version target can detect provider mismatches. Regeneration via CI or an explicit Linux run is unchanged. 3. `scripts/release/check_commit_metadata.sh`: fix a shfmt (>=3.13) false positive. The [install.sh] key in an associative array literal was parsed as floating-point arithmetic (a zsh-only feature). Moving it to a post-declaration assignment satisfies the stricter parser without changing runtime behavior. <!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> Linear: DOCS-279
1 parent d6aa3d6 commit a86e1ca

3 files changed

Lines changed: 39 additions & 6 deletions

File tree

‎flake.nix‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -148,15 +148,36 @@
148148
vendorHash = "sha256-OuQWmZmofdJKq1hvk43RPkILQwAuFzqhmB22Xf6Z3lA=";
149149
};
150150

151-
# Keep Terraform aligned with provisioner/terraform/testdata/version.txt
152-
# so `make gen` remains deterministic in Nix shells.
151+
# Pin to provisioner/terraform/testdata/version.txt for deterministic
152+
# `make gen` across platforms.
153153
terraform_1_15_5 =
154-
if pkgs.stdenv.isLinux && pkgs.stdenv.hostPlatform.isx86_64 then
154+
let
155+
releases = {
156+
x86_64-linux = {
157+
platform = "linux_amd64";
158+
hash = "sha256-cCshNq9nKMj/A3+EPdLbzit62IeGtzgdHXKu+iUPYBw=";
159+
};
160+
aarch64-linux = {
161+
platform = "linux_arm64";
162+
hash = "sha256-Bue0jegmFGxtkzG6NbE9oSMy2Dkr4w0d1reJukcT//A=";
163+
};
164+
aarch64-darwin = {
165+
platform = "darwin_arm64";
166+
hash = "sha256-ARN2YFEABbkYu6ghVIZvvqxDkxY9gnfCq+hh37WELDw=";
167+
};
168+
x86_64-darwin = {
169+
platform = "darwin_amd64";
170+
hash = "sha256-NofQfANLPn3u1bByzYris0g1vLE5uuw/xPX9U02r9e0=";
171+
};
172+
};
173+
target = releases.${system} or null;
174+
in
175+
if target != null then
155176
pkgs.runCommand "terraform-1.15.5" {
156177
nativeBuildInputs = [ pkgs.unzip ];
157178
src = pkgs.fetchurl {
158-
url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip";
159-
hash = "sha256-cCshNq9nKMj/A3+EPdLbzit62IeGtzgdHXKu+iUPYBw=";
179+
url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_${target.platform}.zip";
180+
hash = target.hash;
160181
};
161182
} ''
162183
mkdir -p "$out/bin"

‎provisioner/terraform/testdata/generate.sh‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,17 @@ if [[ " $* " == *" --check "* ]]; then
140140
fi
141141
fi
142142

143+
# Committed testdata encodes linux/amd64 values from coder_provisioner.
144+
# Regenerating elsewhere bakes in the host OS/arch.
145+
if [[ "$(uname)" != "Linux" ]]; then
146+
if ((upgrade)); then
147+
echo "ERROR: --upgrade is not supported on $(uname); run on Linux or via CI."
148+
exit 1
149+
fi
150+
echo "Note: skipping testdata regeneration on $(uname); regenerate on Linux or via CI."
151+
exit 0
152+
fi
153+
143154
# Filter flags from positional args to get directory names.
144155
declare -a dirs=()
145156
for arg in "$@"; do

‎scripts/release/check_commit_metadata.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,6 @@ main() {
7878
[enterprise]="Enterprise"
7979
[examples]="Examples"
8080
[helm]="Helm"
81-
[install.sh]="Installer"
8281
[provisionersdk]="SDK"
8382
[provisionerd]="Provisioner"
8483
[provisioner]="Provisioner"
@@ -88,6 +87,8 @@ main() {
8887
[support]="Support"
8988
[tailnet]="Networking"
9089
)
90+
# shfmt (>=3.13) parses [install.sh] as floating-point arithmetic in array literals.
91+
humanized_areas["install.sh"]="Installer"
9192

9293
# Get hashes for all cherry-picked commits between the selected ref
9394
# and main. These are sorted by commit title so that we can group

0 commit comments

Comments
 (0)