coder · blink-so · Jun 9, 2025 · Jun 9, 2025 · Jun 9, 2025 · johnstcn
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
@@ -222,6 +222,10 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 	e.mut.Lock()
 	defer e.mut.Unlock()
 
+	// Read .terraform.lock.hcl content before running terraform init
+	lockFilePath := getTerraformLockFilePath(e.workdir)
+	preInitLockFileContent, _ := os.ReadFile(lockFilePath)
+
 	outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
 	errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
 	defer func() {
@@ -242,6 +246,29 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 	}
 
 	err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)
+
+	// Check if .terraform.lock.hcl was modified after terraform init
+	postInitLockFileContent, _ := os.ReadFile(lockFilePath)
+	diff := generateFileDiff(preInitLockFileContent, postInitLockFileContent)
+	if diff != "" {
+		// Log informational message about lock file changes with diff
+		infoMsg := "INFO: .terraform.lock.hcl was modified during 'terraform init'. " +
+			"This is normal when Terraform downloads providers or updates dependencies. " +
+			"See https://developer.hashicorp.com/terraform/language/files/dependency-lock#understanding-lock-file-changes " +
+			"for more information about lock file changes."
+
+		// Write info message to debug stream
+		if outWriter != nil {
+			_, _ = outWriter.Write([]byte(infoMsg + "\n"))
+			_, _ = outWriter.Write([]byte("\nLock file changes:\n" + diff + "\n"))
+		}
+
+		e.logger.Info(ctx, "terraform lock file modified during init",
+			slog.F("lock_file_path", lockFilePath),
+			slog.F("diff", diff),
+		)
+	}
+
 	var exitErr *exec.ExitError
 	if xerrors.As(err, &exitErr) {
 		if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
@@ -259,6 +286,53 @@ func getStateFilePath(workdir string) string {
 	return filepath.Join(workdir, "terraform.tfstate")
 }
 
+func getTerraformLockFilePath(workdir string) string {
+	return filepath.Join(workdir, ".terraform.lock.hcl")
+}
+
+// generateFileDiff generates a simple diff between two file contents.
+// Returns empty string if files are identical.
+func generateFileDiff(beforeContent, afterContent []byte) string {
+	if bytes.Equal(beforeContent, afterContent) {
+		return ""
+	}
+
+	// Simple line-by-line diff
+	beforeLines := strings.Split(string(beforeContent), "\n")
+	afterLines := strings.Split(string(afterContent), "\n")
+
+	var diff strings.Builder
+	diff.WriteString("--- .terraform.lock.hcl (before terraform init)\n")
+	diff.WriteString("+++ .terraform.lock.hcl (after terraform init)\n")
+
+	// Simple diff showing added/removed lines
+	beforeMap := make(map[string]bool)
+	for _, line := range beforeLines {
+		beforeMap[line] = true
+	}
+
+	afterMap := make(map[string]bool)
+	for _, line := range afterLines {
+		afterMap[line] = true
+	}
+
+	// Show removed lines
+	for _, line := range beforeLines {
+		if !afterMap[line] && strings.TrimSpace(line) != "" {
+			diff.WriteString("- " + line + "\n")
+		}
+	}
+
+	// Show added lines
+	for _, line := range afterLines {
+		if !beforeMap[line] && strings.TrimSpace(line) != "" {
+			diff.WriteString("+ " + line + "\n")
+		}
+	}
+
+	return diff.String()
+}
+
 // revive:disable-next-line:flag-parameter
 func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, metadata *proto.Metadata) (*proto.PlanComplete, error) {
 	ctx, span := e.server.startTrace(ctx, tracing.FuncName())

diff --git a/provisioner/terraform/executor_internal_test.go b/provisioner/terraform/executor_internal_test.go
@@ -173,3 +173,41 @@ func TestOnlyDataResources(t *testing.T) {
 		})
 	}
 }
+
+func TestGetTerraformLockFilePath(t *testing.T) {
+	t.Parallel()
+
+	workdir := "/tmp/test"
+	expected := filepath.Join(workdir, ".terraform.lock.hcl")
+	got := getTerraformLockFilePath(workdir)
+	require.Equal(t, expected, got)
+}
+
+func TestGenerateFileDiff(t *testing.T) {
+	t.Parallel()
+
+	// Test with identical content
+	content := []byte("line1\nline2\nline3")
+	diff := generateFileDiff(content, content)
+	require.Equal(t, "", diff)
+
+	// Test with different content
+	content1 := []byte("line1\nline2\nline3")
+	content2 := []byte("line1\nmodified line2\nline3\nnew line4")
+	diff = generateFileDiff(content1, content2)
+	require.NotEmpty(t, diff)
+	require.Contains(t, diff, "--- .terraform.lock.hcl (before terraform init)")
+	require.Contains(t, diff, "+++ .terraform.lock.hcl (after terraform init)")
+	require.Contains(t, diff, "- line2")
+	require.Contains(t, diff, "+ modified line2")
+	require.Contains(t, diff, "+ new line4")
+
+	// Test with empty before content (new file)
+	emptyContent := []byte("")
+	newContent := []byte("provider \"aws\" {\n  version = \"5.0.0\"\n}")
+	diff = generateFileDiff(emptyContent, newContent)
+	require.NotEmpty(t, diff)
+	require.Contains(t, diff, "+ provider \"aws\" {")
+	require.Contains(t, diff, "+   version = \"5.0.0\"")
+	require.Contains(t, diff, "+ }")
+}