BM: Baca dalam Bahasa Melayu
World T4: Modules & Pipelines
Provider pins and the lock file
You will learn: how the lock file makes every laptop and pipeline use the same provider versions.
Checked with OpenTofu 1.13 on 1 Nov 2026
The problem
It worked yesterday. Today, on a new laptop, tofu init picked a newer provider, and the plan looks different. What would have kept them the same?
Pick one answer.
Try it
This folder already ran tofu init. Read what it wrote down: cat .terraform.lock.hcl.
Blueprint (your .tf files)init done
local_file.menunot built yetrandom_pet.stallnot built yet
Built (the state file)
Nothing built yet.
Change a file, then run tofu plan to see what it means.
Hint
The file name starts with a dot:.terraform.lock.hcl.Watch
Tap the line with the exact version that init chose.
0 of 1 found
The lock file: .terraform.lock.hcl: the receipt tofu init writes. It records which provider versions it picked. Commit it to Git. records the exact provider version, plus checksums. Then every laptop installs the very same files.
Predict
The lock file is in Git. Next month, random 3.10 comes out. A teammate runs tofu init. Which version does she get?
Pick one answer.
Try it
Ben added a bell that needs a new provider, null. Run tofu plan, read the error, then fix it.
Blueprint (your .tf files)init done
local_file.menunot built yetnull_resource.bellnot built yetrandom_pet.stallnot built yet
Built (the state file)
Nothing built yet.
Change a file, then run tofu plan to see what it means.
Hint
A new provider means: runtofu init, then commit the lock file.Check
Your .gitignore is ready. Sort each file.
Drag a card into a box. Or tap the card, then tap the box.
You did it!
You can now read the lock file and keep provider versions the same everywhere.
Go deeper (optional)
To upgrade, change the pin if needed and run tofu init -upgrade. Then review the lock file change in a pull request. OpenTofu 1.13 writes checksums for every platform on init. tofu providers lock can still add them by hand. Terraform’s lock file has the same name, but its entries point at registry.terraform.io.
Real mission
tofu initcat .terraform.lock.hcltofu initgit add .terraform.lock.hcl *.tf && git commit -m "Pin providers"
0 of 4 steps done · Your ticks are saved.
Bahasa Melayu
Semalam ia berjalan. Hari ini, di laptop baharu, tofu init pilih provider lebih baharu, dan plan nampak lain. Apa yang patut kekalkan semuanya sama?
Folder ini sudah jalankan tofu init. Baca apa yang ia catat: cat .terraform.lock.hcl.
.terraform.lock.hcl.Fail lock kebergantungan rekod versi provider yang tepat, berserta checksum. Jadi setiap laptop pasang fail yang betul-betul sama.
Fail lock ada dalam Git. Bulan depan, random 3.10 keluar. Seorang rakan jalankan tofu init. Versi mana dia dapat?
Ben tambah loceng yang perlukan provider baharu, null. Jalankan tofu plan, baca ralatnya, kemudian baiki.
tofu init, kemudian commit fail lock..gitignore anda sudah sedia. Susun setiap fail.
Kini anda boleh baca fail lock dan kekalkan versi provider sama di mana-mana.
You finished this before. Practice is always welcome!
Official docs: OpenTofu: dependency lock file · tofu init (-upgrade) · tofu providers lock · Terraform: dependency lock file
You've learned for 25 minutes. A short break helps your brain.
Sprint done! Great focus. Stretch for a minute?