From 85d1cb945ed2d9c2f6ff2bdb9715065ed08e0a70 Mon Sep 17 00:00:00 2001
From: "Rasmus \"Pez\" Wejlgaard" <pez@pez.sh>
Date: Sat, 6 Jun 2026 13:19:08 +0100
Subject: [PATCH] chore: commit terraform lock file for reproducible provider
 versions (#121)

The .terraform.lock.hcl was gitignored while providers use floating
~> constraints, so every CI 'tofu init' resolved provider versions
fresh and could drift from what was tested locally, with no checksum
verification on the providers.

Track the lock file instead, with hashes for linux_amd64 (CI) plus
darwin_arm64/amd64 (local). Dependabot's terraform updates now surface
exact provider version bumps as reviewable, hash-pinned changes.
---
 .gitignore                    |  3 +-
 terraform/.terraform.lock.hcl | 76 +++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 terraform/.terraform.lock.hcl

diff --git a/.gitignore b/.gitignore
index 7a6de7f..41572a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,8 @@
 *.tfstate.backup
 *.tfstate.*.backup
 .terraform/
-.terraform.lock.hcl
+# .terraform.lock.hcl is intentionally committed to pin provider versions
+# and checksums for reproducible init across machines and CI.
 crash.log
 override.tf
 override.tf.json
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
new file mode 100644
index 0000000..f4d18db
--- /dev/null
+++ b/terraform/.terraform.lock.hcl
@@ -0,0 +1,76 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/grafana/grafana" {
+  version     = "4.37.0"
+  constraints = "~> 4.35"
+  hashes = [
+    "h1:EqimatXUHgE9jIko0ifoR+kOLVCQlLGvj13iH5GoCnE=",
+    "h1:FidFAmj3ALv3NqC16DXwCJW7AYa3W8kooHp/Mcwwj8M=",
+    "h1:znSXAYpsXka6EPWA7ojZDTBqHhOEZ+/MoMMfiCCNy18=",
+    "zh:02dcb17aae3e97a4b946e28267a80845b130e4a062ebd0f7dbf15ef1f65713e7",
+    "zh:07b57580fe411de152a3b29a5ac1e0ff2541f9a62904c5b9703cf7e3c63bbbfa",
+    "zh:089b7ce58b919732bedcb95e2a5d99553956a3637e89bb0b814de82050cca635",
+    "zh:08c15290aafeec6945cd5321b5cdc2adb5f077b26fb77225984e3acd055293f7",
+    "zh:0e0d0f89d8f2ca89541b5981c9388263af15c83c98f57d831a2dc162f1586af5",
+    "zh:3363c8c5a987951ec6bf69bfdd1293d2fb1e72aa94e272280b69ef2dd3988e34",
+    "zh:479e2f82ad2b7522851c828f33d6ab7a0cfce44304f25b5b1f5ddabed0fb879c",
+    "zh:4d9d619b6c6c619f58624a9fba8414201fe68403eb5e1588b95d8c31ecc9c71e",
+    "zh:545f24ef5b1d87d641a577556ada8b0ac67417e0bc51ac01238898fb6429d67a",
+    "zh:8b43993924d12d946e002acbf54c8bf7f05a269436ad085c45317c6020ba10df",
+    "zh:965cf4bf12a8a8e858d791743716433d71a17ed2a15e6cd183dc3d7349be24e3",
+    "zh:9a1205bc5cf01f143611afb97934f2cbc5c9225f6bc5c279f6424ea4da96151b",
+    "zh:b49d28a1a0226799a9421b50dcdc2c85de5858d42f92c8443745d80c9dd5e0cd",
+    "zh:b618aa9e7272447b2e1ce46bb399e39d21f605de48c756b6af0b42fddca50674",
+    "zh:b9dac24ca39fcc95575f0051390c71dabdd540ea2c365bb87b5621e5d6219594",
+    "zh:ba3b79a13ece3bd782a79afe590200940ce740eee809ed4cb9e1086253dba1d2",
+    "zh:ba3f77877ed139cbf0d9af9d1b84e827c49fc42c60e545c67c9d05d1e63e9b0c",
+    "zh:ba84824517ef8bb78122f7bdcbd49bbdf289df9b82040dfbee913a73f29fc158",
+    "zh:de116fd3a62a20f183793c760fa4d9521cee7d718165924cc9b0012e297636b5",
+  ]
+}
+
+provider "registry.opentofu.org/hetznercloud/hcloud" {
+  version     = "1.64.0"
+  constraints = "~> 1.45"
+  hashes = [
+    "h1:6NMyW2i8MaSu9wXIcFyBkFcwxLL0mPHj/s6LRgf9GmY=",
+    "h1:FUkTfFrWlmv0JhsbjQvTk3zY7A2Q0LuoSs0PKEzaLpk=",
+    "h1:cpTE6JyoNHTxUbAERBShzMrKriX8kf2g47qGoKWY9oY=",
+    "zh:5bf7f8f429b1a8f485988d199f46295676a6cdf7d84ad11f1f4613faecfa89d5",
+    "zh:63b3d182474dd5afd0d5ab3f5f66228b752504436bcb2f4721bd6f1233d0f2ae",
+    "zh:6867da2d89d297b6760d80dde373e74df511bea72f7daccf6a944a9de4b4d4ed",
+    "zh:766fdcea1b03038a92414eafaa430b9ac0c57b36ce4c1573e6e291431659d528",
+    "zh:7f3186dfcae4028eac4f2c9c2c382b49c1fad0b63d0471b50748ee6817fbd8d2",
+    "zh:bb8a33b6ff9a4d3bce87628c49b08a4780e2c034762f40112058d96f5a4e52bd",
+    "zh:cc93751c7c90a37f180cf3e5439ed34f3154e60de5920a13d153d93954938239",
+    "zh:d6e2abf05a0eb8fe0544eb099960a4962db61532e7757016ccacbf0b83bcd1ae",
+    "zh:da9e3adedd8d33623aac4929fa8b1210f98d2931d5737c201da0dda992dd25ab",
+    "zh:dffc931aec4d7b0733690e115b1aabdf5c157b7d347a09a9d149ee6b7e9d8ce3",
+    "zh:e565dea4f28182099a271f794e3b781f069ea54976f5f05dbb79a1c2b6627459",
+    "zh:e79411287af28ccf6187bd418b7ea2ee217e642026392ddc8027bf3e3287fb80",
+    "zh:f5102d7141a04c193dffbb5cbc3f7e3588c41b87e11877d2e20d57ea5ef64123",
+  ]
+}
+
+provider "registry.opentofu.org/pagerduty/pagerduty" {
+  version     = "3.32.4"
+  constraints = "~> 3.32"
+  hashes = [
+    "h1:MeKtMz/0Up2ZiLMcaMGtRlbiMFpQSy96RHBaQfe+qu4=",
+    "h1:PlxP7LHPc7EacGS7c45YUFq3NdmKda55jm0PziOXoYA=",
+    "h1:i6GPVW3nfE3kjLK4buPQ6XJtC6+JjMB2Al/XtLPPlqg=",
+    "zh:0999624276f7c72605a8c2f86900487f8151ecc9e97f53f44c119f23c4bea9ca",
+    "zh:2a3c64da0c09752e8d0faf650f30f4a23cfdb2ccf467a5cc081a1015a15dc576",
+    "zh:2b7b26503af236c13898ed41ee723d357235e8811587309b983ed1bc764193ee",
+    "zh:5ce82ccafa0611cfe497fdebe3cd54e468215aa5c6eb09dbb8e3dd185fe8b9e9",
+    "zh:8912866f4bad7e975134bf9c1fc3460e5aaa4c723bd11bda9c5c7d67aad79497",
+    "zh:948a1eb162488341c889fa3036629d2017f13320fb30ebc06400862f1a68a107",
+    "zh:96ad755f25c4bb6fa06db846fcaacefa87821c7e248f9e7b558bdab090a2df68",
+    "zh:9f4614d7315349535c156029bfcb244e2c126ce6e256c09bdc17a12c43a38229",
+    "zh:c181b362470b3071022adc758828fa9ad515f1dbbfdf58c8489570427703335c",
+    "zh:d7b6b449637f1a6990b3c593c580cee0db5215ae9eb52540210970d780362755",
+    "zh:d9ca46cd45403586ec8dec5ac1606e34db629829d75ea82037b15171b7c8ae18",
+    "zh:fea9d67b81abed4e280a8a8e8f8cdeac190a3a51a40ef0d684a1d9fbc87834f8",
+  ]
+}