From 8e6469d66e2abe7d0431a5b0c65527feacadc8ef Mon Sep 17 00:00:00 2001
From: Rasmus Wejlgaard <pez@pez.sh>
Date: Sat, 6 Jun 2026 13:17:32 +0100
Subject: [PATCH] chore: commit terraform lock file for reproducible provider
 versions

The .terraform.lock.hcl was gitignored while providers use floating
~> constraints, so every CI 'tofu init' resolved provider versions
fresh and could drift from what was tested locally, with no checksum
verification on the providers.

Track the lock file instead, with hashes for linux_amd64 (CI) plus
darwin_arm64/amd64 (local). Dependabot's terraform updates now surface
exact provider version bumps as reviewable, hash-pinned changes.
---
 .gitignore                    |  3 +-
 terraform/.terraform.lock.hcl | 76 +++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 terraform/.terraform.lock.hcl

diff --git a/.gitignore b/.gitignore
index 7a6de7f..41572a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,8 @@
 *.tfstate.backup
 *.tfstate.*.backup
 .terraform/
-.terraform.lock.hcl
+# .terraform.lock.hcl is intentionally committed to pin provider versions
+# and checksums for reproducible init across machines and CI.
 crash.log
 override.tf
 override.tf.json
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
new file mode 100644
index 0000000..f4d18db
--- /dev/null
+++ b/terraform/.terraform.lock.hcl
@@ -0,0 +1,76 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/grafana/grafana" {
+  version     = "4.37.0"
+  constraints = "~> 4.35"
+  hashes = [
+    "h1:EqimatXUHgE9jIko0ifoR+kOLVCQlLGvj13iH5GoCnE=",
+    "h1:FidFAmj3ALv3NqC16DXwCJW7AYa3W8kooHp/Mcwwj8M=",
+    "h1:znSXAYpsXka6EPWA7ojZDTBqHhOEZ+/MoMMfiCCNy18=",
+    "zh:02dcb17aae3e97a4b946e28267a80845b130e4a062ebd0f7dbf15ef1f65713e7",
+    "zh:07b57580fe411de152a3b29a5ac1e0ff2541f9a62904c5b9703cf7e3c63bbbfa",
+    "zh:089b7ce58b919732bedcb95e2a5d99553956a3637e89bb0b814de82050cca635",
+    "zh:08c15290aafeec6945cd5321b5cdc2adb5f077b26fb77225984e3acd055293f7",
+    "zh:0e0d0f89d8f2ca89541b5981c9388263af15c83c98f57d831a2dc162f1586af5",
+    "zh:3363c8c5a987951ec6bf69bfdd1293d2fb1e72aa94e272280b69ef2dd3988e34",
+    "zh:479e2f82ad2b7522851c828f33d6ab7a0cfce44304f25b5b1f5ddabed0fb879c",
+    "zh:4d9d619b6c6c619f58624a9fba8414201fe68403eb5e1588b95d8c31ecc9c71e",
+    "zh:545f24ef5b1d87d641a577556ada8b0ac67417e0bc51ac01238898fb6429d67a",
+    "zh:8b43993924d12d946e002acbf54c8bf7f05a269436ad085c45317c6020ba10df",
+    "zh:965cf4bf12a8a8e858d791743716433d71a17ed2a15e6cd183dc3d7349be24e3",
+    "zh:9a1205bc5cf01f143611afb97934f2cbc5c9225f6bc5c279f6424ea4da96151b",
+    "zh:b49d28a1a0226799a9421b50dcdc2c85de5858d42f92c8443745d80c9dd5e0cd",
+    "zh:b618aa9e7272447b2e1ce46bb399e39d21f605de48c756b6af0b42fddca50674",
+    "zh:b9dac24ca39fcc95575f0051390c71dabdd540ea2c365bb87b5621e5d6219594",
+    "zh:ba3b79a13ece3bd782a79afe590200940ce740eee809ed4cb9e1086253dba1d2",
+    "zh:ba3f77877ed139cbf0d9af9d1b84e827c49fc42c60e545c67c9d05d1e63e9b0c",
+    "zh:ba84824517ef8bb78122f7bdcbd49bbdf289df9b82040dfbee913a73f29fc158",
+    "zh:de116fd3a62a20f183793c760fa4d9521cee7d718165924cc9b0012e297636b5",
+  ]
+}
+
+provider "registry.opentofu.org/hetznercloud/hcloud" {
+  version     = "1.64.0"
+  constraints = "~> 1.45"
+  hashes = [
+    "h1:6NMyW2i8MaSu9wXIcFyBkFcwxLL0mPHj/s6LRgf9GmY=",
+    "h1:FUkTfFrWlmv0JhsbjQvTk3zY7A2Q0LuoSs0PKEzaLpk=",
+    "h1:cpTE6JyoNHTxUbAERBShzMrKriX8kf2g47qGoKWY9oY=",
+    "zh:5bf7f8f429b1a8f485988d199f46295676a6cdf7d84ad11f1f4613faecfa89d5",
+    "zh:63b3d182474dd5afd0d5ab3f5f66228b752504436bcb2f4721bd6f1233d0f2ae",
+    "zh:6867da2d89d297b6760d80dde373e74df511bea72f7daccf6a944a9de4b4d4ed",
+    "zh:766fdcea1b03038a92414eafaa430b9ac0c57b36ce4c1573e6e291431659d528",
+    "zh:7f3186dfcae4028eac4f2c9c2c382b49c1fad0b63d0471b50748ee6817fbd8d2",
+    "zh:bb8a33b6ff9a4d3bce87628c49b08a4780e2c034762f40112058d96f5a4e52bd",
+    "zh:cc93751c7c90a37f180cf3e5439ed34f3154e60de5920a13d153d93954938239",
+    "zh:d6e2abf05a0eb8fe0544eb099960a4962db61532e7757016ccacbf0b83bcd1ae",
+    "zh:da9e3adedd8d33623aac4929fa8b1210f98d2931d5737c201da0dda992dd25ab",
+    "zh:dffc931aec4d7b0733690e115b1aabdf5c157b7d347a09a9d149ee6b7e9d8ce3",
+    "zh:e565dea4f28182099a271f794e3b781f069ea54976f5f05dbb79a1c2b6627459",
+    "zh:e79411287af28ccf6187bd418b7ea2ee217e642026392ddc8027bf3e3287fb80",
+    "zh:f5102d7141a04c193dffbb5cbc3f7e3588c41b87e11877d2e20d57ea5ef64123",
+  ]
+}
+
+provider "registry.opentofu.org/pagerduty/pagerduty" {
+  version     = "3.32.4"
+  constraints = "~> 3.32"
+  hashes = [
+    "h1:MeKtMz/0Up2ZiLMcaMGtRlbiMFpQSy96RHBaQfe+qu4=",
+    "h1:PlxP7LHPc7EacGS7c45YUFq3NdmKda55jm0PziOXoYA=",
+    "h1:i6GPVW3nfE3kjLK4buPQ6XJtC6+JjMB2Al/XtLPPlqg=",
+    "zh:0999624276f7c72605a8c2f86900487f8151ecc9e97f53f44c119f23c4bea9ca",
+    "zh:2a3c64da0c09752e8d0faf650f30f4a23cfdb2ccf467a5cc081a1015a15dc576",
+    "zh:2b7b26503af236c13898ed41ee723d357235e8811587309b983ed1bc764193ee",
+    "zh:5ce82ccafa0611cfe497fdebe3cd54e468215aa5c6eb09dbb8e3dd185fe8b9e9",
+    "zh:8912866f4bad7e975134bf9c1fc3460e5aaa4c723bd11bda9c5c7d67aad79497",
+    "zh:948a1eb162488341c889fa3036629d2017f13320fb30ebc06400862f1a68a107",
+    "zh:96ad755f25c4bb6fa06db846fcaacefa87821c7e248f9e7b558bdab090a2df68",
+    "zh:9f4614d7315349535c156029bfcb244e2c126ce6e256c09bdc17a12c43a38229",
+    "zh:c181b362470b3071022adc758828fa9ad515f1dbbfdf58c8489570427703335c",
+    "zh:d7b6b449637f1a6990b3c593c580cee0db5215ae9eb52540210970d780362755",
+    "zh:d9ca46cd45403586ec8dec5ac1606e34db629829d75ea82037b15171b7c8ae18",
+    "zh:fea9d67b81abed4e280a8a8e8f8cdeac190a3a51a40ef0d684a1d9fbc87834f8",
+  ]
+}