Backport of bugfix: terraform providers mirror command should honor terraform lock file into v1.4

internal/command/e2etest/providers_mirror_test.go

@@ -17,6 +17,14 @@ import (
 // compromise for now to keep these tests relatively simple.
 
 func TestTerraformProvidersMirror(t *testing.T) {
+	testTerraformProvidersMirror(t, "terraform-providers-mirror")
+}
+
+func TestTerraformProvidersMirrorWithLockFile(t *testing.T) {
+	testTerraformProvidersMirror(t, "terraform-providers-mirror-with-lock-file")
+}
+
+func testTerraformProvidersMirror(t *testing.T, fixture string) {
 	// This test reaches out to releases.hashicorp.com to download the
 	// template and null providers, so it can only run if network access is
 	// allowed.
@@ -25,7 +33,7 @@ func TestTerraformProvidersMirror(t *testing.T) {
 	outputDir := t.TempDir()
 	t.Logf("creating mirror directory in %s", outputDir)
 
-	fixturePath := filepath.Join("testdata", "terraform-providers-mirror")
+	fixturePath := filepath.Join("testdata", fixture)
 	tf := e2e.NewBinary(t, terraformBin, fixturePath)
 
 	stdout, stderr, err := tf.Run("providers", "mirror", "-platform=linux_amd64", "-platform=windows_386", outputDir)

internal/command/e2etest/testdata/terraform-providers-mirror-with-lock-file/terraform-providers-mirror.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    template  = { source = "hashicorp/template" }
+    null      = { source = "hashicorp/null" }
+    terraform = { source = "terraform.io/builtin/terraform" }
+  }
+}

internal/command/providers_mirror.go

@@ -76,12 +76,27 @@ func (c *ProvidersMirrorCommand) Run(args []string) int {
 	reqs, moreDiags := config.ProviderRequirements()
 	diags = diags.Append(moreDiags)
 
+	// Read lock file
+	lockedDeps, lockedDepsDiags := c.Meta.lockedDependencies()
+	diags = diags.Append(lockedDepsDiags)
+
 	// If we have any error diagnostics already then we won't proceed further.
 	if diags.HasErrors() {
 		c.showDiagnostics(diags)
 		return 1
 	}
 
+	// If lock file is present, validate it against configuration
+	if !lockedDeps.Empty() {
+		if errs := config.VerifyDependencySelections(lockedDeps); len(errs) > 0 {
+			diags = diags.Append(tfdiags.Sourceless(
+				tfdiags.Error,
+				"Inconsistent dependency lock file",
+				fmt.Sprintf("To update the locked dependency selections to match a changed configuration, run:\n  terraform init -upgrade\n got:%v", errs),
+			))
+		}
+	}
+
 	// Unlike other commands, this command always consults the origin registry
 	// for every provider so that it can be used to update a local mirror
 	// directory without needing to first disable that local mirror
@@ -140,7 +155,10 @@ func (c *ProvidersMirrorCommand) Run(args []string) int {
 			continue
 		}
 		selected := candidates.Newest()
-		if len(constraintsStr) > 0 {
+		if !lockedDeps.Empty() {
+			selected = lockedDeps.Provider(provider).Version()
+			c.Ui.Output(fmt.Sprintf("  - Selected v%s to match dependency lock file", selected.String()))
+		} else if len(constraintsStr) > 0 {
 			c.Ui.Output(fmt.Sprintf("  - Selected v%s to meet constraints %s", selected.String(), constraintsStr))
 		} else {
 			c.Ui.Output(fmt.Sprintf("  - Selected v%s with no constraints", selected.String()))