Atlantis init upgrades plugins

[magne]

Atlantis runs terraform init with the -upgrade option. This upgrades plugins even if I've checked in the .terraform.lock.hcl file.

The workaround is to lock the plugins in terraform required_providers , but this should not be necessary. Even if I've requested a range of versions of a plugin, Atlantis should respect the .terraform.lock.hcl file.

The current Atlantis behavior causes non-repeatable builds when using version ranges for providers, which is exactly what the lock file was supposed to prevent.

Terraform version 0.14.4
Atlantis version 0.16

[mathcantin]

I openned this PR for that #1353.

[grimm26]

you could write a custom workflow to not run init with -upgrade

[magne]

I know I can use a custom workflow to accomplish this, but I feel that predictable and reproducible builds is a very important feature for a CI (/CD) tool like Atlantis. And disregarding the .terraform.lock.hcl file is definitely not predictable.

As a reference, you can include the following default workflow in your server-side repo config to stop atlantis from upgrading your plugins:

workflows:
  default:
    plan:
      steps:
        - init:
            extra_args:
              - '-upgrade:false'
        - plan:

or if you use the --repo-config-json flag:

{
  ...
  "workflows": {
    "default": {
      "plan": {
        "steps": [
          {
            "init": {
              "extra_args": ["-upgrade:false"]
            }
          },
          {
            "plan": {}
          }
        ]
      }
    }
  }
}

[JeffreyVdb]

@magne

I think it should be upgrade=false
So that it becomes:

workflows:
  default:
    plan:
      steps:
        - init:
            extra_args:
              - '-upgrade=false'
        - plan:

And for --repo-config-json

{
  "workflows": {
    "default": {
      "plan": {
        "steps": [
          {
            "init": {
              "extra_args": ["-upgrade=false"]
            }
          },
          {
            "plan": {}
          }
        ]
      }
    }
  }
}

The above does work for us

[jamengual]

closed by #1651