Full Provider Lock Files

import { Aside } from '@astrojs/starlight/components'

Full .terraform.lock.hcl files from the provider cache server

When the provider cache server is used against the OpenTofu provider registry, Terragrunt now writes .terraform.lock.hcl files containing h1: hashes for every platform the registry supports. A single terragrunt init produces a lock file that works on every platform, removing the need to run tofu providers lock -platform=... separately for each target architecture.

The hashes come from the registry's per-platform download response. When the registry does not supply them (for example, a third-party registry that has not adopted the field), Terragrunt falls back to its previous behavior of writing an h1: hash for the current platform plus zh: hashes for every platform listed in the shasums document.

<Aside type="tip" title="Thanks to the OpenTofu team"> This feature builds on work done by the OpenTofu team to expose per-platform hashes directly from the OpenTofu provider registry. Starting with [OpenTofu 1.12](https://opentofu.org/), `tofu init` populates `.terraform.lock.hcl` with hashes for every supported platform out of the box, with no `tofu providers lock` invocation required. Users on older OpenTofu versions still get the same lock files when running through Terragrunt's [provider cache server](https://docs.terragrunt.com/features/caching/provider-cache-server/), but upgrading to 1.12 is the easiest way to get the same behavior everywhere, including when using the [automatic provider cache dir](https://docs.terragrunt.com/features/caching/auto-provider-cache-dir/). </Aside>