feat(tra-1062): pin OpenTofu version in CI and bound required_version

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version_file: .opentofu-version
       - run: tofu fmt -check -recursive
         working-directory: terraform
 
@@ -25,6 +27,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version_file: .opentofu-version
       - run: tofu init -backend=false -input=false
         working-directory: terraform/${{ matrix.dir }}
       - run: tofu validate

.github/workflows/terraform-azure.yml

@@ -46,6 +46,8 @@ jobs:
           tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
       - uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version_file: .opentofu-version
       - name: Write backend.conf
         run: printf 'endpoints = { s3 = "%s" }\n' "$R2_ENDPOINT" > backend.conf
       - name: Tofu init
@@ -90,6 +92,8 @@ jobs:
           tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
       - uses: opentofu/setup-opentofu@v1
+        with:
+          tofu_version_file: .opentofu-version
       - name: Write backend.conf
         run: printf 'endpoints = { s3 = "%s" }\n' "$R2_ENDPOINT" > backend.conf
       - name: Tofu init

.opentofu-version

@@ -0,0 +1 @@
+1.12.5

CLAUDE.md

@@ -4,6 +4,12 @@
 - **IaC**: OpenTofu (Terraform fork) with Cloudflare + AWS providers
 - **State**: Cloudflare R2 bucket (shared across all providers)
 - **Env**: `.env.local` (not `.env`), loaded via direnv
+- **OpenTofu version**: pinned in `.opentofu-version` (repo root) — the single
+  source CI reads via `setup-opentofu`'s `tofu_version_file`. Bumping across a
+  minor (1.12 → 1.13) also requires updating `required_version` in all five
+  roots (`terraform/{gcp,aws,azure}/provider.tf`,
+  `terraform/{bootstrap,cloudflare}/versions.tf`), which is deliberately
+  bounded (`~> 1.12`) so an unintended jump fails loudly at `init`.
 
 ## Commands
 - `just cloudflare` — plan and apply Cloudflare resources

terraform/aws/provider.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = "~> 1.12"
 
   required_providers {
     aws = {

terraform/azure/provider.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = "~> 1.12"
 
   required_providers {
     azurerm = {

terraform/bootstrap/versions.tf

@@ -5,5 +5,5 @@ terraform {
       version = "~> 4.0"
     }
   }
-  required_version = ">= 1.0.0"
+  required_version = "~> 1.12"
 }

terraform/cloudflare/versions.tf

@@ -13,7 +13,7 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.0.0"
+  required_version = "~> 1.12"
 
   backend "s3" {
     # endpoints injected via backend.conf (generated by justfile from env vars)

terraform/gcp/provider.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = "~> 1.12"
 
   required_providers {
     google = {