Add test case to cover use of the -upgrade flag

Author: SarahFrench

internal/command/init.go

@@ -946,16 +946,17 @@ func (c *InitCommand) getProvidersFromState(ctx context.Context, state *states.S
 		}
 	}
 
-	// Previous locks from dep locks file are needed so we don't re-download any providers
-	// Here we also need to incorporate the locks derived from the config, to avoid downloading
-	// a provider twice.
+	// The locks below are used to avoid re-downloading any providers in the
+	// second download step.
+	// We combine any locks from the dependency lock file and locks identified
+	// from the configuration
+	var moreDiags tfdiags.Diagnostics
 	previousLocks, moreDiags := c.lockedDependencies()
 	diags = diags.Append(moreDiags)
-	inProgressLocks := c.mergeLockedDependencies(configLocks, previousLocks)
-
 	if diags.HasErrors() {
 		return false, nil, diags
 	}
+	inProgressLocks := c.mergeLockedDependencies(configLocks, previousLocks)
 
 	var inst *providercache.Installer
 	if len(pluginDirs) == 0 {
@@ -992,7 +993,10 @@ func (c *InitCommand) getProvidersFromState(ctx context.Context, state *states.S
 			return true, nil, diags
 		}
 
-		mode = providercache.InstallUpgrades
+		// We don't set `mode = providercache.InstallUpgrades` here when downloading providers from
+		// state, as it'll cause Terraform to download provider versions that don't match version
+		// constraints in the config.
+		// Instead, leave `mode` as `providercache.InstallNewProvidersOnly`.
 	}
 	newLocks, err := inst.EnsureProviderVersions(ctx, inProgressLocks, reqs, mode)
 	if ctx.Err() == context.Canceled {

internal/command/init_test.go

@@ -115,6 +115,7 @@ func TestInit_two_step_provider_download(t *testing.T) {
 
 	cases := map[string]struct {
 		workDirPath          string
+		flags                []string
 		expectedDownloadMsgs []string
 	}{
 		"providers required by only the state file": {
@@ -173,6 +174,21 @@ func TestInit_two_step_provider_download(t *testing.T) {
 				- Using previously-installed hashicorp/random v1.0.0`,
 			},
 		},
+		"using the -upgrade flag causes provider download to ignore the lock file": {
+			workDirPath: "init-provider-download/config-state-file-and-lockfile",
+			flags:       []string{"-upgrade"},
+			expectedDownloadMsgs: []string{
+				// Config - lock file is not mentioned due to the -upgrade flag
+				`Initializing provider plugins found in the configuration...
+				- Finding hashicorp/random versions matching "< 9.0.0"...
+				- Installing hashicorp/random v1.0.0...
+				- Installed hashicorp/random v1.0.0`,
+				// State - reuses the provider download from the config
+				`Initializing provider plugins found in the state...
+				- Reusing previous version of hashicorp/random from the dependency lock file
+				- Using previously-installed hashicorp/random v1.0.0`,
+			},
+		},
 	}
 
 	for tn, tc := range cases {
@@ -204,7 +220,7 @@ func TestInit_two_step_provider_download(t *testing.T) {
 				},
 			}
 
-			args := []string{"-enable-pluggable-state-storage-experiment"} // Needed to test init changes for PSS project
+			args := append(tc.flags, "-enable-pluggable-state-storage-experiment") // Needed to test init changes for PSS project
 			if code := c.Run(args); code != 0 {
 				t.Fatalf("bad: \n%s", done(t).All())
 			}