Terraform Provider Pin Lint

It reads a .tf file as text and applies 14 rules to the version constraints and source addresses: required_providers entries with no source or no version, constraints with no upper bound, wildcards, 0.x tracking, registry modules with no version, git modules with no ?ref= or a branch ref, and an s3 backend still locking through dynamodb_table.

Platform and DevOps engineers whose pipelines run terraform init on a fresh runner every job, so nothing carries over between builds. Also for anyone reviewing Terraform that an AI assistant generated, where required_providers is often absent entirely and the provider address is silently assumed to be the hashicorp namespace.

terraform fmt only rewrites whitespace and alignment. terraform validate checks syntax and internal consistency against providers that terraform init has already installed, so by the time it runs the choice has been made. Neither one tells you that the constraint allowed that choice to change.

Linting the file you have open is free forever, with no watermark, no trial counter and no held-back findings: open a .tf file, run the command, get every finding and its pinned form. The licence key adds the other axis, scanning every .tf file in the workspace at once and writing a dated Markdown report you keep.

Reading one root module by hand means opening the registry page for each provider and module to see which majors the constraint admits. Contract platform and DevOps engineers list $75-150/hour on public freelance marketplaces, so a single review of a single environment folder already costs more than the licence.