OpenTofu 1.12

Use these rules for OpenTofu 1.12 configurations, modules, providers, state, plans, provisioners, and automation. Check resource-specific settings against the exact provider versions selected by the configuration.

Version and execution trust

• Run the same OpenTofu release in installation, planning, and apply jobs: the newest patch of a release series that is still supported, since OpenTofu patches each series until the support deadline its changelog sets. Constrain the root to that series with a constraint such as opentofu = "~> 1.12.0" in its language.compatible_with block, and change it yourself when you move to a newer series, because Renovate and Dependabot don't update that block. Let them propose provider and module updates and .terraform.lock.hcl refreshes, reference execution images by a digest the bot maintains, and take the exact CLI version from the OpenTofu releases page or leave a placeholder that fails the job rather than a version you remember. Before moving to a CLI release, read its release notes and the repository's security advisories: OpenTofu publishes its advisories there, and the databases that dependency scanners read don't carry them reliably. The 1.12 in this prompt's title names the release series these rules cover, and 1.12.6 is the release they were checked against, not a version to install.
• Verify release archive checksums and authenticate the checksum file with the official signing identity; inspect installer scripts and reject --skip-verify or -skipVerify in deployment images.
• Select CLI and provider binaries for the