{"record":{"id":"bd20aa47fb617979","repo":"hashicorp/terraform","slug":"the-upgrade-flag-conflicts-with-lockfile-readonl","errorCode":null,"errorMessage":"The -upgrade flag conflicts with -lockfile=readonly.","messagePattern":"The -upgrade flag conflicts with -lockfile=readonly\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/arguments/init.go","lineNumber":220,"sourceCode":"\t\tdiags = diags.Append(tfdiags.Sourceless(\n\t\t\ttfdiags.Error,\n\t\t\t\"The -migrate-state and -json options are mutually-exclusive\",\n\t\t\t\"Terraform cannot ask for interactive approval when -json is set. To use the -migrate-state option, disable the -json option.\",\n\t\t))\n\t}\n\n\tif init.MigrateState && init.Reconfigure {\n\t\tdiags = diags.Append(tfdiags.Sourceless(\n\t\t\ttfdiags.Error,\n\t\t\t\"Invalid init options\",\n\t\t\t\"The -migrate-state and -reconfigure options are mutually-exclusive.\",\n\t\t))\n\t}\n\n\tif init.Upgrade && init.Lockfile == \"readonly\" {\n\t\t// This is appended as a Go error because this validation already existed this way\n\t\t// and it's been moved earlier in the process, to the arguments package.\n\t\tdiags = diags.Append(fmt.Errorf(\"The -upgrade flag conflicts with -lockfile=readonly.\"))\n\t}\n\n\targs := cmdFlags.Args()\n\tif len(args) != 0 {\n\t\t// No positional arguments are expected.\n\t\tdiags = diags.Append(tfdiags.Sourceless(\n\t\t\ttfdiags.Error,\n\t\t\t\"No positional arguments are expected\",\n\t\t\t\"The init command does not expect any positional arguments. Did you mean to use -chdir?\",\n\t\t))\n\t}\n\n\tbackendFlagSet := FlagIsSet(cmdFlags, \"backend\")\n\tcloudFlagSet := FlagIsSet(cmdFlags, \"cloud\")\n\n\tif backendFlagSet && cloudFlagSet {\n\t\tdiags = diags.Append(tfdiags.Sourceless(\n\t\t\ttfdiags.Error,","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/arguments/init.go#L202-L238","documentation":"Emitted by `terraform init` argument validation (internal/command/arguments/init.go:217) when `-upgrade` and `-lockfile=readonly` are passed together. `-upgrade` instructs init to re-resolve providers and update the dependency lock file, while `-lockfile=readonly` forbids any change to it; the two intentions are contradictory, so init refuses to proceed.","triggerScenarios":"Invoking `terraform init -upgrade -lockfile=readonly`. The check `init.Upgrade && init.Lockfile == \"readonly\"` (init.go:217) is true, so a Go error is appended to diagnostics during `ParseInit`.","commonSituations":"Copy-pasted CI flags where an `-upgrade` template was combined with a read-only lockfile policy; trying to refresh providers in a pipeline that treats the lockfile as immutable; misunderstanding that `-lockfile=readonly` blocks exactly what `-upgrade` needs to do.","solutions":["Drop `-lockfile=readonly` if you actually want `-upgrade` to update the lock file.","Drop `-upgrade` if the goal is to install exactly what the lock file pins, keeping `-lockfile=readonly`.","For a one-off provider refresh without changing the lock file, use `-lockfile=readonly` alone and update the lock file in a separate controlled step."],"exampleFix":"# before (contradictory flags)\nterraform init -upgrade -lockfile=readonly\n\n# after (upgrade allowed to write the lock file)\nterraform init -upgrade","handlingStrategy":"validation","validationCode":"// Reject the contradictory init flag combination before invoking terraform.\nfunc validateInitFlags(upgrade bool, lockfile string) error {\n    if upgrade && lockfile == \"readonly\" {\n        return fmt.Errorf(\"-upgrade and -lockfile=readonly are mutually exclusive\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document that `-lockfile=readonly` disables exactly what `-upgrade` does.","In CI templates, parameterize flags so both cannot be set in the same job.","Review flag combinations in code review when changing init pipelines."],"tags":["terraform","init","flags","validation","lockfile","upgrade"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}