hashicorp/terraform · critical

When installing providers described in the config Terraform

Error message

When installing providers described in the config Terraform couldn't determine what 'safe init' action should be taken and returned action type %T. This is a bug in Terraform and should be reported.

What it means

Programmer-error panic in confirmProviderIsTrusted: the trust value (ProviderTrust) returned by determineIfProviderTrusted is neither Trusted nor RequiresApproval (nor the values handled above), so the switch default fires. The message includes the concrete type %T so the unexpected action can be identified. Labeled explicitly as a Terraform bug.

Source

Thrown at internal/command/meta_backend.go:3190

					tfdiags.Error,
					"Missing lock for state store provider",
					fmt.Sprintf(`Terraform is initializing a state store for the first time in a non-interactive mode but no lock was found for the state store provider.
%s

%s

%s`,
						lockfileProblem,
						guidance,
						remediationInstructions,
					),
				))
				return diags
			}
		}
	default:
		// Handle Invalid or unexpected action types
		panic(fmt.Sprintf("When installing providers described in the config Terraform couldn't determine what 'safe init' action should be taken and returned action type %T. This is a bug in Terraform and should be reported.", trust))
	}

	return diags
}

// promptStateStorageProviderApproval is used when Terraform is unsure about the safety of the provider downloaded for state storage
// purposes, and we need to prompt the user to approve or reject using it.
func (m *Meta) promptStateStorageProviderApproval(stateStorageProvider addrs.Provider, locksAfterInstall *depsfile.Locks, authResult *getproviders.PackageAuthenticationResult) tfdiags.Diagnostics {
	var diags tfdiags.Diagnostics

	// If we can receive input then we prompt for ok from the user
	lock := locksAfterInstall.Provider(stateStorageProvider)

	var hashList strings.Builder
	for _, hash := range lock.PreferredHashes() {
		hashList.WriteString(fmt.Sprintf("- %s\n", hash))
	}

View on GitHub (pinned to d32a084675)

Solutions

1. Report as a Terraform bug with the %T value from the panic message.
2. Upgrade or downgrade Terraform to a self-consistent build.
3. Run with -safe-init disabled or in interactive mode if available as a workaround.

Example fix

// before (library code)
default:
    panic(fmt.Sprintf("...returned action type %T. This is a bug in Terraform...", trust))

// after (defensive)
default:
    return diags.Append(tfdiags.Sourceless(tfdiags.Error, "Unknown safe-init action", fmt.Sprintf("action type %T", trust)))

// Defensive: unknown trust action -> ask for approval instead of panic
defer func() {
    if r := recover(); r != nil {
        diags = diags.Append(tfdiags.Sourceless(tfdiags.Error, "Unknown safe-init action", fmt.Sprintf("%v", r)))
    }
}()

When it happens

Trigger: An internal change that introduces a new ProviderTrust enum value without extending this switch, or a nil/uninitialized trust value reaching confirmProviderIsTrusted.

Common situations: Terraform internal refactor of the ProviderTrust type; mismatched versions between packages; experimental safe-init logic returning an extended action type.

Related errors

• Unexpected command type in confirmProviderIsTrusted; this is
• nil config passed to StateStoreProviderFactoryFromConfigStat
• init (determineIfProviderTrusted): unexpected provider locat
• errStateStoreInitDiag requires a non-nil reason argument
• confirmFunc must not be nil

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/ff4f3f39a938f8df. Report an issue: GitHub.