Inventory providers across every module, see what the registry allows, and ship one precise, reviewable upgrade PR per provider. Lock files are always regenerated by Terraform or OpenTofu, never hand-edited.
$ go install github.com/provlift/provlift/cmd/provlift@latest$ provlift upgrade --level major --next-major --allow-major provider current target azurerm 3.116.0 → 4.0.0 aws 5.100.0 → 6.0.0 google 6.50.0 → 7.0.0 ✓ constraints rewritten ✓ lock files regenerated ✓ validated · ready for review
list, check, drift and version never change files. validate runs Terraform init, and upgrade edits constraints, so preview upgrades with --dry-run first.
Show every required provider, module kind, source address, constraint, lock state, and declaration location.
Behavior: Read-only. Does not need Terraform or registry access.
Compare locked versions or constraint floors with published provider releases and identify repository or dependency blockers.
Behavior: Read-only. Exit code 2 can gate CI when upgrades are available.
Find provider version skew, constraint divergence, and root modules without lock files.
Behavior: Offline and read-only. Use it before changing provider versions across a repository.
Plan and apply provider updates, rewrite only blocking constraints, regenerate lock files through Terraform, and validate the result.
Behavior: Writes Terraform files and lock files. Major or breaking changes require acknowledgement.
Check formatting, initialize roots, validate Terraform configuration, and optionally run a plan.
Behavior: Runs Terraform. Plan is opt-in and may require backend and cloud credentials.
Inspect the installed CLI version, commit, build date, Go version, and target platform.
Behavior: Read-only and offline.
Discovery, planning, editing, and validation stay visible as separate steps.
Inventory modules and provider requirements without touching files.
Run a direct patch, minor, or major budget, or progress through exact stages.
CI validates the change, explains blockers, and keeps the lock file honest.
Global and upgrade controls in one searchable table.
| Flag | Default | Use it for |
|---|---|---|
| -C, --dir | . | Repository directory to scan. |
| --json | false | Emit machine-readable output instead of a table. |
| --exclude | none | Skip directory globs; repeatable. |
| --terraform-binary | terraform | Drive Terraform, or OpenTofu with "tofu" (bare provider sources then resolve to registry.opentofu.org). |
| --timeout | 15m | Timeout for one Terraform command. |
| --include-prerelease | false | Include prerelease provider versions in discovery and planning. |
| --level | patch | Upgrade budget: patch, minor, or major. |
| --exact-level | false | Apply only the selected level for progressive stages. |
| --allow-major | false | Acknowledge major or breaking changes. |
| --next-major | false | Advance one major series at a time. |
| --to | none | Target one exact provider version. |
| --raise-floor | false | Raise a shared module minimum to the tested target. |
| --pin-unconstrained | false | Add a constraint where none exists. |
| --dry-run | false | Show an upgrade plan without changing files. |
| --skip-init | false | Edit constraints without regenerating the lock file. |
| --skip-validate | false | Skip Terraform validation after upgrade. |
| --backend | false | Allow backend initialization and state access. |
| --platforms | config | Platforms recorded by terraform providers lock. |
| --fmt | true | Run terraform fmt on edited directories. |
| --pr-body | none | Write generated pull request markdown to a file. |
CI runs the tool, keeps forge credentials out of the binary, and turns the result into one focused PR per provider.
Move to the next published release one budget allows, one reviewable step at a time. minor includes patch and minor changes; a planned major needs acknowledgement.
Keep patch, minor, and major changes in separate PRs. --next-major crosses one major series at a time.
CI consumes the stable JSON shape and generated markdown, without giving the CLI forge credentials.