Check lock file diags in mirror command

The lock file diagnostic were not being checked in the mirror command,
so an incomplete or broken lock file might cause the cli to crash.

internal/command/e2etest/providers_mirror_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -20,14 +21,18 @@ import (
 // compromise for now to keep these tests relatively simple.
 
 func TestTerraformProvidersMirror(t *testing.T) {
-	testTerraformProvidersMirror(t, "terraform-providers-mirror")
+	testTerraformProvidersMirror(t, "terraform-providers-mirror", "")
 }
 
 func TestTerraformProvidersMirrorWithLockFile(t *testing.T) {
-	testTerraformProvidersMirror(t, "terraform-providers-mirror-with-lock-file")
+	testTerraformProvidersMirror(t, "terraform-providers-mirror-with-lock-file", "")
 }
 
-func testTerraformProvidersMirror(t *testing.T, fixture string) {
+func TestTerraformProvidersMirrorWithBrokenLockFile(t *testing.T) {
+	testTerraformProvidersMirror(t, "terraform-providers-mirror-with-broken-lock-file", "Inconsistent dependency lock file")
+}
+
+func testTerraformProvidersMirror(t *testing.T, fixture string, errMsg string) {
 	// This test reaches out to releases.hashicorp.com to download the
 	// template and null providers, so it can only run if network access is
 	// allowed.
@@ -40,6 +45,13 @@ func testTerraformProvidersMirror(t *testing.T, fixture string) {
 	tf := e2e.NewBinary(t, terraformBin, fixturePath)
 
 	stdout, stderr, err := tf.Run("providers", "mirror", "-platform=linux_amd64", "-platform=windows_386", outputDir)
+	if errMsg != "" {
+		if !strings.Contains(stderr, errMsg) {
+			t.Fatalf("expected error %q, got %q\n", errMsg, stderr)
+		}
+		return
+	}
+
 	if err != nil {
 		t.Fatalf("unexpected error: %s\nstdout:\n%s\nstderr:\n%s", err, stdout, stderr)
 	}

internal/command/e2etest/testdata/terraform-providers-mirror-with-broken-lock-file/terraform-providers-mirror.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    template  = { source = "hashicorp/template" }
+    null      = { source = "hashicorp/null" }
+    terraform = { source = "terraform.io/builtin/terraform" }
+  }
+}

internal/command/providers_mirror.go

@@ -88,12 +88,6 @@ func (c *ProvidersMirrorCommand) Run(args []string) int {
 	lockedDeps, lockedDepsDiags := c.Meta.lockedDependencies()
 	diags = diags.Append(lockedDepsDiags)
 
-	// If we have any error diagnostics already then we won't proceed further.
-	if diags.HasErrors() {
-		c.showDiagnostics(diags)
-		return 1
-	}
-
 	// If lock file is present, validate it against configuration
 	if !lockedDeps.Empty() {
 		if errs := config.VerifyDependencySelections(lockedDeps); len(errs) > 0 {
@@ -105,6 +99,12 @@ func (c *ProvidersMirrorCommand) Run(args []string) int {
 		}
 	}
 
+	// If we have any error diagnostics already then we won't proceed further.
+	if diags.HasErrors() {
+		c.showDiagnostics(diags)
+		return 1
+	}
+
 	// Unlike other commands, this command always consults the origin registry
 	// for every provider so that it can be used to update a local mirror
 	// directory without needing to first disable that local mirror