Parsing terraform file fails when installing Terraform

[dgrenner]

Problem description

When installing Terraform the parsing of a valid terraform file fails. As a result the required_version specified in the file is ignored. Since latest version of Terraform is picked as a fallback the workflow fails since configuration does not support the chosen Terraform version.

Code example: https://github.com/dgrenner/tf-version - the issue here is line 27 of main.tf (as shown in the workflow log below).
Job run that fails: https://github.com/dgrenner/tf-version/actions/runs/12926732690/job/36050432700

Terraform version

1.10.4

Backend

none

Workflow YAML

name: Push
on:
  push:

jobs:
  terraform-apply:
    name: Terraform apply
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: TF apply
        uses: dflook/terraform-apply@v1.45.0

Workflow log

::group::Installing Terraform
Installing Terraform
  ##[debug]Unexpected token Token('NAME', 'subscription_name') at line 27, column 7.
  ##[debug]Expected one of: 
  ##[debug]	* COMMA
  ##[debug]	* NL_OR_COMMENT
  ##[debug]	* QMARK
  ##[debug]	* BINARY_OP
  ##[debug]	* RBRACE
  ##[debug]Unexpected token Token('NAME', 'subscription_name') at line 27, column 7.
  ##[debug]Expected one of: 
  ##[debug]	* QMARK
  ##[debug]	* BINARY_OP
  ##[debug]	* RBRACE
  ##[debug]	* COMMA
  ##[debug]	* NL_OR_COMMENT
  ##[debug]Downloading signature from https://releases.hashicorp.com/terraform/1.10.5/terraform_1.10.5_SHA256SUMS.72D7468F.sig
  ##[debug]Downloading checksums from https://releases.hashicorp.com/terraform/1.10.5/terraform_1.10.5_SHA256SUMS
  gpg: Signature made Wed Jan 22 17:07:54 2025 UTC
  gpg:                using RSA key 374EC75B485913604A831CC7C820C6D5CD27AB87
  gpg: Good signature from "HashiCorp Security (hashicorp.com/security) <security@hashicorp.com>" [ultimate]
  ##[debug]Downloading archive from https://releases.hashicorp.com/terraform/1.10.5/terraform_1.10.5_linux_amd64.zip
  terraform_1.10.5_linux_amd64.zip: OK
  Version not specified, using the latest release version
  Switched to Terraform v1.10.5
  ##[debug]ls -la /usr/local/bin/terraform:lrwxrwxrwx 1 root root 31 Jan 23 10:02 /usr/local/bin/terraform -> /tmp/terraform_1.10.5/terraform
  Terraform v1.10.5
  on linux_amd64
  ##[debug] Terraform version major 1 minor 10 patch 5
  ##[debug]Unexpected token Token('NAME', 'subscription_name') at line 27, column 7.
  ##[debug]Expected one of: 
  ##[debug]	* BINARY_OP
  ##[debug]	* QMARK
  ##[debug]	* COMMA
  ##[debug]	* RBRACE
  ##[debug]	* NL_OR_COMMENT
  ##[debug]Unexpected token Token('NAME', 'subscription_name') at line 27, column 7.
  ##[debug]Expected one of: 
  ##[debug]	* BINARY_OP
  ##[debug]	* NL_OR_COMMENT
  ##[debug]	* RBRACE
  ##[debug]	* COMMA
  ##[debug]	* QMARK
  Detected local backend
  ::endgroup::
::group::Initializing Terraform
Initializing Terraform
  ##[debug] TF_WORKSPACE=default terraform init -input=false $INIT_ARGS
  Initializing the backend...
  Initializing modules...
  - pubsub in module
  ╷
  │ Error: Unsupported Terraform Core version
  │ 
  │   on main.tf line 2, in terraform:
  │    2:   required_version = "1.10.4"
  │ 
  │ This configuration does not support Terraform version 1.10.5. To proceed,
  │ either choose another supported Terraform version or update this version
  │ constraint. Version constraints are normally set for good reason, so
  │ updating the constraint may lead to other errors or unexpected behavior.
  ╵
  ##[debug]tree:/github/home
  ##[debug]tree:|-- [1001      26M]  .dflook-terraform-github-actions/
  ##[debug]tree:|   `-- [1001      26M]  terraform-bin-dir/
  ##[debug]tree:|       `-- [1001      26M]  terraform_1.10.5_linux_amd64.zip
  ##[debug]tree:`-- [1001     8.0K]  .terraform.d/
  ##[debug]tree:    `-- [1001     4.0K]  plugin-cache/
  ##[debug]tree:
  ##[debug]tree:  26M used in 4 directories, 1 file
  ##[debug]Docker Action run completed with exit code 1
  ##[debug]Finishing: TF apply

Has debug logging been enabled?

• Yes, the ACTIONS_STEP_DEBUG secret was set to true when capturing the workflow log above. I understand that if I have not done this, I may not recieve a response.

[dflook]

Thanks for creating an issue @dgrenner. I had a feeling this would fail eventually, the hcl parsing library the actions use is just not very good.

I'm working on a change to make this more robust.

[dflook]

v1.46.1 was just released, which should be able to cope much better with this issue. I plan to replace the parser at some point, but that will be more work.