pin tf version to avoid surprise breaking changes

.terraform-version

@@ -0,0 +1 @@
+1.14.9

build/build.mk

@@ -53,7 +53,8 @@ else
 endif
 
 # Linker flags: https://cmake.org/cmake/help/latest/envvar/LDFLAGS.html.
-LDFLAGS := "-s -w -X $(BASE_PACKAGE_NAME)/pkg/version.channel=$(REL_CHANNEL) -X $(BASE_PACKAGE_NAME)/pkg/version.release=$(REL_VERSION) -X $(BASE_PACKAGE_NAME)/pkg/version.commit=$(GIT_COMMIT) -X $(BASE_PACKAGE_NAME)/pkg/version.version=$(GIT_VERSION) -X $(BASE_PACKAGE_NAME)/pkg/version.chartVersion=$(CHART_VERSION)"
+TERRAFORM_VERSION := $(shell cat .terraform-version)
+LDFLAGS := "-s -w -X $(BASE_PACKAGE_NAME)/pkg/version.channel=$(REL_CHANNEL) -X $(BASE_PACKAGE_NAME)/pkg/version.release=$(REL_VERSION) -X $(BASE_PACKAGE_NAME)/pkg/version.commit=$(GIT_COMMIT) -X $(BASE_PACKAGE_NAME)/pkg/version.version=$(GIT_VERSION) -X $(BASE_PACKAGE_NAME)/pkg/version.chartVersion=$(CHART_VERSION) -X $(BASE_PACKAGE_NAME)/pkg/recipes/terraform.terraformVersion=$(TERRAFORM_VERSION)"
 
 # Combination of flags into GOARGS.
 GOARGS := -v -gcflags $(GCFLAGS) -ldflags $(LDFLAGS)

pkg/recipes/terraform/install.go

@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/go-logr/logr"
+	"github.com/hashicorp/go-version"
 	install "github.com/hashicorp/hc-install"
 	"github.com/hashicorp/hc-install/product"
 	"github.com/hashicorp/hc-install/releases"
@@ -174,10 +175,7 @@ func downloadAndInstallTerraform(ctx context.Context, installer *install.Install
 
 	installStartTime := time.Now()
 	execPath, err := installer.Ensure(ctx, []src.Source{
-		&releases.LatestVersion{
-			Product:    product.Terraform,
-			InstallDir: globalDir,
-		},
+		&releases.ExactVersion{Product: product.Terraform, Version: version.Must(version.NewVersion(terraformVersion))},
 	})
 	if err != nil {
 		metrics.DefaultRecipeEngineMetrics.RecordTerraformInstallationDuration(ctx, installStartTime,

pkg/recipes/terraform/version.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2026 The Radius Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package terraform
+
+// terraformVersion is the version of Terraform that Radius downloads and
+// uses to execute Terraform recipes.
+//
+// The canonical source of truth is the .terraform-version file at the
+// repository root (matching the .node-version / .python-version
+// convention used by tfenv, tfswitch, asdf, and mise). The Makefile reads
+// that file and overrides this value at build time via the
+// -X linker flag. The hard-coded default below is used by `go test`,
+// `go run`, and other invocations that do not go through the Makefile;
+// the TestTerraformVersionMatchesFile test guarantees it stays in sync
+// with the file.
+var terraformVersion = "1.14.9"
+
+// TerraformVersion returns the Terraform version Radius will install.
+func TerraformVersion() string {
+	return terraformVersion
+}

pkg/recipes/terraform/version_test.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2026 The Radius Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package terraform
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestTerraformVersionMatchesFile guarantees that the hard-coded
+// terraformVersion default in version.go stays in sync with the
+// .terraform-version file at the repository root.
+func TestTerraformVersionMatchesFile(t *testing.T) {
+	_, thisFile, _, ok := runtime.Caller(0)
+	require.True(t, ok, "unable to determine test file location")
+
+	// Walk up from this file to the repo root (which contains go.mod).
+	dir := filepath.Dir(thisFile)
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			break
+		}
+		parent := filepath.Dir(dir)
+		require.NotEqual(t, parent, dir, "could not locate repository root (go.mod)")
+		dir = parent
+	}
+
+	contents, err := os.ReadFile(filepath.Join(dir, ".terraform-version"))
+	require.NoError(t, err, "failed to read .terraform-version at repo root")
+
+	require.Equal(t,
+		strings.TrimSpace(string(contents)),
+		terraformVersion,
+		"terraformVersion default in version.go must match .terraform-version at repo root",
+	)
+}