OpenTofu "Inconsistent dependency lock file" in CI

OpenTofu found a provider your configuration needs that is not recorded in .terraform.lock.hcl, and init is running in a mode that forbids changing the lock. It refuses rather than silently editing the committed lock.

What this error means

tofu init fails with "Error: Inconsistent dependency lock file" and "provider registry.opentofu.org/hashicorp/random: required by this configuration but no version is selected".

tofu

Error: Inconsistent dependency lock file

The following dependency selections recorded in the lock file are inconsistent
with the current configuration:
  - provider registry.opentofu.org/hashicorp/random: required by this
    configuration but no version is selected

To update the locked dependency selections to match a changed configuration,
run: tofu init -upgrade

Common causes

A new provider was added without relocking

Someone added a provider to the configuration but did not run init to add it to .terraform.lock.hcl, so the committed lock is incomplete.

init ran without permission to change the lock

In CI a locked init path (or the absence of -upgrade) refuses to add the missing selection, surfacing the inconsistency instead.

How to fix it

Relock and commit

Run tofu init -upgrade to add the missing provider to the lock.
Commit the updated .terraform.lock.hcl with the config change.
Re-run CI so the locked init now matches the configuration.

Terminal

tofu init -upgrade
git add .terraform.lock.hcl

Keep the lock change in the same commit as the provider

Add the provider to required_providers and regenerate the lock together, so CI never sees a config that references a provider absent from the lock.

How to prevent it

Run tofu init locally after adding any provider and commit the lock.
Review .terraform.lock.hcl diffs alongside provider changes.
Do not hand-edit the lock file.