Many Terraform users assume that a version constraint guarantees the same provider version everywhere.
That assumption breaks down in CI.
Terraform constraints define which versions are allowed, but Terraform init still selects a specific provider version. Different runners can make different selections when no lock file controls the outcome.
This lesson explains the difference between version constraints and provider locking, how .terraform.lock.hcl records provider selections, and why CI pipelines should reject unexpected dependency changes.
The goal is not preventing upgrades.
The goal is making upgrades intentional, reviewable, and predictable.