GeezerVison

Part 1 of 2 for automating Terraform bumps. This PR adds the bump script. #31461 is stacked on top and adds the weekly workflow that runs it. Today these bumps are done by hand (#30516, #31301, #31438 and their backports).

scripts/update_terraform_version.sh [--skip-fixtures] <version>

Run from the repo root. It updates every file that pins the bundled Terraform version. Files a branch doesn't have are skipped, so the same script works on main and on older release branches:

• provisioner/terraform/install.go: TerraformVersion. maxTerraformVersion changes only on a minor/major bump (it moves to X.Y.9).
• provisioner/terraform/terraform_SHA256SUMS (from fix: verify bundled terraform against a checksum file in the Coder repo #31600), when the branch has it: replaced with the verified SHA256SUMS. scripts/Dockerfile.base and install.sh read the version and checksums from that file, so neither is edited.
• Otherwise (older branches): install.sh and scripts/Dockerfile.base are edited directly, as before.
• dogfood/coder/Dockerfile, airgap docs (docs/install/airgap.md or docs/install/prepare/airgap.md), .github/actions/setup-tf/action.yaml, testdata/{,resources/}version.txt
• mise.toml, mise.lock (per-platform checksums), flake.nix (per-platform SRI hashes, old and new layouts)
• provisioner/terraform/testdata/generation.sha1: re-fingerprinted with generate.sh --if-needed using the new binary

Every checksum comes from terraform_<v>_SHA256SUMS, and the script fails unless that file carries a valid signature from HashiCorp's release key (C874 011F 0AB4 0511 0D02 1055 3436 5D94 72D7 468F). It refuses downgrades and fails if a touched file still points at another release, or if a branch that pins TERRAFORM_VERSION in install.sh didn't end up on the new version. It doesn't source lib.sh, so CI can run main's copy against a release branch checkout.

Testing

Run in a dogfood workspace:

• main, 1.16.7 to 1.17.1: byte-identical to fix: bump bundled terraform to 1.17.1 #31438, including maxTerraformVersion and generation.sha1.
• release/2.38, 1.16.7 to 1.17.1: byte-identical to fix: bump bundled terraform to 1.17.1 (backport 2.38) #31441.
• release/2.29 (1.16.6 to 1.16.7) and release/2.34, release/2.36 (to 1.17.1): same file sets as the earlier manual backports (fix: bump bundled terraform to 1.16.6 for 2.29 #30555, fix: bump bundled terraform to 1.16.6 for 2.34 #30554, fix: bump bundled terraform to 1.16.6 for 2.36 #30553).
• Rerunning on an already-bumped tree makes no changes. Downgrades, unknown versions and bad flags fail with a clear error.
• Checksum-file layout (fix: verify bundled terraform against a checksum file in the Coder repo #31600 head, 1.16.7 to 1.17.1, --skip-fixtures): terraform_SHA256SUMS is byte-identical to HashiCorp's signed file, install.sh and Dockerfile.base are untouched, the new TestTerraformChecksumFileMatchesVersion passes, and mise.toml, mise.lock, flake.nix, the airgap doc and the install.go versions are byte-identical to fix: bump bundled terraform to 1.17.1 #31438. Rerunning changes nothing.
• Old layout (main, 1.16.7 to 1.17.1, --skip-fixtures): output is byte-identical to the previous revision of this script.
• shellcheck (v0.10.0) and shfmt -d (v3.12.0) are clean on the updated script.
• make lint/shellcheck fmt/shfmt lint/emdash lint/typos pass.

How #31600, #31463 and #31461 fit together

• fix: verify bundled terraform against a checksum file in the Coder repo #31600 makes provisioner/terraform/terraform_SHA256SUMS (a verbatim copy of HashiCorp's signed file) the one place the bundled Terraform checksums live. Dockerfile.base reads it, and install.sh downloads it from the Coder repo at install time.
• chore: add script to bump bundled terraform #31463 adds scripts/update_terraform_version.sh. On branches with the checksum file it just replaces that file. On older branches it edits install.sh and Dockerfile.base directly.
• ci: add weekly workflow to bump bundled terraform #31461 (stacked on chore: add script to bump bundled terraform #31463) runs the script weekly for main and the supported release branches. It needed no changes for the checksum file.

None of the three touch the same files, and merging all three onto main is conflict-free. On that combined tree, the bump script took 1.16.7 to 1.17.1 by replacing the checksum file, the new Go test passes, and actionlint and shellcheck pass. They can merge in any order. Merge #31461 after #31463, retargeted to main.

Opened by Superblink on behalf of @droopy4096.