From 1087b4e0e37297cf29a486426621cd16672ab872 Mon Sep 17 00:00:00 2001
From: kiwigitops <kiwisclubco@gmail.com>
Date: Sat, 23 May 2026 02:01:04 -0400
Subject: [PATCH] Support OpenTofu Cloudflare provider lock entries

---
 cmd/tf-migrate/version_check.go      | 17 ++++++++++++-----
 cmd/tf-migrate/version_check_test.go | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/cmd/tf-migrate/version_check.go b/cmd/tf-migrate/version_check.go
index 40c4876c..ffbeb0ce 100644
--- a/cmd/tf-migrate/version_check.go
+++ b/cmd/tf-migrate/version_check.go
@@ -90,12 +90,8 @@ func parseVersionFromLockFile(configDir string) (string, error) {
 			continue
 		}
 
-		// Check for registry.terraform.io/cloudflare/cloudflare
-		// or just cloudflare/cloudflare (older formats)
 		providerLabel := labels[0]
-		if providerLabel == "registry.terraform.io/cloudflare/cloudflare" ||
-			providerLabel == "cloudflare/cloudflare" {
-
+		if isCloudflareProviderAddress(providerLabel) {
 			versionAttr := block.Body().GetAttribute("version")
 			if versionAttr == nil {
 				continue
@@ -111,6 +107,17 @@ func parseVersionFromLockFile(configDir string) (string, error) {
 	return "", nil
 }
 
+func isCloudflareProviderAddress(providerLabel string) bool {
+	switch providerLabel {
+	case "registry.terraform.io/cloudflare/cloudflare",
+		"registry.opentofu.org/cloudflare/cloudflare",
+		"cloudflare/cloudflare":
+		return true
+	default:
+		return false
+	}
+}
+
 // parseVersionFromRequiredProviders scans all .tf files for the required_providers
 // block and extracts the cloudflare provider version constraint.
 // Returns the version constraint string and the file path where it was found.
diff --git a/cmd/tf-migrate/version_check_test.go b/cmd/tf-migrate/version_check_test.go
index aa5a2f74..37ee9f1a 100644
--- a/cmd/tf-migrate/version_check_test.go
+++ b/cmd/tf-migrate/version_check_test.go
@@ -116,6 +116,27 @@ provider "registry.terraform.io/cloudflare/cloudflare" {
 		t.Errorf("Expected version 4.52.5, got %s", version)
 	}
 
+	// Test with OpenTofu registry lock file
+	tempDirOpenTofu := t.TempDir()
+	lockContentOpenTofu := `provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "4.52.7"
+  constraints = "~> 4.0"
+}
+`
+	lockFileOpenTofu := filepath.Join(tempDirOpenTofu, ".terraform.lock.hcl")
+	err = os.WriteFile(lockFileOpenTofu, []byte(lockContentOpenTofu), 0644)
+	if err != nil {
+		t.Fatalf("Failed to write lock file: %v", err)
+	}
+
+	version, err = parseVersionFromLockFile(tempDirOpenTofu)
+	if err != nil {
+		t.Fatalf("parseVersionFromLockFile failed: %v", err)
+	}
+	if version != "4.52.7" {
+		t.Errorf("Expected version 4.52.7, got %s", version)
+	}
+
 	// Test with lock file without cloudflare provider
 	lockContentNoCF := `# This file is maintained automatically by "terraform init".
 provider "registry.terraform.io/hashicorp/aws" {