Merge branch 'best-practice-lockfile' into 'main'

Document best practice for lockfile handling

Closes #38

See merge request components/opentofu!64

.gitlab/README.md.template

@@ -205,6 +205,21 @@ plan:
     - apk add jq
 ```
 
+### Best Practices
+
+This section is a collection of *some* best practices.
+Feel free to contribute more that generally apply.
+If a best practice really becomes the de-facto standard
+we may make it the default behavior if possible.
+
+#### Lockfile Handling
+
+If you commit the Lockfile (`.terraform.lock.hcl`) to your repository
+we recommend setting either the `TF_INIT_FLAGS` (handled by this component)
+or `TF_CLI_ARGS_init` (handled by OpenTofu directly) to `-lockfile=readonly`
+to prevent any changes to the lockfile during the pipeline job and with
+that ensuring that OpenTofu really uses the locked dependencies.
+
 ## Releases & Versioning
 
 This project currently releases tagged commits.

README.md

@@ -230,6 +230,21 @@ plan:
     - apk add jq
 ```
 
+### Best Practices
+
+This section is a collection of *some* best practices.
+Feel free to contribute more that generally apply.
+If a best practice really becomes the de-facto standard
+we may make it the default behavior if possible.
+
+#### Lockfile Handling
+
+If you commit the Lockfile (`.terraform.lock.hcl`) to your repository
+we recommend setting either the `TF_INIT_FLAGS` (handled by this component)
+or `TF_CLI_ARGS_init` (handled by OpenTofu directly) to `-lockfile=readonly`
+to prevent any changes to the lockfile during the pipeline job and with
+that ensuring that OpenTofu really uses the locked dependencies.
+
 ## Releases & Versioning
 
 This project currently releases tagged commits.