Pin Terraform to 1.16 in CI

[ale210]

Terraform was never actually pinned in CI. #38 asked for required_version = "~> 1.12.1" — three components, which fixes major and minor and allows patch. What landed in #109 was "~> 1.12", one component short, and a two-part ~> constraint pins only the major: it means >= 1.12, < 2.0, so every 1.x satisfies it.

The dflook plan/apply actions have no version input — they resolve the constraint and take the newest release that matches. From today's plan run:

Using latest Terraform version that matches the required_version constraints
Switched to Terraform v1.16.0

terraform_version recorded in the state file, s3://hfla-incubator-terraform-state:

Date	Version	Serial
2025-04-14 (pre-constraint)	1.11.4	96
2025-09-20	1.13.3	111
2025-10-18	1.13.4	126
2026-08-11	1.15.8	136
2026-08-29	1.16.0	140

It has never run a 1.12.x under the constraint — 1.13 was already out when #109 merged.

Pinning forward to 1.16 rather than back to 1.12. State serial 140 was written by 1.16.0, and Terraform refuses to load a snapshot created by a newer version, so ~> 1.12.1 today would fail every plan and apply outright. 1.16 is what is already deployed; #38's intent is recoverable, its version target is not.

hackforla/devops-security has the same defect in a stronger form — no required_version at all — and gets the matching change in hackforla/devops-security#179.

Verification

• The plan run on this PR reports Switched to Terraform v1.16.x and succeeds. Confirmed: Switched to Terraform v1.16.0, plan green, No changes.

Not in scope

• terraform/backend.tf is not terraform fmt clean on main (source and superuser alignment); left alone.
• .terraform.lock.hcl is gitignored, so provider versions float in CI too. Only postgresql is pinned; the aws provider has no constraint.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

✅ Plan applied in Terraform apply (OIDC) #67