fix(manager/terraform/lockfile): use registryURL defined in lockfile (#28886)

lib/modules/manager/terraform/lockfile/index.spec.ts

@@ -76,7 +76,7 @@ describe('modules/manager/terraform/lockfile/index', () => {
 
   it('update single dependency with exact constraint and depType provider', async () => {
     fs.readLocalFile.mockResolvedValueOnce(codeBlock`
-      provider "registry.terraform.io/hashicorp/aws" {
+      provider "registry.opentofu.org/hashicorp/aws" {
         version     = "3.0.0"
         constraints = "3.0.0"
         hashes = [
@@ -111,7 +111,7 @@ describe('modules/manager/terraform/lockfile/index', () => {
       {
         file: {
           contents: codeBlock`
-            provider "registry.terraform.io/hashicorp/aws" {
+            provider "registry.opentofu.org/hashicorp/aws" {
               version     = "3.36.0"
               constraints = "3.36.0"
               hashes = [
@@ -126,7 +126,7 @@ describe('modules/manager/terraform/lockfile/index', () => {
       },
     ]);
     expect(mockHash.mock.calls).toEqual([
-      ['https://registry.terraform.io', 'hashicorp/aws', '3.36.0'],
+      ['https://registry.opentofu.org', 'hashicorp/aws', '3.36.0'],
     ]);
   });
 

lib/modules/manager/terraform/lockfile/index.ts

@@ -3,7 +3,6 @@ import { logger } from '../../../../logger';
 import * as p from '../../../../util/promises';
 import { escapeRegExp, regEx } from '../../../../util/regex';
 import { GetPkgReleasesConfig, getPkgReleases } from '../../../datasource';
-import { TerraformProviderDatasource } from '../../../datasource/terraform-provider';
 import { get as getVersioning } from '../../../versioning';
 import type {
   UpdateArtifact,
@@ -167,9 +166,6 @@ export async function updateArtifacts({
         massageProviderLookupName(dep);
         const { registryUrls, newVersion, packageName } = dep;
 
-        const registryUrl = registryUrls
-          ? registryUrls[0]
-          : TerraformProviderDatasource.defaultRegistryUrls[0];
         const updateLock = locks.find(
           (value) => value.packageName === packageName,
         );
@@ -191,6 +187,10 @@ export async function updateArtifacts({
             continue;
           }
         }
+
+        // use registryURL defined in the update and fall back to the one defined in the lockfile
+        const registryUrl = registryUrls?.[0] ?? updateLock.registryUrl;
+
         const newConstraint = getNewConstraint(dep, updateLock.constraints);
         const update: ProviderLockUpdate = {
           // TODO #22198

lib/modules/manager/terraform/readme.md

+### Terraform vs OpenTofu
+
+There is no way for Renovate to differentiate, if a user is a Terraform user or has already adopted OpenTofu.
+Therefore, Renovate defaults currently to interpret providers without a registry definition to be located at `registry.terraform.io`.
+This behaviour can be modified using `packageRules`:
+
+```json title="Prefer releases from OpenTofu"
+{
+  "packageRules": [
+    {
+      "matchDatasources": ["terraform-provider"],
+      "registryUrl": "https://registry.opentofu.org"
+    }
+  ]
+}
+```
+
 ### Supported dependencies
 
 Renovate supports updating the Terraform dependencies listed below.