chore: PR simplification

Author: denis256

docs/src/data/changelog/v1.1.4/cli-config-loader.mdx

@@ -0,0 +1,27 @@
+---
+version: "v1.1.4"
+category: "enhancements"
+---
+
+#### CLI config parsing no longer depends on the Terraform module
+
+Terragrunt reads your OpenTofu/Terraform CLI config (`.tofurc`, `.terraformrc`, and the
+`*.tfrc` fragments under the CLI config directory) to pick up registry credentials, host
+overrides, and `provider_installation` settings.
+
+That reading used to go through a loader vendored from the `hashicorp/terraform` module,
+which reached the invoking user's home directory directly and pulled a deprecated OpenPGP
+code path into the build. Terragrunt now parses these files itself, through the same
+filesystem and environment handles as the rest of a run.
+
+The file format is unchanged, and so is precedence:
+
+- `TF_CLI_CONFIG_FILE` or `TERRAFORM_CONFIG` names the config file outright, and suppresses the CLI config directory.
+- Otherwise the first existing default candidate is read, then every `*.tfrc` and `*.tfrc.json` fragment in the CLI config directory, in name order.
+- Fragments override the main file for `credentials`, `host`, and `credentials_helper`; `provider_installation` methods are appended; `plugin_cache_dir` keeps the first value set.
+- `TF_PLUGIN_CACHE_DIR` overrides `plugin_cache_dir` from every file, and is not expanded.
+
+Two things that used to pass silently are now reported:
+
+- A `credentials` or `host` block whose label is not a valid hostname is rejected, instead of being dropped and sending an unauthenticated request to the registry.
+- An unsupported `provider_installation` method is rejected by name.

docs/src/data/changelog/v1.1.4/go-1-27.mdx

@@ -0,0 +1,10 @@
+---
+version: "v1.1.4"
+category: "process-updates"
+---
+
+#### Go bumped to `v1.27`
+
+The version of Golang used to compile the Terragrunt binary has been updated from `v1.26.6` to `v1.27.0`.
+
+If you build Terragrunt from source, or import it as a Go module, you now need a Go 1.27 toolchain.

go.mod

@@ -44,6 +44,7 @@ require (
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-plugin v1.8.0
 	github.com/hashicorp/go-version v1.9.0
+	github.com/hashicorp/hcl v1.0.1-vault-7
 	github.com/hashicorp/hcl/v2 v2.24.0
 
 	// Many functions of terraform was converted to internal to avoid use as a library after v0.15.3. This means that we
@@ -219,7 +220,6 @@ require (
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/hashicorp/vault/api v1.23.0 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect

internal/gcphelper/config.go

@@ -2,9 +2,9 @@
 package gcphelper
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 
 	"net/http"
@@ -143,7 +143,9 @@ func (b *GCPConfigBuilder) Build(
 			return nil, err
 		}
 
-		clientOpts = append(clientOpts, credOpt)
+		if credOpt != nil {
+			clientOpts = append(clientOpts, credOpt)
+		}
 	} else if gcpCfg != nil && gcpCfg.AccessToken != "" {
 		// Use access token from config
 		tokenSource := oauth2.StaticTokenSource(&oauth2.Token{
@@ -213,37 +215,39 @@ func credentialsFileOption(v *venv.Venv, filename string) (option.ClientOption,
 	return credentialsJSONOption(v, data)
 }
 
-// credentialsJSONOption authenticates with a credentials JSON payload.
+// credentialsJSONOption authenticates with a credentials JSON payload, or returns a nil
+// option when the payload is empty so the caller falls through to the ADC chain the way
+// the SDK's own detection does.
 //
-// The credential type is selected explicitly because the SDK's generic JSON
-// detection is deprecated. Terragrunt retains support for every credential type
-// the SDK supports, but rejects unknown values before constructing credentials.
+// The payload's type is read here rather than by the SDK's generic JSON detection, whose
+// CredentialsJSON option is deprecated. The credentials are still built on v.HTTP, because
+// the SDK would otherwise put the token exchange on a client of its own making
+// (google.golang.org/api/internal.creds) that the venv never sees.
 func credentialsJSONOption(v *venv.Venv, data []byte) (option.ClientOption, error) {
+	if len(bytes.TrimSpace(data)) == 0 {
+		return nil, nil
+	}
+
 	var metadata struct {
 		Type credentials.CredType `json:"type"`
 	}
 
 	if err := json.Unmarshal(data, &metadata); err != nil {
-		return nil, fmt.Errorf("error parsing GCP credentials: %w", err)
+		return nil, fmt.Errorf("%w: %w", ErrParsingCredentials, err)
 	}
 
-	switch metadata.Type {
-	case credentials.ServiceAccount,
-		credentials.AuthorizedUser,
-		credentials.ExternalAccount,
-		credentials.ExternalAccountAuthorizedUser,
-		credentials.ImpersonatedServiceAccount,
-		credentials.GDCHServiceAccount:
-	default:
-		return nil, fmt.Errorf("unsupported GCP credentials type %q", metadata.Type)
+	// The SDK reports a missing type as an unsupported filetype, which does not say what is wrong.
+	if metadata.Type == "" {
+		return nil, fmt.Errorf("%w: the payload has no \"type\" field", ErrParsingCredentials)
 	}
 
+	// Every credential type the SDK accepts is passed through; it rejects the rest itself.
 	creds, err := credentials.NewCredentialsFromJSON(metadata.Type, data, &credentials.DetectOptions{
 		Scopes: gcsScopes(),
 		Client: v.HTTP,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("error detecting GCP credentials: %w", err)
+		return nil, fmt.Errorf("%w of type %q: %w", ErrBuildingCredentials, metadata.Type, err)
 	}
 
 	return option.WithAuthCredentials(creds), nil
@@ -271,7 +275,7 @@ func createGCPCredentialsFromGoogleCredentialsEnv(
 	}
 
 	if err := json.Unmarshal([]byte(contents), &account); err != nil {
-		return nil, errors.New("error parsing GCP credentials")
+		return nil, fmt.Errorf("%w from GOOGLE_CREDENTIALS: %w", ErrParsingCredentials, err)
 	}
 
 	conf := jwt.Config{

internal/gcphelper/config_test.go

@@ -248,3 +248,47 @@ func TestGcpConfigWithGoogleCredentialsFile(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotEmpty(t, clientOpts)
 }
+
+func TestGcpConfigCredentialsPayloads(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		expected error
+		name     string
+		payload  string
+	}{
+		{name: "unsupported type", payload: `{"type":"gce_metadata"}`, expected: gcphelper.ErrBuildingCredentials},
+		{name: "missing type", payload: `{"client_email":"a@b.com"}`, expected: gcphelper.ErrParsingCredentials},
+		{name: "not json", payload: `not-json`, expected: gcphelper.ErrParsingCredentials},
+		{name: "json array", payload: `["a"]`, expected: gcphelper.ErrParsingCredentials},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			credsFile := filepath.Join(t.TempDir(), "credentials.json")
+			require.NoError(t, os.WriteFile(credsFile, []byte(tc.payload), 0o600))
+
+			_, err := gcphelper.NewGCPConfigBuilder().
+				WithSessionConfig(&gcphelper.GCPSessionConfig{Credentials: credsFile}).
+				Build(context.Background(), venvtest.NewWithOSFS().WithEnv(map[string]string{}))
+			require.ErrorIs(t, err, tc.expected)
+		})
+	}
+}
+
+// TestGcpConfigEmptyCredentialsFileFallsBackToADC pins the behaviour an unpopulated secret
+// volume depends on: an empty file contributes no option rather than failing the run.
+func TestGcpConfigEmptyCredentialsFileFallsBackToADC(t *testing.T) {
+	t.Parallel()
+
+	credsFile := filepath.Join(t.TempDir(), "credentials.json")
+	require.NoError(t, os.WriteFile(credsFile, nil, 0o600))
+
+	clientOpts, err := gcphelper.NewGCPConfigBuilder().
+		WithSessionConfig(&gcphelper.GCPSessionConfig{Credentials: credsFile}).
+		Build(context.Background(), venvtest.NewWithOSFS().WithEnv(map[string]string{}))
+	require.NoError(t, err)
+	assert.Empty(t, clientOpts)
+}

internal/gcphelper/errors.go

@@ -0,0 +1,10 @@
+package gcphelper
+
+import "errors"
+
+var (
+	// ErrParsingCredentials reports a GCP credentials payload that is not usable JSON.
+	ErrParsingCredentials = errors.New("error parsing GCP credentials")
+	// ErrBuildingCredentials reports a credentials payload the SDK refused to turn into credentials.
+	ErrBuildingCredentials = errors.New("error building GCP credentials")
+)

internal/getter/defaults.go

@@ -1,6 +1,7 @@
 package getter
 
 import (
+	"errors"
 	"net/http"
 	"sync"
 
@@ -12,6 +13,9 @@ import (
 	getter "github.com/hashicorp/go-getter/v2"
 )
 
+// ErrNilVenv reports a nil venv handed to a constructor that authenticates through one.
+var ErrNilVenv = errors.New("getter: venv must not be nil")
+
 // Registry keys for the non-git fetcher and resolver maps. They match
 // the lowercased scheme strings CASGetter.Detect produces. Exported so
 // callers can extend or replace specific entries in
@@ -95,16 +99,14 @@ func WithDispatchFS(fsys vfs.FS) GenericFetcherOption {
 // authenticate through, so the fetcher and the resolver read the registry
 // token and the user's CLI config from the same handles.
 func WithDispatchVenv(v *venv.Venv) GenericFetcherOption {
-	return func(c *genericFetcherConfig) {
-		if v == nil {
-			panic("getter: WithDispatchVenv requires a non-nil venv")
-		}
-
-		c.venv = v
+	if v == nil {
+		panic(ErrNilVenv)
 	}
+
+	return func(c *genericFetcherConfig) { c.venv = v }
 }
 
-// dispatchVenv returns the environment the tfr dispatch entries ride: the one
+// dispatchVenv returns the venv the tfr dispatch entries ride: the one
 // [WithDispatchVenv] persisted, or v when the caller left it unset.
 func dispatchVenv(v *venv.Venv, c *genericFetcherConfig) *venv.Venv {
 	if c.venv != nil {

internal/getter/resolver.go

@@ -41,7 +41,7 @@ func DefaultSourceResolvers(
 
 	tfr := NewTFRResolver().
 		WithHTTPClient(vhttp.WithTimeout(v.HTTP, tfrResolverTimeout)).
-		WithAuth(RegistryAuth{Venv: dispatchVenv(v, &cfg)})
+		WithAuth(NewRegistryAuth(dispatchVenv(v, &cfg)))
 
 	if cfg.tfrEnabled {
 		requireLoggerFS(&cfg, SchemeTFR)

internal/getter/resolver_tfr.go

@@ -92,7 +92,7 @@ func (r *TFRResolver) Probe(ctx context.Context, rawURL string) (string, error)
 
 	registryDomain := srcURL.Host
 	if registryDomain == "" {
-		registryDomain = tfimpl.DefaultRegistryDomain(r.Auth.env(), r.TofuImplementation)
+		registryDomain = tfimpl.DefaultRegistryDomain(r.Auth.registryEnv(), r.TofuImplementation)
 	}
 
 	versionList, hasVersion := srcURL.Query()[versionQueryKey]

internal/getter/tfr_test.go

@@ -294,15 +294,14 @@ credentials %q {
 	require.NoError(t, err)
 }
 
-func TestRegistryGetterNilEnvDoesNotPanic(t *testing.T) {
+func TestRegistryGetterEmptyEnvSendsNoAuth(t *testing.T) {
 	t.Parallel()
 
 	server := newRegistryTestServerWithRequestHook(t, func(r *http.Request) {
 		assert.Empty(t, r.Header.Get("Authorization"))
 	})
 
-	v := venvtest.NewWithOSFS().WithHTTP(server.Client())
-	v.Env = nil
+	v := venvtest.NewWithOSFS().WithHTTP(server.Client()).WithEnv(map[string]string{})
 
 	client := newRegistryTestClientWithVenv(t, v, tfimpl.Terraform)