fix: Fixing --queue-strict-include integration with --queue-include-units-reading (#5222)

* fix: Fixing `--queue-strict-include` integration with `--queue-include-units-reading`

* chore: pattern inclusion fix

* chore: updated normalizePaths

* chore: lint fixes

* chore: docs update

---------

Co-authored-by: Denis O <denis.o@linux.com>

Author: yhakbar

internal/discovery/discovery.go

@@ -831,13 +831,12 @@ func (d *Discovery) processFile(
 		// Everything after this point is only relevant when the filter flag is disabled.
 		// It should be removed once the filter flag is generally available.
 
-		// Enforce include patterns only when strictInclude or excludeByDefault are set AND patterns exist.
-		// When excludeByDefault is true without include patterns (e.g., --units-that-include), or when readFiles
-		// filtering is enabled, we keep configs so downstream filtering can mark exclusions based on read files.
-		// Consolidated include enforcement: only apply when we have include patterns and either:
-		// - strictInclude is enabled, or
-		// - excludeByDefault is enabled and readFiles filtering is NOT enabled
-		enforceInclude := (d.strictInclude || (d.excludeByDefault && !d.readFiles)) && len(d.compiledIncludePatterns) > 0
+		// Enforce include patterns early only when patterns exist AND readFiles is NOT enabled.
+		// When readFiles is enabled (--queue-include-units-reading/--modules-that-include),
+		// we must discover all configs first so that flagUnitsThatRead can filter based on
+		// which files each unit reads. Without this bypass, units outside the default include
+		// patterns (.terragrunt-stack/**) would be dropped before flagUnitsThatRead runs.
+		enforceInclude := !d.readFiles && (d.strictInclude || d.excludeByDefault) && len(d.compiledIncludePatterns) > 0
 		if enforceInclude && !d.matchesIncludePath(canonicalDir) {
 			return nil
 		}
@@ -1264,8 +1263,10 @@ func (d *Discovery) Discover(
 
 		// Apply strictInclude filtering: when strictInclude is true, remove dependencies
 		// that don't match the include patterns (they shouldn't be included just because
-		// they are dependencies of included units)
-		if d.strictInclude && len(d.compiledIncludePatterns) > 0 {
+		// they are dependencies of included units).
+		// Skip this filtering when readFiles is enabled, as we need all components
+		// to remain available for flagUnitsThatRead to process in applyQueueFilters.
+		if d.strictInclude && len(d.compiledIncludePatterns) > 0 && !d.readFiles {
 			components = d.filterByStrictInclude(l, components)
 		}
 

internal/discovery/queue_filters.go

@@ -194,6 +194,9 @@ func unexcludeUnitsReading(components component.Components, normalizedReading []
 
 			readPath = util.CleanPath(readPath)
 
+			// Also resolve symlinks for consistent comparison
+			readPath = resolvePath(readPath)
+
 			if _, ok := readingSet[readPath]; ok {
 				unit.SetExcluded(false)
 
@@ -259,9 +262,10 @@ func (d *Discovery) flagUnitsThatRead(opts *options.TerragruntOptions, component
 		return components
 	}
 
-	// Normalize paths
-	normalizedReading := normalizePaths(opts.WorkingDir, opts.UnitsReading)
-	normalizedIncluding := normalizePaths(opts.WorkingDir, opts.ModulesThatInclude)
+	// Normalize paths using discoveryContext.WorkingDir which is always set correctly
+	workingDir := d.discoveryContext.WorkingDir
+	normalizedReading := normalizePaths(workingDir, opts.UnitsReading)
+	normalizedIncluding := normalizePaths(workingDir, opts.ModulesThatInclude)
 
 	// Capture pre-included units before resetting
 	preIncluded := capturePreIncluded(components)
@@ -270,10 +274,10 @@ func (d *Discovery) flagUnitsThatRead(opts *options.TerragruntOptions, component
 	resetAllUnitsExcluded(components)
 
 	// Un-exclude units that read the requested files
-	unexcludeUnitsReading(components, normalizedReading, opts.WorkingDir)
+	unexcludeUnitsReading(components, normalizedReading, workingDir)
 
 	// Un-exclude units that include the requested files
-	unexcludeModulesThatInclude(components, normalizedIncluding, opts.WorkingDir)
+	unexcludeModulesThatInclude(components, normalizedIncluding, workingDir)
 
 	// Restore prior inclusions
 	restorePreIncluded(components, preIncluded)

test/fixtures/queue-strict-include-units-reading/live/foo/main.tf

@@ -0,0 +1,8 @@
+terraform {
+  source = "."
+}
+
+locals {
+  source_config = read_terragrunt_config("../../sources/source.hcl")
+}
+

test/fixtures/queue-strict-include-units-reading/live/foo/terragrunt.hcl

@@ -0,0 +1,4 @@
+locals {
+  common_value = "from-source"
+}
+

test/fixtures/queue-strict-include-units-reading/sources/source.hcl

@@ -11,7 +11,8 @@ import (
 )
 
 const (
-	testFixtureQueueStrictInclude = "fixtures/queue-strict-include"
+	testFixtureQueueStrictInclude             = "fixtures/queue-strict-include"
+	testFixtureQueueStrictIncludeUnitsReading = "fixtures/queue-strict-include-units-reading"
 )
 
 // TestQueueStrictIncludeWithDependencyNotInQueue tests that when using --queue-strict-include
@@ -137,3 +138,29 @@ func TestQueueStrictIncludeWithDependencyNotInQueue(t *testing.T) {
 			"Should show 'found 1 readyEntries tasks' - dependency should run even though transitive-dependency is not in queue")
 	})
 }
+
+// TestQueueStrictIncludeWithUnitsReadingWithoutIncludeDir reproduces the bug where
+// --queue-strict-include with --queue-include-units-reading (but no --queue-include-dir)
+// fails to discover units that read the specified file.
+func TestQueueStrictIncludeWithUnitsReadingWithoutIncludeDir(t *testing.T) {
+	t.Parallel()
+
+	tmpEnvPath := helpers.CopyEnvironment(t, testFixtureQueueStrictIncludeUnitsReading)
+	helpers.CleanupTerraformFolder(t, tmpEnvPath)
+	testPath := util.JoinPath(tmpEnvPath, testFixtureQueueStrictIncludeUnitsReading)
+
+	// This reproduces the bug: --queue-strict-include + --queue-include-units-reading
+	// without --queue-include-dir should still include units that read the file
+	cmd := fmt.Sprintf("terragrunt run --all --non-interactive --working-dir %s --queue-strict-include --queue-include-units-reading=sources/source.hcl -- plan", testPath)
+	stdout, stderr, err := helpers.RunTerragruntCommandWithOutput(t, cmd)
+
+	// The command should succeed and discover the unit
+	require.NoError(t, err, "Command should succeed\nstdout: %s\nstderr: %s", stdout, stderr)
+
+	output := stdout + stderr
+
+	// Verify that the unit reading sources/source.hcl is discovered and included
+	// This should pass after the fix, but currently fails due to the bug
+	assert.Contains(t, output, "live/foo", "Unit live/foo that reads sources/source.hcl should be included")
+	assert.NotContains(t, output, "No units discovered", "Should discover units reading sources/source.hcl")
+}

test/integration_queue_strict_include_test.go

@@ -345,3 +345,41 @@ func TestUnitsReadingWithFilter(t *testing.T) {
 		})
 	}
 }
+
+// TestQueueStrictIncludeWithUnitsReading tests that --queue-strict-include works correctly
+// with --queue-include-units-reading when no --queue-include-dir is specified.
+// This reproduces the bug where units reading the specified file were not included.
+func TestQueueStrictIncludeWithUnitsReading(t *testing.T) {
+	t.Parallel()
+
+	cleanupTerraformFolder(t, testFixtureUnitsReading)
+
+	tmpEnvPath := helpers.CopyEnvironment(t, testFixtureUnitsReading)
+	rootPath := util.JoinPath(tmpEnvPath, testFixtureUnitsReading)
+	rootPath, err := filepath.EvalSymlinks(rootPath)
+	require.NoError(t, err)
+
+	// Test the bug scenario: --queue-strict-include + --queue-include-units-reading
+	// without --queue-include-dir. Units reading shared.hcl should be included.
+	cmd := "terragrunt run --all plan --non-interactive --log-level trace --working-dir " + rootPath +
+		" --queue-strict-include --queue-include-units-reading shared.hcl"
+
+	_, stderr, err := helpers.RunTerragruntCommandWithOutput(t, cmd)
+	require.NoError(t, err, "Command should succeed and include units reading shared.hcl")
+
+	includedLogEntryRegex := regexp.MustCompile(`=> Unit ([^ ]+) \(excluded: false`)
+	includedUnits := []string{}
+	for _, line := range strings.Split(stderr, "\n") {
+		if includedLogEntryRegex.MatchString(line) {
+			includedUnits = append(includedUnits, includedLogEntryRegex.FindStringSubmatch(line)[1])
+		}
+	}
+
+	// Units that read shared.hcl should be included
+	expectedUnits := []string{
+		"reading-hcl",
+		"reading-hcl-and-tfvars",
+	}
+	assert.ElementsMatch(t, expectedUnits, includedUnits,
+		"Units reading shared.hcl should be included when using --queue-strict-include with --queue-include-units-reading")
+}