chore: Backporting #5722 (#5731)

* chore: Backporting #5722

* fix: Fixing codespell

Author: yhakbar

internal/cli/commands/catalog/tui/model_test.go

@@ -192,7 +192,7 @@ func TestTUINavigationToModuleDetails(t *testing.T) {
 		return bytes.Contains(bts, []byte("List of Modules"))
 	}, teatest.WithCheckInterval(time.Millisecond*100), teatest.WithDuration(time.Second*2))
 
-	// Press Enter to select the first module (assuming it's pre-selected)
+	// Press Enter to select the first module (assuming it's preselected)
 	tm.Send(tea.KeyMsg{
 		Type: tea.KeyEnter,
 	})

internal/discovery/phase_parse.go

@@ -9,6 +9,7 @@ import (
 	"github.com/gruntwork-io/terragrunt/internal/component"
 	"github.com/gruntwork-io/terragrunt/internal/errors"
 	"github.com/gruntwork-io/terragrunt/internal/filter"
+	"github.com/gruntwork-io/terragrunt/internal/runner/run/creds"
 	"github.com/gruntwork-io/terragrunt/internal/util"
 	"github.com/gruntwork-io/terragrunt/pkg/config"
 	"github.com/gruntwork-io/terragrunt/pkg/config/hclparse"
@@ -233,6 +234,10 @@ func parseComponent(
 	parseOpts.TerragruntConfigPath = filepath.Join(parseOpts.WorkingDir, configFilename)
 	parseOpts.OriginalTerragruntConfigPath = parseOpts.TerragruntConfigPath
 
+	if _, err := creds.ObtainCredsForParsing(ctx, l, parseOpts); err != nil {
+		return err
+	}
+
 	ctx, parsingCtx := config.NewParsingContext(ctx, l, parseOpts)
 	parsingCtx = parsingCtx.WithDecodeList(
 		config.TerraformSource,

internal/filter/classifier_test.go

@@ -368,6 +368,33 @@ func TestClassifier_Classify(t *testing.T) {
 			expectedReason: filter.CandidacyReasonNone,
 			expectedIdx:    -1,
 		},
+		{
+			name:               "filesystem_match_requires_parse_when_parse_exprs_exist",
+			filterStrs:         []string{"./apps/*", "reading=config/*.hcl"},
+			componentPath:      "./apps/app1",
+			parseDataAvailable: false,
+			expectedStatus:     filter.StatusCandidate,
+			expectedReason:     filter.CandidacyReasonRequiresParse,
+			expectedIdx:        -1,
+		},
+		{
+			name:               "no_filesystem_match_still_requires_parse",
+			filterStrs:         []string{"./apps/*", "reading=config/*.hcl"},
+			componentPath:      "./libs/db",
+			parseDataAvailable: false,
+			expectedStatus:     filter.StatusCandidate,
+			expectedReason:     filter.CandidacyReasonRequiresParse,
+			expectedIdx:        -1,
+		},
+		{
+			name:               "negation_excluded_not_rescued_by_parse_exprs",
+			filterStrs:         []string{"!./apps/app1", "reading=config/*.hcl"},
+			componentPath:      "./apps/app1",
+			parseDataAvailable: false,
+			expectedStatus:     filter.StatusExcluded,
+			expectedReason:     filter.CandidacyReasonNone,
+			expectedIdx:        -1,
+		},
 	}
 
 	for _, tt := range tests {

test/fixtures/auth-provider-cmd/env-in-locals/main.tf

@@ -0,0 +1,7 @@
+variable "secret" {
+  type = string
+}
+
+output "secret" {
+  value = var.secret
+}

test/fixtures/auth-provider-cmd/env-in-locals/mock-auth-cmd.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+printf '{"envs": {"AUTH_PROVIDER_SECRET": "from-auth-provider"}}\n'

test/fixtures/auth-provider-cmd/env-in-locals/terragrunt.hcl

@@ -0,0 +1,7 @@
+locals {
+  secret = get_env("AUTH_PROVIDER_SECRET")
+}
+
+inputs = {
+  secret = local.secret
+}

test/integration_test.go

@@ -3305,6 +3305,42 @@ func TestReadTerragruntAuthProviderCmd(t *testing.T) {
 	assert.Equal(t, "app3-bar", outputs["foo-app3"].Value)
 }
 
+// TestReadTerragruntAuthProviderCmdEnvInLocalsRunAll verifies that
+// auth-provider-cmd credentials are available during discovery queue
+// construction (run --all). Without the fix in phase_parse.go, get_env()
+// in locals cannot see env vars injected by --auth-provider-cmd because
+// ObtainCredsForParsing is never called during the discovery parse phase.
+func TestReadTerragruntAuthProviderCmdEnvInLocalsRunAll(t *testing.T) {
+	t.Parallel()
+
+	helpers.CleanupTerraformFolder(t, testFixtureAuthProviderCmd)
+	tmpEnvPath := helpers.CopyEnvironment(t, testFixtureAuthProviderCmd)
+	rootPath := filepath.Join(tmpEnvPath, testFixtureAuthProviderCmd, "env-in-locals")
+	mockAuthCmd := filepath.Join(rootPath, "mock-auth-cmd.sh")
+
+	helpers.RunTerragrunt(
+		t, fmt.Sprintf(
+			`terragrunt run --all --non-interactive --working-dir %s --auth-provider-cmd %s -- apply -auto-approve`,
+			rootPath,
+			mockAuthCmd,
+		),
+	)
+
+	stdout, _, err := helpers.RunTerragruntCommandWithOutput(
+		t, fmt.Sprintf(
+			"terragrunt run --non-interactive --working-dir %s --auth-provider-cmd %s -- output -json",
+			rootPath,
+			mockAuthCmd,
+		),
+	)
+	require.NoError(t, err)
+
+	outputs := map[string]helpers.TerraformOutput{}
+	require.NoError(t, json.Unmarshal([]byte(stdout), &outputs))
+
+	assert.Equal(t, "from-auth-provider", outputs["secret"].Value)
+}
+
 func TestIamRolesLoadingFromDifferentModules(t *testing.T) {
 	t.Parallel()