Merge branch 'main' into robots

Author: karlcarstensen

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-<!-- Prepend '[WIP]' to the title if this PR is still a work-in-progress. Remove it when it is ready for review! -->
+<!-- Keep this PR in draft while it is still a work-in-progress. Mark it as ready for review once it is ready for review by maintainers. -->
 
 ## Description
 
@@ -14,15 +14,7 @@ Read the [Gruntwork contribution guidelines](https://gruntwork.notion.site/Grunt
 - [ ] I am submitting code based on open source software (e.g. MIT, MPL-2.0, Apache)
 - [ ] I am adding or upgrading a dependency or adapted code and confirm it has a compatible open source license
 - [ ] Update the docs.
+- [ ] Update the changelog in the docs.
 - [ ] Run the relevant tests successfully, including pre-commit checks.
-- [ ] Include release notes. If this PR is backward incompatible, include a migration guide.
-
-## Release Notes (draft)
-
-<!-- One-line description of the PR that can be included in the final release notes. -->
-Added / Removed / Updated [X].
-
-### Migration Guide
-
-<!-- Important: If you made any backward incompatible changes, then you must write a migration guide! -->
-
+- [ ] This change is backwards compatible.
+- [ ] If this change is not forwards compatible (e.g. a new feature), it is gated behind a feature flag.

.github/scripts/release/resolve-version-ref.sh

@@ -3,7 +3,9 @@
 set -euo pipefail
 
 # Script to resolve the release version and target ref from a
-# workflow_dispatch input by looking up the existing draft release.
+# workflow_dispatch input by looking up the existing release.
+# Works for both draft and published releases so an existing release
+# can be rebuilt and clobbered with new assets.
 #
 # Usage: resolve-version-ref.sh
 # Environment variables:
@@ -20,18 +22,11 @@ function main {
 
 	# Look up the release to get target_commitish
 	local release_json
-	if ! release_json=$(gh release view "$version" --json 'isDraft,targetCommitish' 2>/dev/null); then
+	if ! release_json=$(gh release view "$version" --json 'targetCommitish' 2>/dev/null); then
 		echo "ERROR: No release found for version $version" >&2
 		exit 1
 	fi
 
-	local is_draft
-	is_draft=$(jq -r '.isDraft' <<<"$release_json")
-	if [[ "$is_draft" != "true" ]]; then
-		echo "ERROR: Release $version is already published. Cannot rebuild a published release." >&2
-		exit 1
-	fi
-
 	local ref
 	ref=$(jq -r '.targetCommitish' <<<"$release_json")
 

.github/scripts/release/tests/resolve-version-ref.bats

@@ -27,7 +27,7 @@ teardown() {
 
   run "$SCRIPT"
   [ "$status" -eq 0 ]
-  grep -q "^version=v1.2.3$" "$GITHUB_OUTPUT"
+  grep -q "^version=${INPUT_VERSION}$" "$GITHUB_OUTPUT"
   grep -q "^ref=${sha}$" "$GITHUB_OUTPUT"
 }
 
@@ -40,12 +40,14 @@ teardown() {
   [[ "$output" == *"No release found"* ]]
 }
 
-@test "errors if release is already published" {
-  export GH_STUB_RESPONSE='{"isDraft":false,"targetCommitish":"a1b2c3d4e5f6789012345678901234567890abcd"}'
+@test "resolves published release to version + ref" {
+  local sha="a1b2c3d4e5f6789012345678901234567890abcd"
+  export GH_STUB_RESPONSE="{\"targetCommitish\":\"${sha}\"}"
 
   run "$SCRIPT"
-  [ "$status" -ne 0 ]
-  [[ "$output" == *"already published"* ]]
+  [ "$status" -eq 0 ]
+  grep -q "^version=${INPUT_VERSION}$" "$GITHUB_OUTPUT"
+  grep -q "^ref=${sha}$" "$GITHUB_OUTPUT"
 }
 
 @test "fails when INPUT_VERSION missing" {

.github/workflows/sign-macos.yml

@@ -25,11 +25,16 @@ on:
         required: false
         type: string
         default: 'macos-signed-files'
+      skip-build:
+        description: 'Skip the internal build job and sign artifacts uploaded earlier in this workflow run'
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   build:
     name: Build (darwin/${{ matrix.arch }})
-    if: github.event_name == 'workflow_dispatch'
+    if: ${{ inputs['skip-build'] != true }}
     runs-on: ubuntu-latest
     strategy:
       matrix:

.github/workflows/sign-windows.yml

@@ -25,11 +25,16 @@ on:
         required: false
         type: string
         default: 'windows-signed-files'
+      skip_build:
+        description: 'Skip the internal build job and sign artifacts uploaded earlier in this workflow run'
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   build:
     name: Build (windows/${{ matrix.arch }})
-    if: github.event_name == 'workflow_dispatch'
+    if: ${{ inputs.skip_build != true }}
     runs-on: ubuntu-latest
     strategy:
       matrix:

.golangci.yml

@@ -121,7 +121,7 @@ linters:
       # trying to get this merged in.
       - linters:
           - lll
-        path-except: '^(internal/awshelper/|internal/cas/|internal/cli/commands/(backend/(delete|migrate)|catalog/tui/command|exec|find|help|list|stack)/|internal/cloner/|internal/configbridge/|internal/engine/|internal/errorconfig/|internal/errors/|internal/experiment/|internal/gcphelper/|internal/git/|internal/os/exec/|internal/prepare/|internal/queue/|internal/runner/(common|graph|run/creds)/|internal/stacks/(generate|output)/|internal/tf/cache/(controllers|middleware)/|internal/tflint/|internal/tips/|internal/vfs/|internal/worktrees/|pkg/log/(format/placeholders|writer)/)'
+        path-except: '^(internal/awshelper/|internal/cas/|internal/cli/commands/(backend/(delete|migrate)|catalog/tui/command|dag/graph|exec|find|help|list|scaffold|stack)/|internal/cloner/|internal/configbridge/|internal/engine/|internal/errorconfig/|internal/errors/|internal/experiment/|internal/gcphelper/|internal/git/|internal/os/exec/|internal/prepare/|internal/queue/|internal/report/|internal/retry/|internal/runner/(common|graph|run/creds|runall|runcfg)/|internal/stacks/(generate|output)/|internal/telemetry/|internal/tf/cache/(controllers|middleware)/|internal/tflint/|internal/tips/|internal/vfs/|internal/worktrees/|pkg/log/(format/(options|placeholders)|writer)/|pkg/options/)'
     paths:
       - docs
       - _ci

docs/src/content/docs/01-getting-started/04-terminology.md

@@ -162,7 +162,7 @@ The Run Queue is the queue of all units that Terragrunt will do work on over one
 
 Certain commands like [run --all](/reference/cli/commands/run#all) populate the Run Queue with all units in a stack, while other commands like `plan` or `apply` will only populate the Run Queue with the unit that the command was run in.
 
-Certain flags like [--include-dir](/reference/cli/commands/run#include-dir) can be used to adjust the Run Queue to include additional units. Conversely, there are flags like [--exclude-dir](/reference/cli/commands/run#exclude-dir) that can be used to adjust the Run Queue to exclude units.
+The [`--filter`](/features/filter) flag can be used to adjust the Run Queue, including or excluding units based on filter expressions. For example, `--filter './networking'` includes a specific path, while `--filter '!./legacy'` excludes one.
 
 Terragrunt will always attempt to run until the Run Queue is empty.
 
@@ -213,7 +213,7 @@ By default, Terragrunt will interact with OpenTofu/Terraform in order to retriev
 
 Terragrunt does have the ability to mock outputs, which is useful when dependencies do not yet have outputs to be consumed (e.g. during the run of a unit with a dependency that has not been applied).
 
-Terragrunt also has the ability to fetch outputs without interacting with OpenTofu/Terraform via [--fetch-dependency-output-from-state](/reference/cli/commands/run#fetch-dependency-output-from-state) for dependencies where state is stored in AWS. This is an experimental feature, and more tooling is planned to make this easier to use.
+Terragrunt also has the ability to fetch outputs without interacting with OpenTofu/Terraform via [--dependency-fetch-output-from-state](/reference/cli/commands/run#dependency-fetch-output-from-state) for dependencies where state is stored in AWS. This is an experimental feature, and more tooling is planned to make this easier to use.
 
 ### Feature
 

docs/src/content/docs/02-guides/01-terralith-to-terragrunt/08-step-5-adding-terragrunt.mdx

@@ -39,11 +39,11 @@ Group 1
 ...
 `} />
 
-We can also selectively run the plan for the `dev` environment by changing the working directory to `dev`, or using the [`--queue-include-dir`](https://docs.terragrunt.com/reference/cli-options/#queue-include-dir) flag.
+We can also selectively run the plan for the `dev` environment by changing the working directory to `dev`, or using the [`--filter`](/features/filter) flag.
 
 <Code title="live/dev" lang="bash" frame="terminal" code={`$ terragrunt plan`} />
 
-<Code title="live" lang="bash" frame="terminal" code={`$ terragrunt run --all --queue-include-dir dev plan
+<Code title="live" lang="bash" frame="terminal" code={`$ terragrunt run --all --filter ./dev plan
 15:09:17.090 INFO   The runner at . will be processed in the following order for command plan:
 Group 1
 - Unit ./dev

docs/src/content/docs/03-features/02-stacks/03-explicit.mdx

@@ -474,6 +474,23 @@ Requirements:
 - The `--no-cas` flag must not be set.
 - Sources using `update_source_with_cas` must be relative paths within the same repository.
 
+### Local catalog sources
+
+The consumer stack's `source` can be a local filesystem path in addition to a remote Git URL. Both go through the same CAS-backed rewrite pipeline:
+
+```hcl
+# live/terragrunt.stack.hcl
+stack "service" {
+  source = "../catalog//stacks/service"
+
+  path = "service"
+}
+```
+
+Terragrunt copies the referenced directory into a temporary directory, computes a content-addressed root hash over `(relative path, mode, file-content hash)` triples using SHA-256, and rewrites nested `source` attributes against that copy. The original directory is never modified, so the catalog on disk stays clean even though the rewritten `source` values need somewhere to live.
+
+This is useful when iterating on a catalog before tagging a release: the same `update_source_with_cas = true` attributes in the catalog's `terragrunt.stack.hcl` and `terragrunt.hcl` files apply unchanged, whether consumers pull the catalog over Git or point at a local checkout.
+
 </Since>
 
 ## Known Limitations of Explicit Stacks

docs/src/content/docs/03-features/07-caching/04-cas.mdx

@@ -92,6 +92,8 @@ terraform {
 
 During stack generation, Terragrunt rewrites these relative sources to `cas::` references that point to content stored in the CAS. The repository is cloned once, and subsequent stack generations resolve content from the local store without network access. Generated `.terragrunt-stack` files contain deterministic CAS references instead of version variables, so they do not produce diffs on regeneration.
 
+The catalog source can be either a remote Git URL or a local filesystem path (absolute, or relative to the current working directory). Local sources are copied into a temporary directory before rewriting, so the original catalog directory is never modified. This makes the same catalog layout usable against a published Git ref or a local checkout, which is useful when iterating on a catalog before tagging a release.
+
 For more details on using this with stacks, see [Explicit Stacks: CAS Integration](/features/stacks/explicit#cas-integration).
 
 <Aside type="caution">