chore: Adding defensive tests

Author: yhakbar

internal/getter/filecopy_test.go

@@ -0,0 +1,81 @@
+package getter_test
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	tggetter "github.com/gruntwork-io/terragrunt/internal/getter"
+	"github.com/gruntwork-io/terragrunt/internal/vfs"
+	getter "github.com/hashicorp/go-getter/v2"
+)
+
+// TestFileCopyGetterHandlesSpacesInLocalPaths pins that a local source whose
+// path contains spaces still resolves. The URL reaching the getter carries
+// that path percent-encoded (`file:///projects/my%20local%20module`), so
+// recovering the filesystem path from it is the getter's job, and it has to
+// arrive at the same answer go-getter's own FileGetter would.
+func TestFileCopyGetterHandlesSpacesInLocalPaths(t *testing.T) {
+	t.Parallel()
+
+	base := t.TempDir()
+	srcDir := filepath.Join(base, "my local module")
+
+	require.NoError(t, os.MkdirAll(srcDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(srcDir, "main.tf"), []byte("# hi\n"), 0o644))
+
+	client := &getter.Client{
+		Getters: []getter.Getter{tggetter.NewFileCopyGetter(vfs.NewOSFS())},
+	}
+
+	testCases := []struct {
+		name string
+		src  string
+		dst  string
+		want string
+		mode getter.Mode
+	}{
+		{
+			name: "single file",
+			src:  "file://" + filepath.Join(srcDir, "main.tf"),
+			dst:  filepath.Join(base, "out-file", "main.tf"),
+			mode: getter.ModeFile,
+			want: filepath.Join(base, "out-file", "main.tf"),
+		},
+		{
+			name: "directory",
+			src:  "file://" + srcDir,
+			dst:  filepath.Join(base, "out-dir"),
+			mode: getter.ModeDir,
+			want: filepath.Join(base, "out-dir", "main.tf"),
+		},
+		{
+			name: "mode decided by the getter",
+			src:  "file://" + srcDir,
+			dst:  filepath.Join(base, "out-any"),
+			mode: getter.ModeAny,
+			want: filepath.Join(base, "out-any", "main.tf"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := client.Get(context.Background(), &getter.Request{
+				Src:     tc.src,
+				Dst:     tc.dst,
+				GetMode: tc.mode,
+			})
+			require.NoError(t, err)
+
+			contents, err := os.ReadFile(tc.want)
+			require.NoError(t, err)
+			assert.Equal(t, "# hi\n", string(contents))
+		})
+	}
+}

internal/runner/run/download_source.go

@@ -31,6 +31,12 @@ import (
 // that bypasses the venv filesystem. See [requireOSFilesystemForSource].
 var ErrNonOSFilesystem = errors.New("download requires an OS-backed filesystem")
 
+// ErrNilSource is the panic value [requireOSFilesystemForSource] raises when
+// handed a nil source. Sources are built by [tf.NewSource], whose error every
+// caller checks first, so a nil arriving here is a programming mistake rather
+// than a condition to recover from.
+var ErrNilSource = errors.New("terraform source is required but nil")
+
 // ModuleManifestName is the manifest for files copied from terragrunt module folder (i.e., the folder that contains the current terragrunt.hcl).
 const (
 	ModuleManifestName = ".terragrunt-module-manifest"
@@ -165,7 +171,14 @@ func DownloadTerraformSource(
 // the filesystem they are handed; every other protocol either shells out
 // (git, hg, smb) or writes through os, so on a virtual filesystem it would
 // silently touch the real disk.
+//
+// It panics with [ErrNilSource] on a nil source, so the contract fails where
+// it is broken rather than at whichever field is read first.
 func requireOSFilesystemForSource(fsys vfs.FS, src *tf.Source) error {
+	if src == nil {
+		panic(ErrNilSource)
+	}
+
 	if vfs.IsOSFS(fsys) {
 		return nil
 	}

internal/runner/run/download_source_test.go

@@ -1558,6 +1558,28 @@ func TestDownloadTerraformSourceRejectsNonOSFilesystemPerSource(t *testing.T) {
 	}
 }
 
+// TestDownloadTerraformSourceIfNecessaryPanicsOnNilSource pins the contract on
+// the exported helper. Every source is built by tf.NewSource, whose error the
+// caller checks, so a nil one is a mistake in the calling code.
+func TestDownloadTerraformSourceIfNecessaryPanicsOnNilSource(t *testing.T) {
+	t.Parallel()
+
+	opts, err := options.NewTerragruntOptionsForTest("./test")
+	require.NoError(t, err)
+
+	require.PanicsWithValue(t, run.ErrNilSource, func() {
+		run.DownloadTerraformSourceIfNecessary(
+			t.Context(),
+			logger.CreateLogger(),
+			venv.OSVenv(),
+			nil,
+			configbridge.NewRunOptions(opts),
+			&runcfg.RunConfig{Terraform: runcfg.TerraformConfig{}},
+			report.NewReport(),
+		)
+	})
+}
+
 // TestDownloadTerraformSourceIfNecessaryRejectsNonOSFilesystem pins the gate
 // on the exported helper so external callers cannot bypass it.
 func TestDownloadTerraformSourceIfNecessaryRejectsNonOSFilesystem(t *testing.T) {