bug: empty paths handling in dependencies (#5016)

* Added test for handling empty config path

* chore: simplified dependency output fetching

* chore: empty path handling in dependency

Author: denis256

config/dependency.go

@@ -208,6 +208,18 @@ func decodeAndRetrieveOutputs(ctx *ParsingContext, l log.Logger, file *hclparse.
 	// In normal operation, if a dependency block does not have a `config_path` attribute, decoding returns an error since this attribute is required, but the `hclvalidate` command suppresses decoding errors and this causes a cycle between modules, so we need to filter out dependencies without a defined `config_path`.
 	decodedDependency.Dependencies = decodedDependency.Dependencies.FilteredWithoutConfigPath()
 
+	// Validate that dependency config_path is not an empty string.
+	// Skip null/unknown values and non-strings (which can appear during partial decode or hclvalidate).
+	for _, dep := range decodedDependency.Dependencies {
+		if dep.isDisabled() {
+			continue
+		}
+
+		if isEmptyKnownString(dep.ConfigPath) {
+			return nil, fmt.Errorf("dependency %q has empty config_path in %s; set a non-empty config_path or disable the dependency", dep.Name, file.ConfigPath)
+		}
+	}
+
 	if err := checkForDependencyBlockCycles(ctx, l, file.ConfigPath, decodedDependency); err != nil {
 		return nil, err
 	}
@@ -1202,3 +1214,8 @@ func (deps Dependencies) FilteredWithoutConfigPath() Dependencies {
 
 	return filteredDeps
 }
+
+// isEmptyKnownString returns true when v is a fully-known string whose trimmed value is empty.
+func isEmptyKnownString(v cty.Value) bool {
+	return v.Type().Equals(cty.String) && v.IsWhollyKnown() && strings.TrimSpace(v.AsString()) == ""
+}

test/fixtures/regressions/dependency-empty-config-path/_source/units/consumer/main.tf

@@ -0,0 +1,3 @@
+terraform {}
+
+

test/fixtures/regressions/dependency-empty-config-path/_source/units/consumer/terragrunt.hcl

@@ -0,0 +1,22 @@
+terraform {
+  source = "."
+}
+
+dependency "ecr_cache" {
+  config_path = try(values.dependency_path.ecr-cache, "")
+  # force enabled so error manifests even when empty
+  enabled     = true
+
+  mock_outputs = {
+    token = "mock-token"
+  }
+
+  mock_outputs_merge_strategy_with_state  = "shallow"
+  mock_outputs_allowed_terraform_commands = ["init", "validate", "destroy", "plan"]
+}
+
+inputs = {
+  token = dependency.ecr_cache.outputs.token
+}
+
+

test/fixtures/regressions/dependency-empty-config-path/live/terragrunt.stack.hcl

@@ -0,0 +1,10 @@
+
+unit "consumer" {
+  path   = "consumer"
+  source = "${get_repo_root()}/_source/units/consumer"
+
+  values = {
+  }
+}
+
+

test/integration_regressions_test.go

@@ -13,8 +13,9 @@ import (
 )
 
 const (
-	testFixtureRegressions        = "fixtures/regressions"
-	testFixtureDependencyGenerate = "fixtures/regressions/dependency-generate"
+	testFixtureRegressions               = "fixtures/regressions"
+	testFixtureDependencyGenerate        = "fixtures/regressions/dependency-generate"
+	testFixtureDependencyEmptyConfigPath = "fixtures/regressions/dependency-empty-config-path"
 )
 
 func TestNoAutoInit(t *testing.T) {
@@ -193,3 +194,21 @@ func TestDependencyOutputInInputsStillWorks(t *testing.T) {
 		strings.Contains(runAllStderr, "test-token-12345"),
 		"Token should be passed via inputs")
 }
+
+func TestDependencyEmptyConfigPath_ReportsError(t *testing.T) {
+	t.Parallel()
+
+	helpers.CleanupTerraformFolder(t, testFixtureDependencyEmptyConfigPath)
+	tmpEnvPath := helpers.CopyEnvironment(t, testFixtureDependencyEmptyConfigPath)
+	gitPath := util.JoinPath(tmpEnvPath, testFixtureDependencyEmptyConfigPath)
+	helpers.CreateGitRepo(t, gitPath)
+
+	// Run directly against the consumer unit to force evaluation of dependency outputs
+	consumerPath := util.JoinPath(gitPath, "_source", "units", "consumer")
+	_, stderr, runErr := helpers.RunTerragruntCommandWithOutput(t, "terragrunt plan --non-interactive --working-dir "+consumerPath)
+	require.Error(t, runErr)
+	// Accept match in either stderr or the returned error string
+	if !strings.Contains(stderr, "has empty config_path") && !strings.Contains(runErr.Error(), "has empty config_path") {
+		t.Fatalf("unexpected error; want empty config_path message, got: %v\nstderr: %s", runErr, stderr)
+	}
+}