authentication signature from unknown issuer

[msanavia]

Hi all!

I'm running terragrunt in GH Actions pipeline and I get the following error in my plan job:

- Installing integrations/github v6.2.1...
- Installed integrations/github v6.2.1 (signed by a HashiCorp partner, key ID 38027F80D7FD5FB2)
- Installing registry.opentofu.org/integrations/github v6.2.1...
Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html
time=2024-05-13T13:59:36Z level=error msg=Module /github/workspace/inputs/github has finished with an error: 1 error occurred:
	* [/github/workspace/inputs/github/.terragrunt-cache/HdSrXICwqjb-UoLx4q3qFgKBLs8/PcN6UfUFoDykGtMq_G0avBITDno] exit status 1
 prefix=[/github/workspace/inputs/github] 
time=2024-05-13T13:59:36Z level=info msg=╷
│ Error: Failed to install provider
│ 
│ Error while installing registry.opentofu.org/integrations/github v6.2.1:
│ authentication signature from unknown issuer
╵

time=2024-05-13T13:59:36Z level=error msg=terraform invocation failed in /github/workspace/inputs/github/.terragrunt-cache/HdSrXICwqjb-UoLx4q3qFgKBLs8/PcN6UfUFoDykGtMq_G0avBITDno prefix=[/github/workspace/inputs/github] 
time=2024-05-13T13:59:36Z level=error msg=1 error occurred:
	* [/github/workspace/inputs/github/.terragrunt-cache/HdSrXICwqjb-UoLx4q3qFgKBLs8/PcN6UfUFoDykGtMq_G0avBITDno] exit status 1

My workflow is:

name: 'Terragrunt CI'
on:
  push:
    branches:
    - main
  pull_request:

env:
  tf_version: '1.5.7'
  tg_version: '0.58.3'
  working_dir: 'inputs'

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@main

      - name: Check terragrunt HCL
        uses: gruntwork-io/terragrunt-action@v2
        with:
          tf_version: ${{ env.tf_version }}
          tg_version: ${{ env.tg_version }}
          tg_dir: ${{ env.working_dir }}
          tg_command: 'hclfmt --terragrunt-check --terragrunt-diff'

  plan:
    runs-on: ubuntu-latest
    needs: [ checks ]
    steps:
      - name: 'Checkout'
        uses: actions/checkout@main

      - name: Plan
        uses: gruntwork-io/terragrunt-action@v2
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
        with:
          tf_version: ${{ env.tf_version }}
          tg_version: ${{ env.tg_version }}
          tg_dir: ${{ env.working_dir }}
          tg_command: 'run-all plan'

  deploy:
    runs-on: ubuntu-latest
    needs: [ plan ]
    environment: 'prod'
    if: github.ref == 'refs/heads/main'
    steps:
      - name: 'Checkout'
        uses: actions/checkout@main

      - name: Deploy
        uses: gruntwork-io/terragrunt-action@v2
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
        with:
          tf_version: ${{ env.tf_version }}
          tg_version: ${{ env.tg_version }}
          tg_dir: ${{ env.working_dir }}
          tg_command: 'run-all apply'

And this is my folder structure:

├── inputs
│   ├── github
│   │   ├── providers.yaml
│   │   └── terragrunt.hcl
│   ├── terragrunt.hcl
│   └── versions.tf
└── modules
    └── github
        ├── data.tf
        ├── locals.tf
        ├── main.tf
        ├── outputs.tf
        ├── provider.tf
        └── variables.tf

Could you you please help me resolving this issue?
Many thanks in advance

[denis256]

Hi,
looking at log line Installing registry.opentofu.org/integrations/github v6.2.1 I suspect it is because it was pulled provider from the OpenTofu registry
It will be helpful to provide an example code where this issue happens
Is it happening in the local environment too? or only in GH Action?

[msanavia]

Hi @denis256,

thanks for looking into this!

This is the repo where you can find the folders and files i listed above.

It works fine when i run it on my local machine with same versions (macOS though).

I found this "bug" where they are saying OpeTofu's registry integration is missing the GCP key and it would be the right resolution explained by Terraform. And at this point i'm even more confused on why it work locally on my machine.

Thanks again!

[denis256]

It seems to be working in my tests

https://github.com/denis256/iac

[msanavia]

Hi @denis256,

thanks again for dedicating time to this.

Sooo, I've initialised a new repo and re-uploaded my code.
Plan in GH Actions checked out at first occurrence, but started failing (with same error) after I imported existing repos and ran a plan via CLI locally.

Deleted the remote state files and Plan in GH Actions checked out again. Started importing (no local plan) -> pipeline fails

Deleted the remote state files and Plan in GH Actions checked out again. Ran a local plan (no importing) -> pipeline succeeds

Am I missing something (extremely dumb, I reckon) in my environments' configuration?

[denis256]

AFAIK, Terraform records the version of the module used at the time of the apply operation in the state file - I suspect during importing something is going wrong