{
  "slug": "terragrunt-oci-experiment-downloads-modules-from-oci-registries-cbbfa977386f",
  "title": "terragrunt oci experiment downloads modules from OCI registries",
  "tools": [
    "terragrunt"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-07-29T18:24:33.000Z",
  "announced_at": "2026-07-29T18:24:33.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When using Terragrunt v1.1.2 to fetch an OpenTofu module from an OCI registry, enable the `oci` experiment and set `terraform.source` to an `oci://` URL. Pin it with `tag` or `digest`; omitting both selects `latest`.",
    "examples": [
      "terraform {\n  source = \"oci://<registry>/<repository>/<module>?tag=<tag>\"\n}",
      "terragrunt --experiment oci run -- init"
    ],
    "gotchas": [
      "Version: v1.1.2",
      "Availability: experiment",
      "`--experiment oci` (required): Enables the OCI experiment; v1.1.2 leaves `oci://` sources unsupported when it is disabled.",
      "`terraform.source` (required): Accepts an `oci://` source URL.",
      "`tag`: Pins the artifact to a tag. Use `tag` or `digest`; the release note does not say they may be combined.",
      "`digest`: Pins the artifact to a digest. Use `tag` or `digest`; the release note does not say they may be combined.",
      "`//subdir` selector: Selects a subdirectory within the artifact.",
      "`TG_TMP_OCI_*`: Interim environment-variable family for static OCI credentials; the release note does not document individual variable names or values.",
      "`TG_TMP_OCI_REGISTRY`: Limits static credentials to one registry; without it, configured credentials may be offered to any registry contacted by the process.",
      "Prerequisite: Use Terragrunt v1.1.2 or later for the described change; enable the `oci` experiment for the source to work.",
      "Prerequisite: For authentication, v1.1.2 supports static credentials through interim environment variables and read-only discovery of Docker and containers auth files. Credential helpers are not invoked; a registry needing per-run token minting requires an externally obtained login in an ambient file.",
      "When the experiment is disabled, `oci://` sources remain unsupported.",
      "Static credentials can be limited to one registry with `TG_TMP_OCI_REGISTRY`; without it, configured credentials may be offered to any registry the process contacts.",
      "Credential helpers are not invoked yet; registries that need per-run token minting only work while an externally obtained login is present in an ambient file.",
      "Artifacts follow the publishing contract OpenTofu 1.10 consumes natively.",
      "Docs conflict: Current active-experiment docs describe later behavior: OCI sources work by default, and configured credential helpers may be invoked. Those statements differ from v1.1.2; the release-specific behavior above follows the v1.1.2 release note."
    ]
  },
  "why_it_matters": "When configuring an OpenTofu module from an OCI registry, set its OCI source in the Terragrunt configuration and fetch it with the `oci` experiment enabled.",
  "sources": [
    "https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.2",
    "https://docs.terragrunt.com/reference/experiments/active/"
  ],
  "rank": 0.95033,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-f2f17bdc0bf69da0-6:gate",
    "evidence_hash": "c9d4f6a61049c3f7a59fd7b3e1f047acdbf4908e23199e46600202a3377a1ad0"
  },
  "review": {
    "draft_hash": "d57670af521d2af30ba1a3beb3ac81cb28cc14d1ffa16315a995c203480c7cad",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.69 (>= 0.6 needed)."
  }
}