{
  "slug": "terragrunt-run-can-skip-auth-provider-commands-during-discovery-a6c6c1c4df5e",
  "title": "terragrunt run can skip auth-provider commands during discovery",
  "tools": [
    "terragrunt"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-07-01T08:49:32.000Z",
  "announced_at": "2026-07-01T08:49:32.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When configuration parsing resolves without credentials, run the change-based selection with `--no-discovery-auth-provider-cmd` to skip auth-provider invocations during discovery; auth still runs for executing units. Do not enable it if discovery parsing needs credentials, and `--experiment opt-out-auth` is not required in v1.1.0.",
    "examples": [
      "terragrunt run --all --no-discovery-auth-provider-cmd --queue-include-units-reading=./changed-file.txt -- plan"
    ],
    "gotchas": [
      "Version: v1.1.0",
      "--all (required): Run the command against all discovered units, subject to selection options.",
      "--no-discovery-auth-provider-cmd: Skip `--auth-provider-cmd` invocations during discovery; `TG_NO_DISCOVERY_AUTH_PROVIDER_CMD` is the corresponding environment variable.",
      "--queue-include-units-reading (required): Limit `run --all` to units that read the specified file via an HCL function or include. Takes a string; `TG_QUEUE_INCLUDE_UNITS_READING` is the corresponding environment variable.",
      "-- (required): Separates Terragrunt arguments from the underlying command and its arguments; `plan` is the command passed through here.",
      "Prerequisite: Use the discovery skip only when parsing resolves without credentials; credential-dependent parsing, such as via `get_aws_account_id()`, can fail when enabled.",
      "Use only when parsing resolves without credentials; configuration that depends on values from `--auth-provider-cmd` during discovery will fail to parse when enabled."
    ]
  },
  "why_it_matters": "Run a change-based unit selection when parsing configuration does not need credentials.",
  "before": "Terragrunt invoked `--auth-provider-cmd` once for every discovered unit by default. The flag was previously gated behind the `opt-out-auth` experiment.",
  "sources": [
    "https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.0",
    "https://docs.terragrunt.com/reference/cli/commands/run/"
  ],
  "rank": 0.91032,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-17b01b515b1e067d-4:gate",
    "evidence_hash": "7dd3267c5d1eaec03235b5e3bcbc7134a244015cb580932fb05c5c6ef61add1b"
  },
  "review": {
    "draft_hash": "5a08ab9dd9a06ee8e712c65b69ea572ef37a688ac67e57974179ffd55431bfa4",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.67 (>= 0.6 needed)."
  }
}