fix: Use more robust default branch detection in Git-based expressions

Author: yhakbar

cli/flags/shared/shared.go

@@ -251,15 +251,7 @@ func NewFilterFlags(l log.Logger, opts *options.TerragruntOptions) cli.Flags {
 						l.Warnf("Warning: You have uncommitted changes. The --filter-affected flag may not include all your local modifications.")
 					}
 
-					defaultBranch := "main"
-
-					if b, err := gitRunner.Config(ctx.Context, "init.defaultBranch"); err == nil && b != "" {
-						l.Debugf("Using default branch discovered from git config: %s", b)
-
-						defaultBranch = b
-					} else {
-						l.Warnf("Failed to get default branch from `git config init.defaultBranch`, using main.")
-					}
+					defaultBranch := gitRunner.GetDefaultBranch(ctx.Context, l)
 
 					opts.FilterQueries = append(opts.FilterQueries, fmt.Sprintf("[%s...HEAD]", defaultBranch))
 

internal/git/git.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/go-git/go-git/v6"
 	"github.com/go-git/go-git/v6/storage/filesystem"
+	"github.com/gruntwork-io/terragrunt/pkg/log"
 )
 
 const (
@@ -451,6 +452,154 @@ func (g *GitRunner) Config(ctx context.Context, name string) (string, error) {
 	return strings.TrimSpace(stdout.String()), nil
 }
 
+// GetDefaultBranch implements the hybrid approach to detect the default branch:
+// 1. Tries to determine the default branch of the remote repository using the fast local method first
+// 2. Falls back to the network method if the local method fails
+// 3. Attempts to update local cache for future use
+// Returns the branch name (e.g., "main") or an error if both methods fail.
+func (g *GitRunner) GetDefaultBranch(ctx context.Context, l log.Logger) string {
+	branch, err := g.GetDefaultBranchLocal(ctx)
+	if err == nil && branch != "" {
+		return branch
+	}
+
+	branch, err = g.GetDefaultBranchRemote(ctx)
+	if err == nil && branch != "" {
+		err = g.SetRemoteHeadAuto(ctx)
+		if err != nil {
+			l.Warnf("Failed to update local cache for default branch: %v", err)
+		}
+
+		return branch
+	}
+
+	l.Debugf("Failed to determine default branch of remote repository, attempting to get default branch of local repository")
+
+	if b, err := g.Config(ctx, "init.defaultBranch"); err == nil && b != "" {
+		return b
+	}
+
+	l.Debugf("Failed to determine default branch of local repository, using 'main' as fallback")
+
+	return "main"
+}
+
+// GetDefaultBranchLocal attempts to get the default branch using the local cached remote HEAD.
+// Returns the branch name (e.g., "main") if successful, or an error if the local ref is not set.
+// This is fast and works offline, but requires that `git remote set-head origin --auto` has been run.
+func (g *GitRunner) GetDefaultBranchLocal(ctx context.Context) (string, error) {
+	if err := g.RequiresWorkDir(); err != nil {
+		return "", err
+	}
+
+	cmd := g.prepareCommand(ctx, "rev-parse", "--abbrev-ref", "origin/HEAD")
+
+	var stdout, stderr bytes.Buffer
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return "", &WrappedError{
+			Op:      "git_rev_parse_origin_head",
+			Context: stderr.String(),
+			Err:     ErrCommandSpawn,
+		}
+	}
+
+	result := strings.TrimSpace(stdout.String())
+
+	// If the result is just "origin/HEAD", the local ref is not properly set
+	if result == "origin/HEAD" {
+		return "", &WrappedError{
+			Op:      "git_rev_parse_origin_head",
+			Context: "local origin/HEAD ref not set",
+			Err:     ErrNoMatchingReference,
+		}
+	}
+
+	if after, ok := strings.CutPrefix(result, "origin/"); ok {
+		return after, nil
+	}
+
+	return result, nil
+}
+
+// GetDefaultBranchRemote queries the remote repository to determine the default branch.
+// This is the most accurate method but requires network access.
+// Returns the branch name (e.g., "main") if successful.
+func (g *GitRunner) GetDefaultBranchRemote(ctx context.Context) (string, error) {
+	if err := g.RequiresWorkDir(); err != nil {
+		return "", err
+	}
+
+	cmd := g.prepareCommand(ctx, "ls-remote", "--symref", "origin", "HEAD")
+
+	var stdout, stderr bytes.Buffer
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return "", &WrappedError{
+			Op:      "git_ls_remote_symref",
+			Context: stderr.String(),
+			Err:     ErrCommandSpawn,
+		}
+	}
+
+	// Parse output: "ref: refs/heads/main    HEAD"
+	output := stdout.String()
+	lines := strings.SplitSeq(strings.TrimSpace(output), "\n")
+
+	for line := range lines {
+		if line == "" {
+			continue
+		}
+
+		if strings.HasPrefix(line, "ref:") {
+			parts := strings.Fields(line)
+			if len(parts) >= 2 { //nolint:mnd
+				ref := parts[1]
+
+				if after, ok := strings.CutPrefix(ref, "refs/heads/"); ok {
+					return after, nil
+				}
+			}
+		}
+	}
+
+	return "", &WrappedError{
+		Op:      "git_ls_remote_symref",
+		Context: "could not parse default branch from ls-remote output",
+		Err:     ErrNoMatchingReference,
+	}
+}
+
+// SetRemoteHeadAuto runs `git remote set-head origin --auto` to update the local cached remote HEAD.
+// This makes future calls to GetDefaultBranchLocal faster.
+func (g *GitRunner) SetRemoteHeadAuto(ctx context.Context) error {
+	if err := g.RequiresWorkDir(); err != nil {
+		return err
+	}
+
+	cmd := g.prepareCommand(ctx, "remote", "set-head", "origin", "--auto")
+
+	var stderr bytes.Buffer
+
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return &WrappedError{
+			Op:      "git_remote_set_head",
+			Context: stderr.String(),
+			Err:     ErrCommandSpawn,
+		}
+	}
+
+	return nil
+}
+
 func (g *GitRunner) prepareCommand(ctx context.Context, name string, args ...string) *exec.Cmd {
 	cmd := exec.CommandContext(ctx, g.GitPath, append([]string{name}, args...)...)