0.17.0 fails to clone remote modules: fatal: empty string is not a valid pathspec

[PavelPikat]

What happened?

After upgrading provider-terrraform from 0.14.1 to 0.17.0 hoping to fix issues with remote repositories and max-reconcile-rate, we experience failures in all our new and existing Workspaces where the provider is unable to download remote module from our private Azure DevOps Git repository.

The error observed is:

connect failed: cannot get remote Terraform module: error downloading 'https://<org>@dev.azure.com/<org>/Platform%20Engineering/_git/InfrastructureModules': /usr/bin/git exited with 128: fatal: empty string is not a valid pathspec. please use . instead if you meant to match all paths

Git credentials are configured via ProviderConfig's credentials, .git-credentials file

How can we reproduce it?

Have a Terraform module in a remote Azure DevOps Git repository.
Sample Composition used to provision Azure Resource Group:

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: resourcegroup-azure-v1
  labels:
    crossplane.io/xrd: xresourcegroups
    provider: azure
spec:
  compositeTypeRef:
    apiVersion: idp/v1
    kind: XResourceGroupV1
  mode: Pipeline
  pipeline:
    - step: render-templates
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            {{- $baseName := index .observed.composite.resource.metadata.labels "crossplane.io/composite" }}
            
            ---
            apiVersion: tf.upbound.io/v1beta1
            kind: Workspace
            metadata:
              name: {{ print $baseName "-azure-rg" }}
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ print $baseName "-azure-rg" }}
                {{ setResourceNameAnnotation (print $baseName "-azure-rg") }}
            spec:
              providerConfigRef:
                name: azure
              forProvider:
                source: Remote
                initArgs:
                  - -backend-config=config.azurerm.tfbackend
                  - -backend-config=key=platform-engineering/uxp-
                module: git::https://<org>@dev.azure.com/<org>/Platform%20Engineering/_git/InfrastructureModules
                entrypoint: azure/v1/rg                
                {{- with .observed.composite.resource.spec.parameters }}
                varmap:
                  name: {{ .name }}
                  location: {{ .location }}
                    
                {{- end }}

    - step: automatically-detect-readiness
      functionRef:
        name: function-auto-ready

What environment did it happen in?

• Crossplane Version: 1.16.0-up.1
• Provider Version: 0.17.0
• Kubernetes Version: 1.29.4
• Kubernetes Distribution: AKS

[PavelPikat]

Rolling back to 0.16.0 fixes all failed Workspaces right away, without any other changes anywhere else

[bobh66]

Thanks @PavelPikat - I suspect that this might be a bug in the new go-getter version we pulled in.

Can you try adding ?ref=<branch-or-tag> to the module specification, where branch-or-tag is the git reference you want to use (default branch) and see if that fixes the problem on 0.17?

[PavelPikat]

@bobh66 Thanks for the suggestion, it does help