Terragrunt "Could not download remote source" in CI

Terragrunt uses go-getter to download the module named in the terraform { source = ... } block into its .terragrunt-cache. The download failed: a wrong ref, a private repo the runner cannot authenticate to, or a transient network error.

What this error means

terragrunt fails with "Error downloading remote source" or "could not download module" pointing at the source URL in your terraform block, before init completes.

terragrunt

ERRO[0002] Error downloading remote source: /home/runner/work/infra/.terragrunt-cache:
error downloading 'git::https://github.com/acme/modules.git?ref=v9.9.9': /usr/bin/git
exited with 128: fatal: couldn't find remote ref v9.9.9

Common causes

The source ref or path does not exist

The ref= tag, branch, or //subdir in the source URL points at something that is not in the module repo.

The runner cannot authenticate to a private module repo

A private git or registry source needs credentials the CI job never provided, so the clone is rejected.

How to fix it

Fix the source ref and subdirectory

Confirm the tag or branch in ref= exists in the module repo.
Confirm any //path subdirectory matches the repo layout.
Re-run so go-getter can resolve the source.

terragrunt.hcl

terraform {
  source = "git::https://github.com/acme/modules.git//vpc?ref=v1.4.0"
}

Provide credentials for a private source

Give the runner a token so git can clone the private module repo.

.github/workflows/ci.yml

- run: |
    git config --global url."https://x-access-token:${{ secrets.GH_PAT }}@github.com/".insteadOf "https://github.com/"
    terragrunt init

How to prevent it

Pin module sources to immutable tags, not moving branches.
Store module-repo credentials in CI secrets and inject them once.
Cache .terragrunt-cache between runs to reduce repeated downloads.