fix(ci): pin tflint plugin verification to pgp to unblock linting - #61
Merged
Conversation
GitHub removed the `bundle` field from attestation API responses, so tflint >=0.61 nil-derefs during `tflint --init` while verifying the ruleset plugin. The crash happens during plugin download, before any linting runs, so every PR touching .tf is blocked at the Merge Gate. Pin `signature = "pgp"`, which still verifies the plugin cryptographically via the legacy signing key rather than skipping verification. Marked TEMPORARY with the upstream issue to revert once terraform-linters/tflint#2593 ships. Verified against tflint v0.63.1 (the version CI resolves): init succeeds and lint exits 0.
The terraform path filter covered **.tf and the lock file but not the linter's own config, so a change to .tflint.hcl skipped the Terraform job entirely -- meaning a tflint config change could never be validated by the job that runs tflint. Without this, the signature fix in the previous commit merges with the Terraform job SKIPPED and no proof it works.
There was a problem hiding this comment.
Pull request overview
This PR unblocks the CI merge gate for Terraform changes by configuring the tflint-ruleset-terraform plugin to use PGP signature verification instead of the default auto mode, avoiding a known upstream crash triggered by GitHub’s attestation API breaking change.
Changes:
- Pin the
terraformplugin verification mode tosignature = "pgp"to avoid theauto-mode attestation verification panic. - Add a dated, explicit revert note documenting when/why this should be removed once the upstream fix is released.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Jul 17, 2026
JacobPEvans-personal
added a commit
that referenced
this pull request
Jul 17, 2026
…#67) The Copilot review ruleset from #60 was scoped via the gitflow custom property -- all 9 gitflow-tagged repos, and it grows automatically as more repos opt into gitflow. That ruleset was never applied (tofu apply was left as an operator step and never run), but the org has already exhausted its Copilot review capacity from unrelated usage. With 0 assigned Copilot seats, every review bills AI credits directly with no pooled allowance -- property-based scoping is the wrong shape for a budget that's already tight. Replace it with an explicit (branch, repo-list) target model, mirroring merge-gate.tf's existing for_each-over-buckets pattern rather than inventing a new one. Starting scope: just ansible-proxmox-apps on develop, in the new config/copilot-review.yml. Growing the pilot is a one-line YAML edit, never a broader property match. Since nothing was ever applied, this is a clean replacement: no import, no moved block, no state migration. The enforcement variable is renamed org_gitflow_copilot_review_enforcement -> org_copilot_review_enforcement since it's no longer gitflow-tied (safe -- variables aren't in state). Verified: tofu fmt/validate pass; tflint passes against v0.63.1 (the version CI resolves, via the signature = "pgp" pin from #61/#64).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every PR touching
.tfis currently blocked at the Merge Gate. The cause isoutside this repo: GitHub removed the
bundlefield from attestation APIresponses (documented breaking change),
so tflint >= 0.61 hits a nil pointer dereference in
sigstore-gowhileverifying the ruleset plugin's attestation during
tflint --init.The crash happens while downloading the plugin — before tflint reads a single
line of Terraform. Upstream issue: terraform-linters/tflint#2591.
This sets
signature = "pgp"on the plugin block, which still verifies theplugin cryptographically via the legacy signing key. It is deliberately not
signature = "none", which would skip verification entirely and emit"disabling verification can pose security risks".
Why this is temporary
The real fix is terraform-linters/tflint#2593
("fetch attestation bundles from bundle_url"), currently open and
unreleased. The config carries a dated comment to revert to the default
automode once that ships.Verification
Reproduced and verified against tflint v0.63.1 — the version CI resolves
via
tflint_version: latest:auto)Panic: runtime error: invalid memory address or nil pointer dereferencesignature = "pgp"Installed+ lint exits 0This PR's own CI Gate run is the real test: if the Terraform job goes green,
the fix works.
Cost impact
Free. Config-only change to a linter already running in CI. No GitHub
feature enabled, no per-seat cost, no change to Actions minutes (this repo is
public, so Actions are exempt).
Follow-up (not in this PR)
ci-gate.ymlpins the action by SHA but passestflint_version: latest, soan upstream release can turn every PR red with no change to this repo. Worth
pinning to a known-good >= 0.61 separately.