chore(ci): pin tflint to v0.63.1 and hold upgrades for 60 days - #64
Merged
Conversation
The setup-tflint action was SHA-pinned but installed `latest`, so any upstream tflint release reached this repo with no change here. On 2026-07-17 that turned every PR red: tflint >=0.61 nil-derefs verifying its ruleset plugin after GitHub removed the `bundle` field from attestation API responses (terraform-linters/tflint#2591). Pin v0.63.1 -- the version CI has proven green with the signature workaround in .tflint.hcl. Renovate could not see this pin: the org preset's custom managers cover .nix, Ansible role defaults, and biome.jsonc, and the built-in github-actions manager only tracks `uses:`, not action inputs. Add a repo-local custom manager for annotated pins in workflows so the version stays tracked instead of rotting. Hold tflint upgrades 60 days with automerge disabled. terraform-linters is a trusted org in the shared preset, so a minor/patch would otherwise auto-merge after 3 days -- the exact path by which this regression would return unattended. The hold gives #2593 time to ship and bake. Also run the Terraform job when this workflow changes, so a tool-pin change is validated by the job it configures rather than merging as SKIPPED.
There was a problem hiding this comment.
Pull request overview
Pins the TFLint version used by the CI Gate workflow and teaches Renovate to track that pin (and delay/avoid auto-merging future TFLint upgrades) to prevent upstream TFLint releases from breaking org-wide CI without any repo change.
Changes:
- Pin
terraform-linters/setup-tflint’s installed TFLint version tov0.63.1in.github/workflows/ci-gate.yml(with a Renovate annotation). - Add a Renovate
customManagersregex manager to detect# renovate:-annotated workflow input pins. - Add a Renovate
packageRulesentry to holdterraform-linters/tflintupdates for 60 days and disable automerge.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| renovate.json | Adds a regex-based custom manager for annotated workflow pins and a package rule to delay/stop automerging TFLint updates. |
| .github/workflows/ci-gate.yml | Pins tflint_version to v0.63.1 and updates the path filter so CI exercises workflow/tooling changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "Renovate-annotated version pins in this repo's workflow files. The org preset's custom managers cover .nix, Ansible role defaults, and biome.jsonc -- nothing scans .github/workflows for annotated tool pins, and the built-in github-actions manager only tracks `uses:`, not action inputs. Without this, `tflint_version:` in ci-gate.yml is invisible to Renovate and the pin rots silently. Only lines carrying an explicit `# renovate:` annotation are matched, so `uses:` lines are untouched." | ||
| ], | ||
| "customType": "regex", | ||
| "managerFilePatterns": ["/^\\.github/workflows/.+\\.ya?ml$/"], |
JacobPEvans-personal
added a commit
that referenced
this pull request
Jul 17, 2026
…#67) The Copilot review ruleset from #60 was scoped via the gitflow custom property -- all 9 gitflow-tagged repos, and it grows automatically as more repos opt into gitflow. That ruleset was never applied (tofu apply was left as an operator step and never run), but the org has already exhausted its Copilot review capacity from unrelated usage. With 0 assigned Copilot seats, every review bills AI credits directly with no pooled allowance -- property-based scoping is the wrong shape for a budget that's already tight. Replace it with an explicit (branch, repo-list) target model, mirroring merge-gate.tf's existing for_each-over-buckets pattern rather than inventing a new one. Starting scope: just ansible-proxmox-apps on develop, in the new config/copilot-review.yml. Growing the pilot is a one-line YAML edit, never a broader property match. Since nothing was ever applied, this is a clean replacement: no import, no moved block, no state migration. The enforcement variable is renamed org_gitflow_copilot_review_enforcement -> org_copilot_review_enforcement since it's no longer gitflow-tied (safe -- variables aren't in state). Verified: tofu fmt/validate pass; tflint passes against v0.63.1 (the version CI resolves, via the signature = "pgp" pin from #61/#64).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the hole that caused yesterday's org-wide CI outage.
setup-tflintwasSHA-pinned, but the tool it installs was not (
tflint_version: latest), soany upstream tflint release landed here with zero changes to this repo. On
2026-07-17 that turned every PR red — tflint >= 0.61 nil-derefs verifying its
ruleset plugin after GitHub removed the
bundlefield from attestation APIresponses (tflint#2591).
Pins
v0.63.1— the version this repo's CI has already proven green with thesignature = "pgp"workaround from #61.Renovate could not see this pin
Worth calling out, because it shapes the fix: the org preset's custom managers
cover
.nix, Ansible role defaults, andbiome.jsonc— nothing scans.github/workflows. The built-ingithub-actionsmanager only tracksuses:,not action inputs. So a bare pin would have been invisible to Renovate and
rotted indefinitely.
This adds a repo-local custom manager for
# renovate:-annotated pins inworkflow files, matching the annotation style the org preset already uses for
.nixand Ansible. Only annotated lines match, souses:lines are untouched.Why the 60-day hold
terraform-linters/**is a trusted org in the shared preset, and thepublisher-agnostic rule auto-merges any minor/patch after 3 days. That is
precisely the path by which this regression would return unattended. So:
minimumReleaseAge60 daysautomergefalseVerification
renovate-config-validator→ Config validated successfullydatasource=github-releases,depName=terraform-linters/tflint,currentValue=v0.63.1— and asserted it captures nouses:lines. A configthat validates but matches nothing would silently do nothing, which is the
failure mode worth ruling out.
.github/workflows/ci-gate.ymladded to the terraform path filter so thisPR's own Terraform job runs and exercises the pin. Without it, a broken tool
pin merges green as
SKIPPEDand only fails later on someone else's.tfPR— the same false-green that let the original breakage through.
Cost impact
Free. CI config only. No GitHub feature enabled, no per-seat cost. This repo
is public, so Actions minutes are exempt.
Unwind path
Documented in both files. Once #2593 ships and is adopted here, drop the
packageRulesentry and thesignature = "pgp"line in.tflint.hcl. Theversion pin itself stays — pinning the tool is correct regardless of this
incident.