fix(terraform-static-analysis): workaround TFLint issue #2591 attestation panic

[Aaron Robinson (ASTRobinson)]

Summary

This PR applies a temporary workaround for terraform-linters/tflint#2591, where tflint --init panics in the attestation verification path due to GitHub's API now returning bundle: null and only a bundle_url in attestation list responses.

Changes

Attestation panic workaround (#2591)

• Run TFLint commands with GITHUB_TOKEN unset in the action runtime to avoid the crashing attestation path. GITHUB_TOKEN is still available later for PR comments.
• Set signature = "pgp" in bundled TFLint plugin configs so verification uses the PGP path instead of the broken attestation path.
• Fail fast with a clear error message if tflint --init exits non-zero.

Plugin version bumps

Plugin	Old	New
tflint-ruleset-aws	0.33.0	0.48.0
tflint-ruleset-azurerm	0.27.0	0.32.0
tflint-ruleset-terraform	0.9.1	0.15.0

Configs updated: tflint.aws.hcl, tflint.azure.hcl, tflint.default.hcl

Docs

• terraform-static-analysis/README.md — noted the temporary signature = "pgp" workaround and linked to the upstream fix PR.

Validation

• bash -n terraform-static-analysis/entrypoint.sh — no syntax errors.
• Editor diagnostics on all touched files — no errors.

Follow-up

Remove the signature = "pgp" lines and the env -u GITHUB_TOKEN wrapper once the upstream fix ships:

• plugin: fetch attestation bundles from bundle_url terraform-linters/tflint#2593

[mikereiddigital]

lg2m

[mikereiddigital]

lg2m