From 249a794b7f6a8214af87d3ad28d199f6549efd8a Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Thu, 16 Jul 2026 15:58:18 -0400 Subject: [PATCH] fix(tflint): verify aws plugin via PGP to dodge tflint init panic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub REST API 2026-03-10 removed the `bundle` field from attestation list responses. tflint's default `auto` signature mode prefers attestations, unmarshals the now-null bundle into a nil *bundle.Bundle without erroring, and panics dereferencing it inside sigstore verify. `tflint --init` crashes before any linting runs, failing the terraform_tflint hook in every consuming repo. Pinning the plugin to `signature = "pgp"` takes the legacy verification path instead. Verification stays enabled; tflint emits a deprecation warning about the legacy signing key. Pinning an older tflint does not help — the trigger is server-side and every version taking the attestation path panics. Upstream: https://github.com/terraform-linters/tflint/issues/2591 Co-Authored-By: Claude Opus 4.8 --- precommit-config/.tflint.hcl | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/precommit-config/.tflint.hcl b/precommit-config/.tflint.hcl index 702eb60..e90cf31 100644 --- a/precommit-config/.tflint.hcl +++ b/precommit-config/.tflint.hcl @@ -1,5 +1,12 @@ +# signature = "pgp" pins plugin verification to the legacy PGP key instead of the default +# "auto", which prefers GitHub attestations. GitHub REST API 2026-03-10 dropped the `bundle` +# field from attestation list responses; tflint unmarshals the resulting null into a nil +# *bundle.Bundle without erroring and then panics dereferencing it during `tflint --init`. +# Upstream: https://github.com/terraform-linters/tflint/issues/2591 +# Drop this line once that lands and the tflint we install carries the fix. plugin "aws" { - enabled = true - version = "0.40.0" - source = "github.com/terraform-linters/tflint-ruleset-aws" -} \ No newline at end of file + enabled = true + version = "0.40.0" + source = "github.com/terraform-linters/tflint-ruleset-aws" + signature = "pgp" +}