From 98cedbaf5e22b7aad94df9c787c3e9eaf009c3d1 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Wed, 8 Jul 2026 10:40:39 -0400 Subject: [PATCH 1/3] fix(terraform_validate): free disk space before per-module init terraform_validate runs `terraform init` in every module directory, each pulling its own copy of the provider plugins (~700 MB for aws alone). Repos with many modules exhaust the runner's ~14 GB disk with "no space left on device". Reclaim ~15-25 GB by removing preinstalled toolchains (android SDK, dotnet, haskell, swift) this job never uses. No behavior change for other jobs or small repos. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/pre-commit.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 32f3a47..45e6dd3 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -120,6 +120,15 @@ jobs: needs: [terraform_fmt, check-yaml, terraform_tflint, terraform_docs] steps: + # terraform_validate runs `terraform init` in every module directory, and each + # one downloads its own copy of the provider plugins (the aws provider alone is + # ~700 MB unpacked). On repos with many modules this exhausts the runner's ~14 GB + # disk ("no space left on device"). Reclaim space by removing preinstalled + # toolchains this job never uses. Purely additive: a no-op for small repos. + - name: Free up disk space + run: | + sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift + df -h / - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 with: go-version: ${{ env.GO_VERSION }} From ee3da80a17cd8b9ef7b53f5939e6a74615b4ceb0 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Wed, 8 Jul 2026 11:11:18 -0400 Subject: [PATCH 2/3] feat(pre-commit): add trivy_scan_ref input to scope terraform_trivy scan Defaults to '.' (unchanged behavior). Callers can pass a narrower path (e.g. 'terraform') to limit the fs scan to IaC and skip app dependency CVE / Dockerfile findings. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/pre-commit.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 45e6dd3..20e5dad 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -2,6 +2,12 @@ name: Pre-Commit on: workflow_call: + inputs: + trivy_scan_ref: + description: "Path Trivy scans in the terraform_trivy job. Narrow to e.g. 'terraform' to skip app dependency/Dockerfile scanning." + type: string + required: false + default: "." env: PY_VERSION: "3.x" @@ -189,6 +195,7 @@ jobs: uses: aquasecurity/trivy-action@master with: scan-type: "fs" + scan-ref: ${{ inputs.trivy_scan_ref }} hide-progress: false exit-code: "1" scanners: "vuln,secret,misconfig" From c6875e5759b55cbdc3e3fc6197adc7a6ad72c969 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Thu, 16 Jul 2026 15:58:18 -0400 Subject: [PATCH 3/3] fix(tflint): verify aws plugin via PGP to dodge tflint init panic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub REST API 2026-03-10 removed the `bundle` field from attestation list responses. tflint's default `auto` signature mode prefers attestations, unmarshals the now-null bundle into a nil *bundle.Bundle without erroring, and panics dereferencing it inside sigstore verify. `tflint --init` crashes before any linting runs, failing the terraform_tflint hook in every consuming repo. Pinning the plugin to `signature = "pgp"` takes the legacy verification path instead. Verification stays enabled; tflint emits a deprecation warning about the legacy signing key. Pinning an older tflint does not help — the trigger is server-side and every version taking the attestation path panics. Upstream: https://github.com/terraform-linters/tflint/issues/2591 Co-Authored-By: Claude Opus 4.8 --- precommit-config/.tflint.hcl | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/precommit-config/.tflint.hcl b/precommit-config/.tflint.hcl index 702eb60..e90cf31 100644 --- a/precommit-config/.tflint.hcl +++ b/precommit-config/.tflint.hcl @@ -1,5 +1,12 @@ +# signature = "pgp" pins plugin verification to the legacy PGP key instead of the default +# "auto", which prefers GitHub attestations. GitHub REST API 2026-03-10 dropped the `bundle` +# field from attestation list responses; tflint unmarshals the resulting null into a nil +# *bundle.Bundle without erroring and then panics dereferencing it during `tflint --init`. +# Upstream: https://github.com/terraform-linters/tflint/issues/2591 +# Drop this line once that lands and the tflint we install carries the fix. plugin "aws" { - enabled = true - version = "0.40.0" - source = "github.com/terraform-linters/tflint-ruleset-aws" -} \ No newline at end of file + enabled = true + version = "0.40.0" + source = "github.com/terraform-linters/tflint-ruleset-aws" + signature = "pgp" +}