From 98cedbaf5e22b7aad94df9c787c3e9eaf009c3d1 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Wed, 8 Jul 2026 10:40:39 -0400 Subject: [PATCH 1/4] fix(terraform_validate): free disk space before per-module init terraform_validate runs `terraform init` in every module directory, each pulling its own copy of the provider plugins (~700 MB for aws alone). Repos with many modules exhaust the runner's ~14 GB disk with "no space left on device". Reclaim ~15-25 GB by removing preinstalled toolchains (android SDK, dotnet, haskell, swift) this job never uses. No behavior change for other jobs or small repos. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/pre-commit.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 32f3a47..45e6dd3 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -120,6 +120,15 @@ jobs: needs: [terraform_fmt, check-yaml, terraform_tflint, terraform_docs] steps: + # terraform_validate runs `terraform init` in every module directory, and each + # one downloads its own copy of the provider plugins (the aws provider alone is + # ~700 MB unpacked). On repos with many modules this exhausts the runner's ~14 GB + # disk ("no space left on device"). Reclaim space by removing preinstalled + # toolchains this job never uses. Purely additive: a no-op for small repos. + - name: Free up disk space + run: | + sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift + df -h / - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 with: go-version: ${{ env.GO_VERSION }} From ee3da80a17cd8b9ef7b53f5939e6a74615b4ceb0 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Wed, 8 Jul 2026 11:11:18 -0400 Subject: [PATCH 2/4] feat(pre-commit): add trivy_scan_ref input to scope terraform_trivy scan Defaults to '.' (unchanged behavior). Callers can pass a narrower path (e.g. 'terraform') to limit the fs scan to IaC and skip app dependency CVE / Dockerfile findings. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/pre-commit.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 45e6dd3..20e5dad 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -2,6 +2,12 @@ name: Pre-Commit on: workflow_call: + inputs: + trivy_scan_ref: + description: "Path Trivy scans in the terraform_trivy job. Narrow to e.g. 'terraform' to skip app dependency/Dockerfile scanning." + type: string + required: false + default: "." env: PY_VERSION: "3.x" @@ -189,6 +195,7 @@ jobs: uses: aquasecurity/trivy-action@master with: scan-type: "fs" + scan-ref: ${{ inputs.trivy_scan_ref }} hide-progress: false exit-code: "1" scanners: "vuln,secret,misconfig" From c6875e5759b55cbdc3e3fc6197adc7a6ad72c969 Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Thu, 16 Jul 2026 15:58:18 -0400 Subject: [PATCH 3/4] fix(tflint): verify aws plugin via PGP to dodge tflint init panic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub REST API 2026-03-10 removed the `bundle` field from attestation list responses. tflint's default `auto` signature mode prefers attestations, unmarshals the now-null bundle into a nil *bundle.Bundle without erroring, and panics dereferencing it inside sigstore verify. `tflint --init` crashes before any linting runs, failing the terraform_tflint hook in every consuming repo. Pinning the plugin to `signature = "pgp"` takes the legacy verification path instead. Verification stays enabled; tflint emits a deprecation warning about the legacy signing key. Pinning an older tflint does not help — the trigger is server-side and every version taking the attestation path panics. Upstream: https://github.com/terraform-linters/tflint/issues/2591 Co-Authored-By: Claude Opus 4.8 --- precommit-config/.tflint.hcl | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/precommit-config/.tflint.hcl b/precommit-config/.tflint.hcl index 702eb60..e90cf31 100644 --- a/precommit-config/.tflint.hcl +++ b/precommit-config/.tflint.hcl @@ -1,5 +1,12 @@ +# signature = "pgp" pins plugin verification to the legacy PGP key instead of the default +# "auto", which prefers GitHub attestations. GitHub REST API 2026-03-10 dropped the `bundle` +# field from attestation list responses; tflint unmarshals the resulting null into a nil +# *bundle.Bundle without erroring and then panics dereferencing it during `tflint --init`. +# Upstream: https://github.com/terraform-linters/tflint/issues/2591 +# Drop this line once that lands and the tflint we install carries the fix. plugin "aws" { - enabled = true - version = "0.40.0" - source = "github.com/terraform-linters/tflint-ruleset-aws" -} \ No newline at end of file + enabled = true + version = "0.40.0" + source = "github.com/terraform-linters/tflint-ruleset-aws" + signature = "pgp" +} From 9a893b0549544f48b2cb1b675685cb53e433e13c Mon Sep 17 00:00:00 2001 From: Cameron Schuette Date: Mon, 20 Jul 2026 10:51:44 -0400 Subject: [PATCH 4/4] fix(gitleaks): pin Go to 1.23.x to dodge go-re2 wasm panic setup-go resolved "^1.23.0" to Go 1.26.x, where the go-re2 v1.8.0 wazero runtime vendored by gitleaks v8.23.1 panics with "wasm error: invalid table access" while compiling config regexes. The hook dies at config load with exit code 2, before scanning any file. Only surfaced once the pre-commit cache went cold and the environment was rebuilt against the newer toolchain. No gitleaks release fixes this upstream -- v8.30.1 still vendors go-re2 v1.9.0 -- so pin the toolchain instead. Applies to every job in this workflow, not just gitleaks. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/pre-commit.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 20e5dad..bdaf458 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -11,7 +11,10 @@ on: env: PY_VERSION: "3.x" - GO_VERSION: "^1.23.0" + # Pinned to 1.23.x, not "^1.23.0": on newer Go the runner resolves to 1.26.x, + # where gitleaks' vendored go-re2 wazero runtime panics with + # "wasm error: invalid table access" while compiling its config regexes. + GO_VERSION: "~1.23.0" jobs: terraform_fmt: