fix(pre-commit): unbreak tflint, free disk in terraform_validate, scope trivy

[camrschuette]

Three fixes to the shared pre-commit.yml. The tflint one is an active outage — every repo consuming this workflow is currently failing terraform_tflint. The other two have been running in stratusphere via a branch pin since 2026-07-08; this merge retires that pin.

1. fix(tflint) — unbreak terraform_tflint everywhere (urgent)

Not a lint failure: tflint --init panics installing the aws plugin, before any linting runs.

Installing "aws" plugin...
Panic: runtime error: invalid memory address or nil pointer dereference
 -> 4: github.com/sigstore/sigstore-go/pkg/bundle.(*Bundle).TlogEntries: /bundle.go(300)
 -> 8: github.com/terraform-linters/tflint/plugin.(*SignatureChecker).VerifyAttestations: /signature.go(136)
 -> 9: github.com/terraform-linters/tflint/plugin.(*InstallConfig).Install: /install.go(134)

Server-side cause, nothing in our repos changed. GitHub REST API 2026-03-10 removed the bundle field from attestation list responses. tflint calls that endpoint to verify the plugin, and:

1. GitHub now returns "bundle": null
2. tflint unmarshals null into a **Bundle — sets the pointer nil and returns no error, so its own nil guard at plugin/signature.go:133 never fires
3. verifier.Verify(b, policy) calls a method on the nil receiver; sigstore-go`s nil check dereferences it. Panic.

A latent tflint bug that only fires once the server returns null. Upstream terraform-linters/tflint#2591 — filed 2026-07-16, still open, master unpatched.

signature = "pgp" takes the legacy PGP verification path instead of the default auto (which prefers attestations). Verification stays enabled. tflint emits a deprecation warning about the legacy key; the hook passes. v0.40.0 ships checksums.txt.sig, so the PGP path is valid for the pinned version.

Alternatives ruled out:

• Pinning older tflint — trigger is server-side; every version taking the attestation path panics. Confirmed on v0.62.1 and v0.63.1.
• Bumping sigstore-go — v1.2.2 has the identical nil-receiver line. Must be fixed tflint-side.
• signature = "none" — works but disables verification. Avoided; PGP works.

Verified by reproducing the exact CI panic locally, then confirming the fix against a clean plugin dir on tflint v0.63.1 with an authenticated GITHUB_TOKEN:

Installing "aws" plugin...
The plugin was signed using a legacy PGP signing key. Please update the plugin to the latest version
Installed "aws" (source: github.com/terraform-linters/tflint-ruleset-aws, version: 0.40.0)
+ ruleset.aws (0.40.0)

Confirmed green in stratusphere CI: Terraform validate with tflint...Passed.

2. fix(terraform_validate) — free disk before per-module init

terraform_validate runs terraform init in every module directory, each downloading its own provider copies (aws provider alone is ~700 MB unpacked). Repos with many modules exhaust the runners ~14 GB disk with no space left on device`. Removes preinstalled toolchains the job never uses (android, dotnet, ghc, swift). Purely additive — a no-op for small repos.

3. feat(pre-commit) — trivy_scan_ref input

Adds an optional input to scope the terraform_trivy fs scan. Defaults to ".", so existing callers are unaffected. Callers can pass a narrower path (e.g. terraform) to limit the scan to IaC and skip app dependency CVE / Dockerfile findings handled elsewhere.

Notes for reviewers

• The Checkout precommit config step has no ref:, so config is always read from this repos default branch — pinning the reusable workflow to a feature branch does not change which config CI uses. That is why the tflint fix has to land on main` to take effect anywhere.
• Supersedes fix(tflint): verify aws plugin via PGP to dodge tflint init panic #106, which carried the tflint fix alone; closed in favor of this.
• Once merged, stratusphere drops its branch pin (@fix/tf-validate-free-disk → @main) and deletes its stopgap local .tflint.hcl.
• Worth a follow-up: every --only rule in the tflint hook is a bundled terraform_* rule — no aws-ruleset rule is enabled. The aws plugin install is dead weight and the sole reason this failure mode can hit us. Dropping it would remove the class entirely.

🤖 Generated with Claude Code