tflint is out of date

Description

The tf-tflint job defaults to using ghcr.io/terraform-linters/tflint-bundle as its image. The source repository was archived in February 2024 and its README was updated with the following text:

DEPRECATED: This project is deprecated. We strongly recommend migrating to plugin management with .tflint.hcl and Renovate.

The bundled version of tflint in this image is still v0.48.0. v0.50.0 introduced a newer setting for dealing with modules, call_module_type/--call-module-type, and the older module setting was officially deprecated in v0.51.0.

Since the tflint maintainers elected not to update tflint-bundle after they introduced those changes, users are forced to choose between:

  • remaining on the tflint-bundle image and staying on the older module config, or
  • overriding the image so they can use the newer config

Implementation ideas

Option 1 is to switch the default image to ghcr.io/terraform-linters/tflint (the non-bundled image) which is still maintained. This may be a breaking change for the following reasons:

  • users would probably need to add a .tflint.hcl to their repos, which is not currently required when using the bundled image
  • users would probably need to explicitly declare plugin source/version attributes in their .tflint.hcl, which is not currently required when using the bundled image
  • CI runners with limited/no Internet access may not be able to install tflint plugins at runtime, meaning users in these environments would need to roll their own image with tflint and required plugins pre-installed.

Option 2 is to roll a new bundled image. It would be less user-impacting, but the downside is the burden of maintaining your own docker images.

Option 3 would be to move to someone else's bundled image but that is problematic in that, if you even found one, would it be trustworthy?