terraform: Add support for GitHub Attestations in TFLint installation

[wata727]

Fixes #1563

[Kaniska244]

Hi @wata727

Thank you for the contribution. Would you kindly bump the feature version and look into the failing test?

[nranderson]

@Kaniska244 Would appreciate if this update could be prioritized. It appears the endpoint cosign was using has been removed and our builds are now failing without this update.

[2026-05-26T13:17:25.942Z] 
20.99 Error: searching log query: Post "https://rekor.sigstore.dev/api/v1/log/en
[2026-05-26T13:17:25.942Z] 
ntries/retrieve": POST https://rekor.sigstore.dev/api/v1/log/entries/retrieve giv
ving up after 4 attempt(s): Post "https://rekor.sigstore.dev/api/v1/log/entries/r
[2026-05-26T13:17:25.942Z] 
retrieve": dial tcp 127.232.108.0:443: connect: connection refused
[2026-05-26T13:17:25.942Z] 
20.99 error during command execution: searching log query: Post "https://rekor.s
[2026-05-26T13:17:25.942Z] 
sigstore.dev/api/v1/log/entries/retrieve": POST https://rekor.sigstore.dev/api/v1
1/log/entries/retrieve giving up after 4 attempt(s): Post "https://rekor.sigstore
[2026-05-26T13:17:25.942Z] 
e.dev/api/v1/log/entries/retrieve": dial tcp 127.232.108.0:443: connect: connecti
[2026-05-26T13:17:25.942Z] 
ion refused
[2026-05-26T13:17:25.942Z] 
21.00 ERROR: Feature "Terraform, tflint, and TFGrunt" (ghcr.io/devcontainers/fea
[2026-05-26T13:17:25.942Z] 

[MVJosh]

Any chance we can prioritise this for merging please? It looks like the requested changes have been addressed.
#773 is an issue again, making this feature uninstallable - it would be good to remove the dependency on cosign.

In the short term, is there any way to install this feature from this branch? vscode just seems to use the default branch with no obvious way to change it

[NathanCYee]

@Kaniska244 please see if you could review the latest changes. As mentioned by @MVJosh and @nranderson cosign is now removed and builds of the feature are starting to fail at the cosign install step. It would be good to remove the dependency on cosign and align with the gh attestation method used with newer tflint releases

[Clockwork-Muse]

Side note: parts of cosign appear to be blocked on some corporate networks, preventing install of terraform/tflint in those networks.

[NathanCYee]

@bamurtaugh could you help find a reviewer for this PR?

[Kaniska244]

@Kaniska244 Would appreciate if this update could be prioritized. It appears the endpoint cosign was using has been removed and our builds are now failing without this update.

[2026-05-26T13:17:25.942Z] 
20.99 Error: searching log query: Post "https://rekor.sigstore.dev/api/v1/log/en
[2026-05-26T13:17:25.942Z] 
ntries/retrieve": POST https://rekor.sigstore.dev/api/v1/log/entries/retrieve giv
ving up after 4 attempt(s): Post "https://rekor.sigstore.dev/api/v1/log/entries/r
[2026-05-26T13:17:25.942Z] 
retrieve": dial tcp 127.232.108.0:443: connect: connection refused
[2026-05-26T13:17:25.942Z] 
20.99 error during command execution: searching log query: Post "https://rekor.s
[2026-05-26T13:17:25.942Z] 
sigstore.dev/api/v1/log/entries/retrieve": POST https://rekor.sigstore.dev/api/v1
1/log/entries/retrieve giving up after 4 attempt(s): Post "https://rekor.sigstore
[2026-05-26T13:17:25.942Z] 
e.dev/api/v1/log/entries/retrieve": dial tcp 127.232.108.0:443: connect: connecti
[2026-05-26T13:17:25.942Z] 
ion refused
[2026-05-26T13:17:25.942Z] 
21.00 ERROR: Feature "Terraform, tflint, and TFGrunt" (ghcr.io/devcontainers/fea
[2026-05-26T13:17:25.942Z] 

Hi @nranderson, Hi @MVJosh, Hi @NathanCYee, Hi @wata727

I am so sorry for the delay. I am checking it right now. Will get back ASAP.

[Kaniska244]

Hi @wata727

Would you kindly resolve the conflict. The rest appear to be fine as explained.

[abdurriq]

Nit: Would be nice to have this shared across the scripts rather than defined in both places, to avoid potential drift.

Conflict resolved