Loading_
Loading_
Scheduled workflow that plans every workspace, classifies drift by blast radius, and opens one consolidated issue instead of a nightly wall of noise.
# .github/workflows/terraform-drift.yml## Nightly drift detection across every workspace under environments/.# Opens or updates ONE issue with the classified findings. name: Terraform drift on: schedule: - cron: '0 3 * * *' workflow_dispatch: permissions: contents: read issues: write id-token: write jobs: discover: runs-on: ubuntu-latest outputs: workspaces: ${{ steps.find.outputs.workspaces }} steps: - uses: actions/checkout@v4 - id: find run: | LIST=$(find environments -name '*.tfvars' -printf '%h\n' | sort -u | jq -R -s -c 'split("\n")[:-1]') echo "workspaces=$LIST" >> "$GITHUB_OUTPUT"132 more lines behind the library licence
terraform-drift.yml · 5.4 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
Everyone runs terraform plan in CI on pull requests. Almost nobody runs it on a schedule against main, which is where drift actually appears — someone fixed something in the console at 2am and never came back to codify it.
This runs the plan for every workspace it discovers, parses the JSON plan rather than scraping text output, and classifies each change: tag-only drift is noise, a security group rule change is not.
Findings are deduplicated against the open issue so a persistent drift updates the existing thread rather than opening a new one every night.
The platform turns any script into a governed automation — versioned, gated, audited and reversible.