I Added Terraform Drift Detection to Every GitHub Repo in One Line

Description and use

Terraform drift detection in GitHub repos now needs only one workflow line, eliminating 15‑minute setup and providing native alerts and PR gating.

Problem

Setting up drift detection in CI required repetitive boilerplate: installing Python, tfdrift, configuring secrets, handling SARIF upload, and managing exit codes.

Outcome

Drift detection now requires only one line in the workflow, reducing setup time from 15 minutes to a single action call, enabling native GitHub security alerts, PR gating, and streamlined notifications.

Workflow

• Use the tfdrift GitHub Action with sarif-output to replace multiple setup and scan steps.
• Configure action inputs such as path, min-severity, fail-on, sarif-output, json-output, slack-webhook, and environment secrets for AWS credentials.
• Run the action in scheduled or PR workflows to generate drift reports and upload SARIF to Code Scanning.
• Use action outputs drift-count and has-drift to conditionally trigger notifications or fail the job based on severity.

Evidence

Setting up drift detection in CI always took the same 15 minutes of boilerplate. Install Python. Install tfdrift. Wire up secrets. Figure out how to upload SARIF. Handle exit codes so the job doesn't fail before the artifact uploads.

Source

I got tired of it, so I published tfdrift as a GitHub Actions Marketplace action. Now it's one uses line.

Source

The action runs tfdrift scan under the hood. Because it runs inside GitHub Actions, the existing --gha path fires automatically: every drifted resource becomes an inline PR annotation and the job summary gets a drift table.

Source

v0.5.4 adds --sarif-output as a secondary output flag. One scan run, two files: tfdrift scan --format json --output drift-report.json --sarif-output results/tfdrift.sarif

Source