I Added Terraform Drift Detection to Every GitHub Repo in One Line

Описание и применение

Автоматизация обнаружения отклонений Terraform в GitHub репозиториях теперь требует только одну строку в workflow, устраняя 15‑минутный набор инструментов и обеспечивая встроенные уведомления и блокировку PR.

Задача

Setting up drift detection in CI required repetitive boilerplate: installing Python, tfdrift, configuring secrets, handling SARIF upload, and managing exit codes.

Результат

Drift detection now requires only one line in the workflow, reducing setup time from 15 minutes to a single action call, enabling native GitHub security alerts, PR gating, and streamlined notifications.

Рабочий процесс

• Use the tfdrift GitHub Action with sarif-output to replace multiple setup and scan steps.
• Configure action inputs such as path, min-severity, fail-on, sarif-output, json-output, slack-webhook, and environment secrets for AWS credentials.
• Run the action in scheduled or PR workflows to generate drift reports and upload SARIF to Code Scanning.
• Use action outputs drift-count and has-drift to conditionally trigger notifications or fail the job based on severity.

Доказательства

Setting up drift detection in CI always took the same 15 minutes of boilerplate. Install Python. Install tfdrift. Wire up secrets. Figure out how to upload SARIF. Handle exit codes so the job doesn't fail before the artifact uploads.

Источник

I got tired of it, so I published tfdrift as a GitHub Actions Marketplace action. Now it's one uses line.

Источник

The action runs tfdrift scan under the hood. Because it runs inside GitHub Actions, the existing --gha path fires automatically: every drifted resource becomes an inline PR annotation and the job summary gets a drift table.

Источник

v0.5.4 adds --sarif-output as a secondary output flag. One scan run, two files: tfdrift scan --format json --output drift-report.json --sarif-output results/tfdrift.sarif

Источник