I Added Terraform Drift Detection to Every GitHub Repo in One Line

说明与用途

在 GitHub 仓库中检测 Terraform 偏移现在只需一行 workflow，消除了 15 分钟的设置，并提供原生警报和 PR 阻止。

问题

Setting up drift detection in CI required repetitive boilerplate: installing Python, tfdrift, configuring secrets, handling SARIF upload, and managing exit codes.

结果

Drift detection now requires only one line in the workflow, reducing setup time from 15 minutes to a single action call, enabling native GitHub security alerts, PR gating, and streamlined notifications.

工作流

• Use the tfdrift GitHub Action with sarif-output to replace multiple setup and scan steps.
• Configure action inputs such as path, min-severity, fail-on, sarif-output, json-output, slack-webhook, and environment secrets for AWS credentials.
• Run the action in scheduled or PR workflows to generate drift reports and upload SARIF to Code Scanning.
• Use action outputs drift-count and has-drift to conditionally trigger notifications or fail the job based on severity.

证据

Setting up drift detection in CI always took the same 15 minutes of boilerplate. Install Python. Install tfdrift. Wire up secrets. Figure out how to upload SARIF. Handle exit codes so the job doesn't fail before the artifact uploads.

来源

I got tired of it, so I published tfdrift as a GitHub Actions Marketplace action. Now it's one uses line.

来源

The action runs tfdrift scan under the hood. Because it runs inside GitHub Actions, the existing --gha path fires automatically: every drifted resource becomes an inline PR annotation and the job summary gets a drift table.

来源

v0.5.4 adds --sarif-output as a secondary output flag. One scan run, two files: tfdrift scan --format json --output drift-report.json --sarif-output results/tfdrift.sarif

来源