Repository navigation
Devsecops security control plane - #5
Merged
Merged
Conversation
Shells out to a real terraform binary for fmt/init/validate/plan only --
apply/destroy stay on SimulatedTerraformTool until Milestone 3. Adds
tools/_subprocess_safety.py for explicit timeouts and secret redaction on
every real subprocess call, since state/auth output can contain secrets.
Plan parsing extracts only {address, action} from terraform show -json,
never raw attribute values, feeding the existing risk classifier
unchanged. Also renders LearningMoment.related_artifact, which had no
real caller before this milestone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
workflows/terraform_flow.py runs fmt -> init -> validate -> plan -> risk analysis, teaching provider/state concepts just-in-time (gated by learner profile, matching local_flow's precedent) and diagnosing an auth failure on plan as an expected, honest outcome rather than a bug. cli/main.py wires RealTerraformTool in only for this command, keeping every other command's terraform tool simulated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
projects/api_platform/infra/terraform/: resource group, container registry, Log Analytics workspace, tagged for easy identification and cleanup. Split into providers/variables/main/outputs.tf as a readability convention (Terraform still merges the whole directory). Fixes an ACR naming bug (hyphens aren't valid in that resource's name, unlike most others) caught by live terraform validate during review. .gitignore now excludes .terraform/ and *.tfstate* while keeping .terraform.lock.hcl committed. ProjectAnalyzer correctly now detects this real IaC. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
fmt -check, init -backend=false, and validate against projects/api_platform/infra/terraform/ -- no Azure credentials needed, no plan/apply in CI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs/terraform-state.md is the reference the in-flow teaching moments link back to: desired vs. actual vs. Terraform state, provider, resource address, dependencies, drift, local vs. remote state and locking, state sensitivity, why deleting state isn't deleting infrastructure, why hand-editing state is dangerous. Updates README/roadmap/safety/ development docs to describe exactly what's real this milestone (fmt/ init/validate/plan, no apply, no real Azure execution) and documents the RUN_AZURE_INTEGRATION_TESTS convention Milestone 3 will need. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
CLAUDE.md: durable rules on product direction, the Tool/ToolService gateway, real-vs-simulated labeling, and quality gates. .claude/agents/: terraform-reviewer, security-reviewer, learning-reviewer -- read-only review personas used during this milestone's own development. .claude/hooks/confirm_destructive_command.py: a PreToolUse Bash hook that forces explicit confirmation before terraform apply/destroy, az group/ resource delete, git push --force, and similar commands run directly via Bash, as a backstop for when a command bypasses ToolService entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.