tfclassify

Overview ¶

tfclassify reads a Terraform plan and says which of its changes billet has to be drained for.

terraform -chdir=terraform/modules/billet plan -out=tfplan
terraform -chdir=terraform/modules/billet show -json tfplan > plan.json
go run ./scripts/tfclassify -plan plan.json

It exits 2 when the plan holds a draining or destructive change and -acknowledge was not given, so it can gate an apply. Exit 1 is tfclassify itself failing — a plan it cannot parse, a resource nobody classified — and the two are separated because a pipeline treats them differently: one is a finding, the other is a broken gate.