mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-19 07:27:04 +03:00
00abbf90a4
* feat(skill): add Terraform operational skill Add a single tool skill for Terraform and OpenTofu operations: module structure, state backends and locking, plan/apply workflow, drift detection, remote state, upgrade and refactor flows, and evidence-based diagnostics. Ships the agent-first tfops wrapper (JSON output, direct state-file analysis, --dry-run/--yes/--force mutation gate), a fixture-tested suite, six eval cases, dated references, and routing up to platform-engineering. Closes #243. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * fix(skill): clarify missing-binary report in tfops doctor When the TERRAFORM env override names a binary that cannot be found, doctor now reports the env value with a (not found) marker instead of falling back to the generic default name. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --------- Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
2.8 KiB
2.8 KiB
Plan/apply workflow
plan proposes; apply realizes. The plan output is the contract the apply fulfills — review it as a diff, not a wall of text.
The loop
- Validate before planning:
terraform validate/tofu validatecatches syntax and semantic errors early. - Plan:
terraform plan -json(JSON, machine-reviewable) orterraform plan -out plan.tfplan(binary, reproducible apply input).tfops plan --jsonwraps the native plan or analyzes a state file directly when the backend is unreachable. - Review: classify every change — create, update in place, destroy, replace (destroy + create). Replaces are the highest risk; databases and stateful services deserve lifecycle checks (
prevent_destroy,create_before_destroy, backup/restore proof) before approval. - Apply:
terraform apply plan.tfplan(reviewed input) or-auto-approveonly inside a reviewed CI/CD gate.tfops applyrequires--yesand refuses when the analyzed state has tainted resources unless--forceis given. - Verify: apply exit 0 is evidence about Terraform only — check the external boundary the resource serves (DNS, endpoint, API) and re-plan to confirm no residual drift.
Plan-reading rules
- Count creates/updates/destroys/replaces before reading details; a plan with unexpected destroys is a stop condition.
~in-place update,+create,-destroy,-/+replace. A replace is a delete-then-create pair in the diff.- Sensitive changes show as redacted values — if the diff implies a secret rotation you did not intend, stop and find the cause.
-targetnarrows a run: acceptable for emergencies, never the default workflow (it leaves the rest of the state unverified).- Workspaces:
terraform workspace list/selectbefore planning so the plan is against the right state; plan output should state the workspace.
JSON plan output
terraform plan -json emits NDJSON events (one JSON object per line: version, config, diagnostics, planned changes, resource changes). Useful fields: resource_changes[*].change.actions (the action list) and planned_values. tfops wraps the stream in a single JSON envelope for stable agent consumption.
Sources
Last Updated: 2026-08-03
- Terraform plan command: https://developer.hashicorp.com/terraform/cli/commands/plan (accessed 2026-08-03)
- Terraform apply command: https://developer.hashicorp.com/terraform/cli/commands/apply (accessed 2026-08-03)
- JSON output format: https://developer.hashicorp.com/terraform/internals/json-format (accessed 2026-08-03)
- OpenTofu CLI commands: https://opentofu.org/docs/cli/commands/ (accessed 2026-08-03)
- Lifecycle rules (
create_before_destroy,prevent_destroy): https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle (accessed 2026-08-03)