How to Build a Terraform Drift Detection and Remediation Pipeline in CI

·1 views

Terraform drift occurs when real cloud infrastructure diverges from the declared configuration, often due to manual console changes, third-party automation, or cloud provider-assigned defaults. Left undetected, drift can cause a scheduled terraform apply to silently revert emergency fixes or generate noisy, untrustworthy plan diffs that engineers begin to ignore. The proposed solution is a scheduled CI job that runs a plan, classifies detected drift, and opens a pull request or issue for human review before taking any action. For low-risk, narrowly scoped cases, the pipeline can also remediate automatically, but only after meeting strict prerequisites such as remote state with locking, pinned CLI versions, and read-only cloud credentials. Key technical requirements include using a supported locking backend like S3 native locking or Terraform Cloud, committing the lock file, and ensuring CI credentials are properly scoped to prevent false positives and state corruption.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Launches SeedSQL to Auto-Generate Relational SQL Test Data with Key Integrity

A developer has built SeedSQL, a free web tool designed to simplify the creation of realistic mock data for complex relational database schemas. The tool addresses common pain points such as foreign key mismatches, format errors, and the time-consuming task of writing manual seed scripts. SeedSQL automatically maps parent-child table dependencies, ensuring referential integrity across linked tables like users, orders, and payments. Users can export generated data as SQL insert scripts or CSV files compatible with PostgreSQL and MySQL. The free tier supports up to 1,000 rows and includes localization features for country-specific data formats.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Can Help Automate Shopify, But Production Failures Are Costly

A developer and e-commerce consultant shares hard-won lessons from deploying AI agents on Shopify, warning that real-world results often fall short of the marketing promise. One client spent $5,000 in LLM credits on a product description agent that repeatedly hallucinated features unrelated to their store. In a separate case, an inventory automation agent misread Shopify's API and accidentally zeroed out stock across entire product categories. Customer service bots built with frameworks like CrewAI have also been observed entering endless clarification loops, burning API costs while failing to resolve basic refund requests. The author concludes that AI works best for repetitive, low-stakes tasks like drafting bulk product descriptions, but requires strict guardrails, human review, and robust error-handling before it can be trusted in production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Common Data Leakage Traps That Make ML Models Look Better Than They Are

Data leakage is one of the most frequent reasons machine learning results appear stronger than they actually are, yet few practitioners check for it systematically. The five main culprits include duplicate or near-duplicate rows shared across training and test sets, temporal look-ahead leakage from random splits on time-series data, and features that inadvertently encode the target variable. A real-world demonstration using the EEG Eye State dataset showed a model's AUC score collapsing from 0.971 to 0.546 simply by switching from a random split to a time-respecting one. To address this, the author developed two open-source Python tools — LeakHound, which detects all five leak types and reports honest versus inflated scores, and safesplit, which prevents leakage by enabling group-aware, time-aware, and sequence-aware data splitting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agent Reports Are Not Proof: The Case for Independent Artifact Verification

A software engineering post argues that session reports generated by AI agents are self-descriptions, not independently verifiable evidence. The author contends that approving a report — even with multiple reviewers — only means one observation has been read multiple times, not independently confirmed. The post cites a real example where a test suite was reported stable and approved twice, yet a fresh rerun against the actual files on disk revealed two failures in sixteen runs. The recommended practice is to check the exact worktree, read the actual diff, run the declared command, and preserve its output for others to inspect. The core principle is that a report serves as a map to the artifact, not a substitute for re-running and directly observing it.

0 comments Read more at DEV Community