StackGuardian / StackGuardian/tirith
feat(cli): plan identity — a canonical hash in the verdict, and `tirith verify --expect <hash>`
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
Nothing connects the plan that was evaluated to the plan that is applied. Emit a canonical hash of
the evaluated document alongside the verdict; tirith verify --expect <hash> runs before
terraform apply and fails if the plan about to be applied is not the one that passed. Reframes
the tool from linting to provenance.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the tirith verify entry point and how the evaluated Terraform document is connected to the verdict. Define the canonical hash output and the --expect <hash> check before terraform apply; done means a changed plan is rejected while the matching evaluated plan passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, terraform
- Domain
- cli, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100