Repository navigation
Home
tf-snag reads the plan Terraform already produced and tells you which resources changed outside Terraform: the storage account someone loosened in the portal, the tag a script stripped, the NSG rule added by hand. It also reports the deprecation warnings buried in the plan log.
It is a single CLI that runs anywhere. In Azure DevOps it goes further, with optional pipeline tasks, a run tab, Boards work items, a wiki exceptions register and Teams alerts.
- Getting Started: install, first run, and a minimal pipeline
- CLI Reference: every flag, exit codes and environment variables
- Drift and Deprecations: what counts as drift, and how deprecations are found
- Retirements: which resources sit on a published Azure retirement notice, and how long you have left
- Output Formats: text, JSON, markdown, SARIF, JUnit and Teams
- Baselines and Provenance: tracking findings across runs: new, updated, absent and first seen
- Ignoring Findings: ignore files and inline comments
- Azure DevOps Pipelines: the extension's tasks and run tab, or the CLI on its own
- Work Items: one Azure Boards work item per finding, kept up to date
- Exceptions Register: every ignore rule, published to an Azure DevOps wiki
- Microsoft Teams: an Adaptive Card when something new appears
- Releasing: how the CLI and the extension are released
- Source and issues