Audit a bundle locally

You don’t have to trust the description on this site. The collector is a small Go program. Run it on your own plan and read the output: that output is exactly what the Action uploads.

Run it

1. Plan as usual, in your root module.

   terraform plan -out=tfplan

2. Build the collector from the Action’s source. You need Go 1.23 or newer.

   go install github.com/Tekchbila-Studios/infragram-action/cmd/infragram-collect@v1.0.4

3. Produce the bundle, exactly as the Action does.

   terraform show -json tfplan | infragram-collect -source . -output bundle.json

   -source points at the configuration directory so locals can be resolved to references. Leave it out to see the bundle without them.

4. Scan it with the same tool and version.

   gitleaks stdin --no-banner < bundle.json

Inspect it

A few jq queries answer most review questions:

# What was removed?
jq .sanitization bundle.json

# Which resource types are included, and how many of each?
jq -r '.resources[].type' bundle.json | sort | uniq -c | sort -rn

# Every attribute kept for one resource
jq '.resources[] | select(.address == "aws_db_instance.main") | .values' bundle.json

# All attribute names in the bundle. Grep this for anything you didn't expect.
jq -r '[.. | objects | keys[]] | unique[]' bundle.json

# How resources reference each other
jq -r '.references[] | "\(.source) --\(.via)--> \(.ref)"' bundle.json | head -20

Validate it against the schema

The schema is published at its canonical URL:

curl -sO https://infragr.am/schemas/bundle-v3.schema.json
npx --yes ajv-cli validate --spec=draft2020 -s bundle-v3.schema.json -d bundle.json

See Bundle schema for a field-by-field description.

Run the collector’s own tests

git clone https://github.com/Tekchbila-Studios/infragram-action
cd infragram-action
go test ./...

The tests pin the guarantees described on these pages. For example, TestScanLocalsNeverEmitsValues fails if a literal ever reaches the bundle through a local.