terrashark

# Terrashark: Failure-Mode Workflow for Terraform/OpenTofu Run this workflow top to bottom. ## 1) Capture execution context Record before writing code: - runtime (`terraform` or `tofu`) and exact version - provider(s), target platform, and state backend - execution path (local CLI, CI, HCP Terraform/TFE, Atlantis) - environment criticality (dev/shared/prod) If unknown, state assumptions explicitly. ## 2) Diagnose likely failure mode(s) Select one or more based on user intent and risk: - identity churn: resource addressing instability, refactor breakage - secret exposure: secrets in state, logs, defaults, artifacts - blast radius: oversized stacks, weak boundaries, unsafe applies - CI drift: version mismatch, unreviewed applies, missing artifacts - compliance gate gaps: missing policies/approvals/audit controls ## 3) Load only the relevant reference file(s) Primary references: - `references/identity-churn.md` - `references/secret-exposure.md` - `references/blast-radius.md` - `references/ci-drift.md` - `references/compliance-gates.md` Supplemental references (only when needed): - `references/testing-matrix.md` - `references/quick-ops.md` - `references/examples-good.md` - `references/examples-bad.md` - `references/examples-neutral.md` - `references/coding-standards.md` - `references/module-architecture.md` - `references/ci-delivery-patterns.md` - `references/security-and-governance.md` - `references/do-dont-patterns.md` - `references/mcp-integration.md` Conditional ref...