Skip to content
Sarj Sarj Sarj Standards

declarative-deployment-boundary

recognized control-plane commands mutate infrastructure outside Terraform

SARJ309 Rule source Tests Catalog JSON

Why

Imperative control-plane commands and plan-address allowlists split deployment ownership between Terraform and repository-specific orchestration, so drift and safety depend on execution order. Publishing an application artifact is a release operation and remains outside this rule.

Fix

Model the resource, identity, and lifecycle in Terraform; let CI select inputs and apply the saved plan without maintaining a second mutation path.

Examples

Before — flagged A Cloud Run configuration update owns infrastructure
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: gcloud run deploy api --image $IMAGE --memory 1Gi
After — preferred CI publishes a Cloud Run application artifact
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: gcloud run deploy api --image $IMAGE --region us
Before — flagged Keep Cloud Run infrastructure in Terraform
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: gcloud run deploy api --image $IMAGE --memory 1Gi
After — preferred CI applies the reviewed Terraform plan
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: terraform apply saved.tfplan
Before — flagged Keep Worker resource creation in Terraform
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: pnpm exec wrangler d1 create app
After — preferred CI publishes a Worker application artifact
.github/workflows/deploy.yml
jobs:
  deploy:
    steps:
      - run: pnpm exec wrangler deploy --tag $GITHUB_SHA

Files

.github/workflows/*.{yaml,yml}{cloudbuild,deploy,deployments,iac,infra,k8s,scripts,terraform,tools}/**