auto-web

/auto-web

Determine whether what is actually running matches what is in this repository — and remediate the gaps in the correct order, with the read-only work done first.

Two governing rules.

1. Observe before you touch. Every phase below is read-only until an explicit approval gate. The dangerous failure here is not missing drift; it is "fixing" drift by overwriting live state that was the correct side.
2. Never print a secret. Enumerate names, never values. The commands below are chosen for that property, and the ones that violate it are called out.

Step 1 — Discover The Infrastructure

Find every deploy target the repo describes:

rg --files --hidden --no-ignore \
  -g '{Dockerfile*,docker-compose*,*.tf,*.tfvars,Pulumi.*,*.bicep,template.y*ml,serverless.y*ml}' \
  -g '{vercel.json,netlify.toml,fly.toml,render.yaml,railway.*,app.yaml,Procfile,heroku.yml,wrangler.*}' \
  -g '{*.k8s.y*ml,kustomization.y*ml,Chart.y*ml,ansible.cfg,inventory*,Caddyfile,nginx.conf}' \
  -g '!.git' -g '!node_modules' -g '!.terraform' -g '!vendor'

Put the exclusions after the inclusions and use the bare-directory form (-g '!.git', not -g '!.git/**') — the glob order matters and the trailing-slash form leaks paths back in.

Also read: CI deploy jobs and their environment declarations, .env.example, SSH config and deploy scripts, DNS-as-code, and reverse-proxy config. Then ask the user which environments exist and which you may touch.

Stack is server-side state, not repo state. On Heroku, heroku.yml overrides the Procfile's process definitions only when the app's stack is container — confirm with heroku stack -a <app> rather than inferring from which files exist.

Step 2 — Credentials, Safely

Detect the secret manager in use, then fetch without echoing: op read, vault kv get -field=…, sops -d, aws secretsmanager get-secret-value --query SecretString --output text, doppler secrets get --plain.

Name-only enumeration is what an audit needs: