Find Terraform roots your delivery pipeline does not visibly cover.
A monorepo adds infra/data, but the pull request workflow only watches infra/network/**. The workflow is valid YAML. The new root can still miss the visible planning path.
Release review is pending. There is no supported public install command. Commands below describe the local candidate and require its reviewed build; they are not package availability claims.
One small fixture, with evidence limits in the report.
The candidate includes examples/monorepo with two Terraform roots and a literal GitHub path filter. Its report identifies the omitted root with CI-PATH-001 and records execution_verified: false. This is configuration evidence, not proof that a workflow ran.
edgecheck check examples/monorepo --json edgecheck.json --markdown edgecheck.md --sarif edgecheck.sarif --fail-on medium --allow-partial --quiet
# Selected fields from the sanitised candidate demo CI-PATH-001 infra/data Root omitted from the visible PR path filter execution_verified: false # No Git index in this example: partial coverage; --allow-partial is advisory.
What this candidate can assess.
Repository files, explicit or discovered Terraform/OpenTofu roots, visible CI commands and working directories, bounded literal path-filter checks, state and lockfile hygiene. The candidate retains infraedge-toolkit check as a compatibility alias and the .infraedge.yml intent contract.
What it cannot determine
Source inspection cannot prove successful runs, enforced approvals, branch protection or protected environments. Reusable workflows, matrices, wrappers and expressions remain unknown where static resolution is not sound. Missing Git evidence and skipped traversal must remain visible. Use Checkov, actionlint and zizmor alongside this narrower check.
Reference pipeline step
# Reference CLI step after installing a reviewed candidate wheel.
# Run from the checkout; use the normal strict coverage default for CI.
permissions:
contents: read
steps:
- name: Review root coverage
run: edgecheck check . --json "$RUNNER_TEMP/edgecheck.json" --markdown "$RUNNER_TEMP/edgecheck.md" --sarif "$RUNNER_TEMP/edgecheck.sarif" --fail-on medium --quiet
Privacy, source and version.
The local check reads repository content and Git metadata. It does not execute workflows or repository scripts and needs no AWS credentials. Keep reports private because paths and findings describe your repository. Hosted GitHub, GitLab and Azure consumer runs still require validation.
Source extraction is pending; no public standalone source link is available yet. Extraction candidate: 0.2.0a1; no public package or standalone repository is announced.
EdgeResolve can help wire reviewed changes into your delivery pipeline.
Want to review this with an engineer?
A short triage call can establish whether this check would help your team. The release candidate still needs its remaining consumer and release reviews.