Catch destructive Terraform applies before approval

Every 30 minutes during business hours on weekdays, act as a pre-apply safety guardrail for our HCP Terraform (Terraform Cloud) infrastructure. This runs on a schedule (not on the new-run event) on purpose: a run's plan JSON is not ready to read the moment a run is queued, so scanning on a cadence for runs that are already in the planned state guarantees the plan is finished and readable before anyone approves the apply.

For each workspace we manage, use HCP Terraform's List Workspace Runs with status filtering to find runs that are planned and awaiting confirmation, meaning they have finished planning and are now waiting for a human to approve or discard the apply. Ignore runs in any other state.

For every such pending run, pull the Get Plan JSON Output and scan the plan's resource_changes. Look at each change's actions array: a change is destructive when it contains a delete, or a replace (a create and delete pair, shown as ["create", "delete"] or ["delete", "create"]). Changes that only create (add) or update (change in place) resources are safe. Use Show Run if you need the run's details or a link to it.

When a pending run will destroy or recreate one or more resources, post a prominent warning to our infrastructure Slack channel using the Slack Bot Send a Message action. Send one clear message per risky run that names the workspace, lists exactly which resource addresses are set to be destroyed and which are set to be replaced, and includes a link to the run so a reviewer can inspect it before approving. Make the destructive resources impossible to skim past.

Flag anything touching databases, storage buckets, or other stateful resources as HIGH RISK at the top of the message, since destroying or replacing those can mean permanent data loss. Treat resource types such as managed database instances and clusters (for example RDS, Cloud SQL, Aurora), object storage buckets (for example S3, GCS, Azure Blob), persistent volumes and disks, and stateful data stores as high risk.

Stay completely silent when a pending plan only adds or updates resources: send no message at all, so the channel stays high signal and people trust every alert. This is a pre-apply safety review guardrail, separate from any daily run digest, so the only thing that ever reaches Slack is a genuinely risky pending apply.