Weekly Cloudflare DNS drift report in Slack

Build me an agent workflow that runs every Monday at 8am in my timezone (cron trigger) and reconciles our production Cloudflare DNS against an approved list we maintain in Google Sheets, then posts a drift report to Slack.

On each run, the agent should: (1) call Cloudflare's List Zones to enumerate every zone the API token can see, and for each zone call Cloudflare's List DNS Records to pull the current production DNS state (handle pagination so we get every record, not just the first page); (2) in parallel, call Google Sheets' Get Values on the tab named "Approved DNS records" in the spreadsheet I'll provide, which has the header row: zone, name, type, content, proxied, owner, ticket.

Then diff the two sets, matching on (zone, name, type). Reason about each delta and group findings into four buckets: UNAUTHORIZED (present in Cloudflare, missing from the sheet), MISSING (in the sheet but not in Cloudflare), CONTENT DRIFT (matching record exists in both but the content value differs, for example an A record's IP changed or a CNAME target changed), and PROXY DRIFT (the proxied flag in Cloudflare does not match what the sheet says). For any delta that matches a row in the sheet, attach the owner and ticket columns to the finding.

Write a concise drift report grouped by severity in this order: UNAUTHORIZED first, then CONTENT DRIFT, then PROXY DRIFT, then MISSING. Each item should be one short line: zone, record name, type, what changed, and the owner if known. If there is no drift, say so explicitly with a short "all clear" line so the team can see the check actually ran.

Post the report to the #platform-ops Slack channel using Slack's Send a Message operation. Then call Google Sheets' Append Values on a tab named "Drift history" in the same spreadsheet to append one row per finding with columns: timestamp (UTC, ISO 8601), severity, zone, record name, type, change description, owner, ticket. This is the audit trail, so always append even when there is no drift (append a single "all clear" marker row in that case).

Make the spreadsheet ID, the approved-records tab name, the drift-history tab name, and the Slack channel configurable at the top of the instructions so I can swap them without editing the agent body. The agent should fail loudly (post an error to the Slack channel) if the spreadsheet or either tab is unreachable, rather than silently skipping the run.