diggerhq/digger
Digger
Digger 是一个 GitOps 基础设施自动化系统和 Terraform 编排器。它支持直接从版本控制拉取请求（Pull Request）和 CI 流水线执行基础设施计划并应用。
该项目提供了一个用于基于策略的治理和状态管理的框架。它对基础设施变更强制执行基于角色的访问控制和自定义安全策略，同时集中存储带有版本历史和访问控制的状态文件。
该系统通过拉取请求评论触发器和远程执行来管理基础设施工作流。它包括用于识别实际云状态与期望云状态之间差异的漂移检测功能、用于防止竞争条件的并发执行锁定，以及用于确保批准的版本应用于生产的计划持久化功能。
Features
- Pull Request Comment Triggers - Enables the execution of infrastructure plans and applies directly via specific pull request comments.
- Orchestrators - Orchestrates Terraform plans and applies directly from version control pull requests and CI pipelines.
- Orchestration State Management - Provides centralized management of infrastructure state to coordinate cloud operations and maintain a single source of truth.
- State Management - Provides centralized storage for infrastructure state files with integrated access controls and version history.
- GitOps Automation - Triggers infrastructure updates and state changes directly based on activity within version control pull requests.
- GitOps Workflows - Synchronizes infrastructure state with version control using automated deployment pipelines triggered by pull requests.
- Infrastructure as Code Deployments - Manages the deployment and execution of infrastructure code through automated pipelines and remote environments.
- Infrastructure Automation Workflows - Automates the modification and deployment of infrastructure resources through integrated workflows.
- Infrastructure Governance Policies - Enforces automated rules and role-based access controls on infrastructure changes to ensure security and compliance.
- Infrastructure State Managers - Maintains infrastructure state files centrally with access controls and version history to ensure consistency.
- Infrastructure Policy Enforcers - Enforces security standards and custom compliance policies on infrastructure-as-code definitions before deployment.
- Policy-Based Access Control - Enforces security permissions and custom rules on infrastructure changes through a policy-driven authorization system.
- Drift Detection - Identifies discrepancies between the actual cloud resource states and the desired states defined in infrastructure-as-code configuration.
- Infrastructure Resource Locks - Implements locking mechanisms to prevent concurrent modifications to the same infrastructure project or workspace.
- PR Action Workflows - Provides interfaces for triggering common infrastructure actions such as plans and applies from a pull request view.
- Remote Workspace Command Execution - Provides the capability to execute shell commands and manage files on remote hosts via connected workspace instances.
- Drift Detection - Automates the identification of discrepancies between defined infrastructure code and the actual cloud environment state.
- Remote Worker Command Executors - Executes infrastructure shell commands on remote cloud worker instances and streams real-time logs back to the user.
- Race Condition Prevention - Prevents data races and concurrent modifications by using locks on pull requests during infrastructure updates.
- Plan Approval Workflows - Saves proposed infrastructure changes for human approval before execution to ensure safe production deployments.
- Plan Persistence - Caches execution plans in cloud storage to ensure the approved version is exactly what is applied to production.
