Detect Configuration Drift in Deployment Pipelines with Diff Checker

# Staging deployment works fine
# Production deployment behaves differently

# Later investigation reveals:
$ diff staging/k8s/deployment.yaml production/k8s/deployment.yaml
# Output too long to parse manually
# No automated check was in place
# Drift accumulated over 3 months of hotfixes

name: Config Drift Check
on:
  pull_request:
    paths:
      - 'k8s/**'
      - 'terraform/**'

jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Compare staging vs production manifests
        id: diff
        run: |
          DIFF_OUTPUT=$(diff -u k8s/staging/deployment.yaml k8s/production/deployment.yaml || true)

          if [ -z "$DIFF_OUTPUT" ]; then
            echo "status=identical" >> $GITHUB_OUTPUT
            echo "✓ No config drift detected"
          else
            echo "status=drift_detected" >> $GITHUB_OUTPUT
            echo "⚠️ Config differences found:"
            echo "$DIFF_OUTPUT"
            # Store for PR comment
            echo "$DIFF_OUTPUT" > /tmp/drift-report.txt
          fi

      - name: Post drift report as PR comment
        if: steps.diff.outputs.status == 'drift_detected'
        run: |
          gh pr comment ${{ github.event.pull_request.number }} --body "$(cat <<'EOF'
          ## ⚠️ Config Drift Detected

          Staging and production manifests differ:

          '''diff
          $(cat /tmp/drift-report.txt)
          '''

          Please review and align configurations before merging.
          EOF
          )"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Block deployment on critical drift
        if: steps.diff.outputs.status == 'drift_detected'
        run: exit 1