reachdiff

项目介绍

reachdiff is a small open-source CLI for a question that terraform plan never answers directly: who gains or loses access to what when this plan is applied? It reads terraform show -json output for Databricks Unity Catalog grants, expands group memberships, and reports the effective-access diff — for example, 'gp-interns gains READ on main.hr (all tables) via SELECT on main.hr + USE_CATALOG on main + USE_SCHEMA on main.hr' — with the route behind each change and an exit code a pipeline can act on (0 pass, 1 WARN, 2 BLOCK, 3 invalid input or operational failure). It also flags what the plan hides: a grant_resource_conflict when two resources manage grants on the same securable (in the author's test, this silently removed every grant on a table), latent grants that a new USE_SCHEMA privilege can switch on, and sensitive data (schemas tagged pii/sensitive) gaining new readers. Its design rule is that anything it cannot see becomes a finding rather than a silent pass: without READ METADATA it discards untrustworthy grant lists, and without workspace-admin rights it reports 'members not read' instead of pretending a group is empty. There is a GitHub Action and an Azure DevOps template that post one pull-request comment, updated in place, with token federation so no Databricks secret is stored in CI. Status and scope, as the author states: version 0.9.0, beta; live mode was exercised against one Azure Databricks workspace (Premium, classic compute), while AWS, GCP, serverless workspaces and multiple workspaces are not yet covered, and ABAC policies, row filters, column masks and runtime behaviour are not evaluated. An offline mode with a synthetic example plan needs no dependencies and no workspace.