### Install Open Policy Agent (OPA)

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Installs the Open Policy Agent (OPA) CLI. Use this for policy-as-code enforcement on Terraform plans.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Opa

          new Opa().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.39.0")
          "Opa Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          opa version;
          terraform show -json terraformLibrary.tfPlan > tfplan.json;
          opa exec --decision terraform/analysis/authz --bundle ./policy tfplan.json;
```

--------------------------------

### Configure OPA in Terrakube Workflow

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Opa/README.md

Defines a custom script step to download a specific version of OPA and verify the installation via bash.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Opa

          new Opa().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.39.0")
          "Opa Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          opa version;
```

--------------------------------

### Reuse Terrakube Extension for Terratag

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

This example shows how to simplify the flow by reusing an existing Terrakube extension for Terratag. It downloads the tool using the extension and then executes it.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      before: true
      script: |
        import TerraTag
        new TerraTag().loadTool(
          "$workingDirectory",
          "$bashToolsDirectory",
          "0.1.30")
        "Terratag download completed"
    - runtime: "BASH"
      priority: 200
      before: true
      script: |
        cd $workingDirectory
        terratag -tags="{\"environment_id\": \"development\"}"
- type: "terraformApply"
  step: 300
```

--------------------------------

### TerraTag Extension Workflow

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Configures a workflow to download and install the TerraTag extension using Groovy and then apply tags using a Bash command.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      before: true
      script: |
        import TerraTag
        new TerraTag().loadTool(
          "$workingDirectory",
          "$bashToolsDirectory",
          "0.1.30")
        "Terratag download completed"
    - runtime: "BASH"
      priority: 200
      before: true
      script: |
        cd $workingDirectory
        terratag -tags="{\"environment_id\": \"development\", \"team\": \"platform\", \"cost_center\": \"12345\"}"
- type: "terraformApply"
  step: 300
```

--------------------------------

### Send Nested Slack Notifications

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/SlackApp/README.md

This example demonstrates sending multiple Slack messages sequentially within a single step. It utilizes the SlackApp class, potentially initializing it with a working directory.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import SlackApp

          SlackApp slackApp = new SlackApp("$workingDirectory")
          
          slackApp.sendMessageWithoutAttachment(
              "#general", 
              "Hello Terrakube!", 
              "$SLACK_TOKEN", 
              terrakubeOutput);
          "Slack Message Completed..."
      - runtime: "GROOVY"
        priority: 200
        after: true
        script: |
          import SlackApp

          SlackApp slackApp = new SlackApp("$workingDirectory")
          
          slackApp.sendMessageWithoutAttachment(
              "#general", 
              "First reply to message!", 
              "$SLACK_TOKEN", 
              terrakubeOutput);

          slackApp.sendMessageWithoutAttachment(
              "#general", 
              "First reply to message!", 
              "$SLACK_TOKEN", 
              terrakubeOutput);

```

--------------------------------

### Handle Approvals within Jobs

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

This example illustrates how to incorporate approval steps within a Terrakube job flow. It includes manual approval gates before `terraformApply` and after processing Terraform output, ensuring team oversight.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      before: true
      script: |
        import TerraTag
        new TerraTag().loadTool(
          "$workingDirectory",
          "$bashToolsDirectory",
          "0.1.30")
        "Terratag download completed"
    - runtime: "BASH"
      priority: 200
      before: true
      script: |
        cd $workingDirectory
        terratag -tags="{\"environment_id\": \"development\"}"
- type: "approval"
  step: 150
  team: "AZB_ADMIN"
- type: "terraformApply"
  step: 200
  commands:
    - runtime: "GROOVY"
      priority: 100
      after: true
      script: |
        import groovy.json.JsonSlurper
        
        def jsonSlurper = new JsonSlurper()
        def terraformOutput = jsonSlurper.parseText("$terraformOutputJson")

        terrakubeOutput << "This is the name of the RG ${terraformOutput.rg_name.value}"
- type: "approval"
  step: 250
  team: "AZB_ADMIN"
- type: "terraformDestroy"
  step: 300
```

--------------------------------

### Save Infracost Job Context

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Context/README.md

This example demonstrates how to save Infracost analysis results into the job context. It requires Infracost to be loaded, a Terraform plan to be generated, and then the Infracost JSON output to be saved using the Context extension.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      after: true
      script: |
        import Infracost

        String credentials = "version: \"0.1\"
" +
                "api_key: $INFRACOST_KEY 
" +
                "pricing_api_endpoint: https://pricing.api.infracost.io"

        new Infracost().loadTool(
           "$workingDirectory",
           "$bashToolsDirectory", 
           "0.10.12",
           credentials)
        "Infracost Download Completed..."
    - runtime: "BASH"
      priority: 200
      after: true
      script: |
        terraform show -json terraformLibrary.tfPlan > plan.json 
        INFRACOST_ENABLE_DASHBOARD=true infracost breakdown --path plan.json --format json --out-file infracost.json
    - runtime: "GROOVY"
      priority: 300
      after: true
      script: |
        import Context
        
        new Context("$terrakubeApi", "$terrakubeToken", "$jobId", "$workingDirectory").saveFile("infracost", "infracost.json")

        "Save context completed..."


```

--------------------------------

### Save and Retrieve Job Context

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

The Context extension allows saving and retrieving job context information between workflow steps. This example demonstrates saving Infracost analysis results.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      after: true
      script: |
        import Infracost

        String credentials = "version: \"0.1\"
" +
                "api_key: $INFRACOST_KEY 
" +
                "pricing_api_endpoint: https://pricing.api.infracost.io"

        new Infracost().loadTool(
           "$workingDirectory",
           "$bashToolsDirectory",
           "0.10.12",
           credentials)
        "Infracost Download Completed..."
    - runtime: "BASH"
      priority: 200
      after: true
      script: |
        terraform show -json terraformLibrary.tfPlan > plan.json
        INFRACOST_ENABLE_DASHBOARD=true infracost breakdown --path plan.json --format json --out-file infracost.json
    - runtime: "GROOVY"
      priority: 300
      after: true
      script: |
        import Context

        new Context("$terrakubeApi", "$terrakubeToken", "$jobId", "$workingDirectory").saveFile("infracost", "infracost.json")

        "Save context completed..."
```

--------------------------------

### Slack Notification with Drift Detection

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Sends a Slack notification with detailed Terraform plan changes and drift detection information. This includes installing OPA, analyzing the plan, and formatting the output as a Slack attachment.

```yaml
# Slack notification with attachment and drift detection
flow:
  - type: "terraformPlan"
    step: 100
    name: "Running Terraform Plan with Drift Detection and Slack Notification"
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Opa

          new Opa().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.45.0")
          "Opa Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          terraform show -json terraformLibrary.tfPlan > tfplan.json;
          echo "Validating terraform plan information";
          opa exec --decision terrakube/plan/information --bundle .terrakube/toolsRepository/policy/ tfplan.json | jq '.result[0].result' > drift_detection.json;
          cat drift_detection.json;
      - runtime: "GROOVY"
        priority: 300
        after: true
        script: |
          @Grapes([
            @Grab('com.slack.api:slack-api-client:1.21.2')
          ])
          import SlackApp
          import groovy.json.JsonSlurper
          import groovy.json.JsonOutput
          import com.slack.api.model.Attachment;

          File drift_detection = new File("${workingDirectory}/drift_detection.json")
          String drift_detection_content = drift_detection.text

          def jsonSlurper = new JsonSlurper()
          def body = jsonSlurper.parseText(drift_detection_content)
          def changes =  body.created + body.updated + body.deleted

          Attachment attachment = Attachment.builder()
            .text("Terraform Plan \n\nWorkspace: <your domain>/workspaces/$workspaceId \n\nRepo: $source \n\nChanges: $drift_detection_content")
            .footer("Version: $terraformVersion branch: $branch")
            .color("#1463fb")
            .build();

          new SlackApp().sendMessage(
            "#terraform_actions",
            null,
            "$SLACK_TOKEN",
            Arrays.asList(attachment),
            terrakubeOutput
          );

          "Drift Detection Completed..."
```

--------------------------------

### Basic Workflow with Custom Commands

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Demonstrates a basic Terrakube workflow configuration using Groovy and Bash commands before Terraform plan and after Terraform apply.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          import TerraTag
          new TerraTag().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.1.30")
          "Terratag download completed"
      - runtime: "BASH"
        priority: 200
        before: true
        script: |
          cd $workingDirectory
          terratag -tags="{\"environment_id\": \"development\"}"
  - type: "approval"
    step: 150
    team: "AZB_ADMIN"
  - type: "terraformApply"
    step: 200
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import groovy.json.JsonSlurper

          def jsonSlurper = new JsonSlurper()
          def terraformOutput = jsonSlurper.parseText("$terraformOutputJson")

          terrakubeOutput << "Resource Group: ${terraformOutput.rg_name.value}"
  - type: "terraformDestroy"
    step: 300
```

--------------------------------

### Infracost Extension Workflow

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Sets up a workflow to download and configure the Infracost extension for cost estimation, including generating a plan JSON and running the breakdown command.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      after: true
      script: |
        import Infracost

        String credentials = "version: \"0.1\"\n" +
                "api_key: $INFRACOST_KEY \n" +
                "pricing_api_endpoint: https://pricing.api.infracost.io"

        new Infracost().loadTool(
           "$workingDirectory",
           "$bashToolsDirectory",
           "0.9.11",
           credentials)
        "Infracost Download Completed..."
    - runtime: "BASH"
      priority: 200
      after: true
      script: |
        terraform show -json terraformLibrary.tfPlan > plan.json
        infracost breakdown --path plan.json
```

--------------------------------

### Download and Execute Terratag CLI

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/TerraTag/README.md

This snippet demonstrates downloading the Terratag tool and then executing it to apply tags. Ensure the Terratag version is correctly specified.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      before: true
      script: |
        import TerraTag
        new TerraTag().loadTool(
          "$workingDirectory",
          "$bashToolsDirectory",
          "0.1.30")
        "Terratag download completed"
    - runtime: "BASH"
      priority: 200
      before: true
      script: |
        cd $workingDirectory
        terratag -tags="{\"environment_id\": \"development\"}"
- type: "terraformApply"
  step: 300

```

--------------------------------

### Download and Execute Terratag with Custom Logic

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

This snippet demonstrates writing custom logic in Groovy to download and extract Terratag, followed by Bash commands to make it executable and run it with specific tags. It requires manual dependency management for Groovy.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          @Grapes([
            @Grab('commons-io:commons-io:2.8.0'),
            @Grab('org.apache.commons:commons-compress:1.21'),
          ])

          import org.apache.commons.io.FileUtils
          
          class TerraTagDownloader {
            def downloadTerraTag(workingDirectory, version, os, arch) {
              String terraTagFile = "terratag_${version}_${os}_${arch}.tar.gz"
              String terraTagURL = "https://github.com/env0/terratag/releases/download/v${version}/${terraTagFile}"
              println "Downloading $terraTagURL"
              FileUtils.copyURLToFile(new URL(terraTagURL), new File("${workingDirectory}/${terraTagFile}"))
            }
          } 
          new TerraTagDownloader().downloadTerraTag("$workingDirectory", "0.1.29", "darwin", "amd64")
          "TerraTag Download Compledted..."
      - runtime: "BASH"
        priority: 200
        before: true
        script: |
          cd $workingDirectory;
          tar -xvf terratag_0.1.29_darwin_amd64.tar.gz;
          chmod +x terratag;
          ./terratag -tags="{\"environment_id\": \"development\"}"
  - type: "terraformApply"
    step: 300
  - type: "terraformDestroy"
    step: 400
```

--------------------------------

### Customize workflow with Groovy and Bash commands

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

Inject custom logic into workflow steps using Groovy scripts or Bash commands.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          
          import TerraTag

          new TerraTag().downloadTerraTag("$workingDirectory", "0.1.29", "darwin", "amd64")
          "TerraTag Download Compledted..."
      - runtime: "BASH"
        priority: 200
        before: true
        script: |
          echo $PATH
          helloWorld.sh
          terratag.sh
  - type: "terraformApply"
    step: 300
```

--------------------------------

### Define standard job workflow

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

The basic structure for a Terrakube job workflow using terraformPlan and terraformApply steps.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
  - type: "terraformApply"
    step: 200
```

--------------------------------

### Configure Infracost in Terrakube Workflow

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Infracost/README.md

Defines a terraformPlan flow step that downloads the Infracost tool via Groovy and generates a cost breakdown using Bash.

```yaml
flow:
- type: "terraformPlan"
  step: 100
  commands:
    - runtime: "GROOVY"
      priority: 100
      after: true
      script: |
        import Infracost

        String credentials = "version: \"0.1\"\n" +
                "api_key: $INFRACOST_KEY \n" +
                "pricing_api_endpoint: https://pricing.api.infracost.io"

        new Infracost().loadTool(
           "$workingDirectory",
           "$bashToolsDirectory", 
           "0.9.11",
           credentials)
        "Infracost Download Completed..."
    - runtime: "BASH"
      priority: 200
      after: true
      script: |
        terraform show -json terraformLibrary.tfPlan > plan.json 
        infracost breakdown --path plan.json
```

--------------------------------

### Configure Terrascan in Terrakube Workflow

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Terrascan/README.md

Defines a custom script step to download the Terrascan tool and execute a scan against Terraform files.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Terrascan

          new Terrascan().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "1.12.0")
          "Terrascan Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          terrascan scan -i terraform -t azure;
```

--------------------------------

### Handle Terraform Output After Apply

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

This snippet demonstrates how to process Terraform output after a `terraformApply` step using a Groovy script. It parses the JSON output to extract specific values and appends them to the Terrakube output.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          import TerraTag
          new TerraTag().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.1.30")
          "Terratag download completed"
      - runtime: "BASH"
        priority: 200
        before: true
        script: |
          cd $workingDirectory
          terratag -tags="{\"environment_id\": \"development\"}"
  - type: "terraformApply"
    step: 200
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import groovy.json.JsonSlurper

          def jsonSlurper = new JsonSlurper()
          def terraformOutput = jsonSlurper.parseText("$terraformOutputJson")

          terrakubeOutput << "This is the name of the RG ${terraformOutput.rg_name.value}"
  - type: "terraformDestroy"
    step: 400
```

--------------------------------

### Send Email using Sendgrid Extension

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Sendgrid/README.md

Use this script within a customScripts flow step to send an email. Ensure the SENDGRID_KEY environment variable is set at the workspace level. The terrakubeOutput variable is available for use.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          import Sendgrid
          new Sendgrid().sendMail("no-reply@terrakube.com","sample@gmail.com", "Terrakube Sample", "Hello World Mail!", "text/plain", "$SENDGRID_KEY", terrakubeOutput)
```

--------------------------------

### Execute custom Bash scripts

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

Invoke pre-loaded bash scripts from the repository's bash folder within a custom workflow step.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "BASH"
        priority: 200
        before: true
        script: |
          helloWorld.sh
          terratag.sh
  - type: "terraformApply"
    step: 300
```

--------------------------------

### Send Email Notifications with SendGrid

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Utilize the SendGrid extension to send transactional emails from Terrakube workflows. Requires the SENDGRID_KEY environment variable to be set.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          import Sendgrid
          new Sendgrid().sendMail(
            "no-reply@terrakube.com",
            "devops-team@example.com",
            "Terrakube Job Notification",
            "Your Terraform job has completed successfully!\n\nWorkspace: $workspaceId\nJob: $jobId",
            "text/plain",
            "$SENDGRID_KEY",
            terrakubeOutput)
```

--------------------------------

### Configure Snyk Scan in Terrakube Flow

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/Snyk/README.md

Use this YAML configuration to download and execute Snyk within a Terrakube workflow. Ensure the SNYK_TOKEN environment variable is set at the workspace level.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Snyk

          new Snyk().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "1.831.0")
          "Snyk Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          snyk iac test .;
```

--------------------------------

### Send Microsoft Teams Notification via Groovy

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/MicrosoftTeams/README.md

Uses the MicrosoftTeams and MessageCard classes to construct and send a webhook notification. Requires the MSTEAMS_WEBHOOK_URL environment variable to be configured.

```yaml
flow:
- type: "customScripts"
  step: 100
  commands:
  - runtime: "GROOVY"
    priority: 100
    after: true
    script: |
      import MicrosoftTeams
      import MessageCard

      MessageCard message = new MessageCard('0078D7', 'Hello from Terrakube!', 'Hello Terrakube!')

      // Optionally you can add more info to the message
      message
        .setActivity('My activity title', 'Activity subtitle')
        .setButtons([
          'Go to Terrakube site!': 'https://terrakube.io',
          'terrakube docs': 'https://docs.terrakube.io'
        ])
        .setFacts([
          'Fact 1': 'Value 1',
          'Fact 2': 'Value 2'
        ])

      // You must set the MSTEAMS_WEBHOOK_URL with the actual webhook as an environment variable on your workspace or globally
      new MicrosoftTeams("$MSTEAMS_WEBHOOK_URL").sendMessage(message);
      "Teams Message Completed..."
```

--------------------------------

### Inject Groovy classes

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/README.md

Import and utilize custom Groovy classes within the job execution context.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        before: true
        script: |
          import TerraTag
          new TerraTag().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.1.30")
          "Terratag download completed"
```

--------------------------------

### Send Slack Notification with Attachment for Drift Detection

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/SlackApp/README.md

This snippet sends a Slack message with a formatted attachment, suitable for reporting Terraform plan drift detection. It includes dependencies for Slack API and JSON parsing, and requires Opa for policy execution.

```yaml
flow:
  - type: "terraformPlan"
    step: 100
    name: "Running Terraform Plan with Drift Detection and Slack Notification"
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import Opa

          new Opa().loadTool(
            "$workingDirectory",
            "$bashToolsDirectory",
            "0.45.0")
          "Opa Download Completed..."
      - runtime: "BASH"
        priority: 200
        after: true
        script: |
          cd $workingDirectory;
          terraform show -json terraformLibrary.tfPlan > tfplan.json;
          echo "Validating terraform plan information";
          opa exec --decision terrakube/plan/information --bundle .terrakube/toolsRepository/policy/ tfplan.json | jq '.result[0].result' > drift_detection.json;
          cat drift_detection.json;
      - runtime: "GROOVY"
        priority: 300
        after: true
        script: |
          @Grapes([
            @Grab('com.slack.api:slack-api-client:1.21.2')
          ])
          import SlackApp
          import groovy.json.JsonSlurper
          import groovy.json.JsonOutput
          import com.slack.api.model.Attachment;
          
          File drift_detection = new File("${workingDirectory}/drift_detection.json")
          String drift_detection_content = drift_detection.text

          println drift_detection_content

          def jsonSlurper = new JsonSlurper()
          def body = jsonSlurper.parseText(drift_detection_content)
          def changes =  body.created + body.updated + body.deleted

          Attachment attachment = Attachment.builder()
            .text("Terraform Plan \n\nWorkspace: <your domain>/workspaces/$workspaceId \n\nRepo: $source \n\nChanges: $drift_detection_content")
            .footer("Version: $terraformVersion branch: $branch")
            .color("#1463fb")
            .build();

          new SlackApp().sendMessage(
            "#terraform_actions", 
            null,
            "$SLACK_TOKEN",
            Arrays.asList(attachment),
            terrakubeOutput
          );

          "Drift Detection Completed..."

```

--------------------------------

### Compute Terraform Plan Score with OPA

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Calculates a weighted score for a Terraform plan based on resource creation, deletion, and modification counts.

```rego
score := s {
    all := [ x |
            some resource_type
            crud := weights[resource_type];
            del := crud["delete"] * num_deletes[resource_type];
            new := crud["create"] * num_creates[resource_type];
            mod := crud["modify"] * num_modifies[resource_type];
            x := del + new + mod
    ]
    s := sum(all)
}
```

--------------------------------

### Send Simple Slack Notification

Source: https://github.com/terrakube-io/terrakube-extensions/blob/main/groovy/SlackApp/README.md

Use this snippet to send a basic text message to a Slack channel. Ensure the $SLACK_TOKEN environment variable is set and terrakubeOutput is available.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import SlackApp

          new SlackApp().sendMessageWithoutAttachment(
              "#general", 
              "Hello Terrakube!", 
              "$SLACK_TOKEN", 
              terrakubeOutput);
          "Slack Message Completed..."

```

--------------------------------

### Rego Policy for Terraform Plan Drift Detection

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

This OPA Rego policy file, `policy/plan_information.rego`, calculates the number of created, deleted, and updated resources in a Terraform plan for drift detection.

```rego
# policy/plan_information.rego - Drift detection policy
package terrakube.plan.information

import input as tfplan

created := create_count {
    resources := [resource | resource:= tfplan.resource_changes[_]; resource.change.actions[_] == "create"]
    create_count := count(resources)
}

deleted := delete_count {
    resources := [resource | resource:= tfplan.resource_changes[_]; resource.change.actions[_] == "delete"]
    delete_count := count(resources)
}

updated := updated_count {
    resources := [resource | resource:= tfplan.resource_changes[_]; resource.change.actions[_] == "update"]
    updated_count := count(resources)
}

no_change := no_change_count {
    resources := [resource | resource:= tfplan.resource_changes[_]; resource.change.actions[_] == "no-op"]
    no_change_count := count(resources)
}
```

--------------------------------

### Rego Policy for Terraform Blast Radius Authorization

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

This OPA Rego policy file, `policy/terraform.rego`, defines weights for resource operations and calculates a blast radius score for automated authorization decisions. It also checks for changes to IAM resources.

```rego
# policy/terraform.rego - Blast radius authorization policy
package terraform.analysis

import input as tfplan

# acceptable score for automated authorization
blast_radius := 30

# weights assigned for each operation on each resource-type
weights := {
    "aws_autoscaling_group": {"delete": 100, "create": 10, "modify": 1},
    "aws_instance": {"delete": 10, "create": 1, "modify": 1}
}

# Consider exactly these resource types in calculations
resource_types := {"aws_autoscaling_group", "aws_instance", "aws_iam", "aws_launch_configuration"}

# Authorization holds if score for the plan is acceptable and no changes are made to IAM
default authz := false
authz {
    score < blast_radius
    not touches_iam
}
```

--------------------------------

### Access Injected Context Variables

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Demonstrates how to access Terrakube job context variables within Bash and Groovy scripts.

```yaml
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "BASH"
        priority: 100
        after: true
        script: |
          echo "Working Directory: $workingDirectory"
          echo "Tools Directory: $bashToolsDirectory"
          echo "Organization ID: $organizationId"
          echo "Workspace ID: $workspaceId"
          echo "Job ID: $jobId"
          echo "Step ID: $stepId"
          echo "Terraform Version: $terraformVersion"
          echo "Source: $source"
          echo "Branch: $branch"
          echo "VCS Type: $vcsType"
      - runtime: "GROOVY"
        priority: 200
        after: true
        script: |
          println "Terrakube API: $terrakubeApi"
          println "Job ID: $jobId"
          println "Workspace ID: $workspaceId"

          // Access terraform output after apply
          import groovy.json.JsonSlurper
          def jsonSlurper = new JsonSlurper()
          def output = jsonSlurper.parseText("$terraformOutputJson")

          terrakubeOutput << "Output values: ${output}"
```

--------------------------------

### Send Microsoft Teams Notifications

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Use the Microsoft Teams extension to send customizable message cards to Teams channels via Incoming Webhooks. Ensure the MSTEAMS_WEBHOOK_URL environment variable is set.

```yaml
flow:
- type: "customScripts"
  step: 100
  commands:
  - runtime: "GROOVY"
    priority: 100
    after: true
    script: |
      import MicrosoftTeams
      import MessageCard

      MessageCard message = new MessageCard('0078D7', 'Hello from Terrakube!', 'Hello Terrakube!')

      // Optionally add more info to the message
      message
        .setActivity('Terraform Plan Completed', 'Infrastructure changes detected')
        .setButtons([
          'Go to Terrakube site!': 'https://terrakube.io',
          'terrakube docs': 'https://docs.terrakube.io'
        ])
        .setFacts([
          'Workspace': 'production-aws',
          'Changes': '3 created, 1 modified, 0 deleted',
          'Estimated Cost': '+$50/month'
        ])

      // MSTEAMS_WEBHOOK_URL must be set as an environment variable
      new MicrosoftTeams("$MSTEAMS_WEBHOOK_URL").sendMessage(message);
      "Teams Message Completed..."
```

--------------------------------

### Send Simple Slack Notification

Source: https://context7.com/terrakube-io/terrakube-extensions/llms.txt

Sends a simple text message to a Slack channel. Requires a Slack token and channel name.

```yaml
# Simple Slack notification
flow:
  - type: "customScripts"
    step: 100
    commands:
      - runtime: "GROOVY"
        priority: 100
        after: true
        script: |
          import SlackApp

          new SlackApp().sendMessageWithoutAttachment(
              "#general",
              "Hello Terrakube!",
              "$SLACK_TOKEN",
              terrakubeOutput);
          "Slack Message Completed..."
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.