Turn on drift checks

drift:
  schedule: "0 6 * * *"

plywood ci writes a scheduled job per stack, and each runs chant’s drift detection on its stack. On stock Pulumi it runs pulumi refresh --preview-only --target <urn> for each resource in the stack’s last export. Each drifted stack gets one issue that lists each resource’s URN, status and attributes. A run that finds new drift edits the issue, and a clean run closes it.

drift.stacks lists the stacks the job reads as names or project/* globs. respond.drift sets the answer to a finding:

Value	Answer
issue (the default)	the issue
pull-request	the issue and the drift agent’s pull request
up	the issue and a gated update of the waves holding the drifted stacks
none	the exit code only

npx plywood drift shop/prod-east reads one stack by hand. Each read passes the stack to chant (workspace drift --member <project> --stack <stack>), so a project with several stacks reads each stack’s own stored export. A stack the store holds no export for fails its read with no-drift-read, naming the stack.

With plunge, the Pulumi fork from the team behind plywood, the pipeline also gets drift read by plunge drift with one provider read per resource and no program run.