Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
Terraform is a mature Infrastructure as Code (IaC) tool that enables users to define, provision, and manage cloud infrastructure using a declarative configuration language. The system operates as a command-line interface with a plugin-based architecture, allowing extensibility through providers and provisioners for various cloud platforms and services. Its core functionality includes loading configuration, managing state, generating execution plans via dependency graph resolution, and applying changes to infrastructure. The architecture is modular, separating concerns into distinct packages for CLI commands, configuration loading, state management, plugin handling, and the core execution engine. Key entry points are found in the `main` package and the `internal/command` directory, which implements subcommands like `apply`, `plan`, `state`, and `workspace`. Data flows involve parsing HCL configuration into an internal representation, comparing it with the current state to generate a plan, and executing that plan via provider plugins to update infrastructure and refresh the state. Terraform demonstrates strong engineering practices with a comprehensive test suite, continuous integration, and a well-defined plugin system. While the codebase is large and exhibits some complexity (such as duplication between plugin versions and backend helpers), it remains actively maintained with recent commits and ongoing development. The tool's design emphasizes reusability, as evidenced by components like the generic collections package and the diagnostic system, which could be extracted for use in other projects.
OpenTofu is an open-source Infrastructure as Code (IaC) tool for safely and efficiently creating, changing, and versioning infrastructure. It operates as a CLI-driven application where users define infrastructure in declarative HCL configurations, which are parsed into a dependency graph to plan and apply changes across cloud providers. The architecture features modular separation of concerns: configuration loading (internal/configs), state management (internal/backend/internal/states), graph-based planning (internal/plans/internal/dag), encryption (internal/encryption), and a plugin system for providers/provisioners (internal/plugin/internal/getproviders). Key external dependencies include Go cloud SDKs (AWS, Azure, GCP), HCL for parsing, and cty for type system. The tool emphasizes extensibility through interface-based designs: encryption methods and key providers can be plugged in via internal/encryption, backends via internal/backend, and plugins via internal/plugin. State locking, workspace management, and Terraform Cloud integration are built-in features. Development is active with regular releases, comprehensive testing (unit/end-to-end), and maintenance of compatibility with Terraform ecosystem while introducing independent features like native OCI support and enhanced encryption options.
This repository is the Pulumi Infrastructure as Code (IaC) platform. It provides a CLI (`pulumi`) and multi-language SDKs (TypeScript, Python, Go, .NET, Java, YAML) that allow users to define cloud infrastructure using general-purpose programming languages. The architecture is a monorepo containing a core engine (`pkg/engine`) that orchestrates resource lifecycle management, deployment steps, and state operations. Language plugins (`pulumi-language-nodejs`, `pulumi-language-python`, `pulumi-language-go`) host user programs and communicate with the engine via gRPC. Code generators (`pkg/codegen`) produce SDKs from provider schemas, enabling a pluggable provider model. The CLI entry point is `pkg/cmd/pulumi/main.go`, dispatching to subcommands for stack management, deployment operations (up, preview, destroy, refresh), policy-as-code, config, secrets, and ESC (Environments, Secrets, Config). External dependencies include cloud provider APIs (AWS, Azure, GCP, Kubernetes) accessed through plugins, and state backends (local filesystem, S3, Azure Blob, GCS, PostgreSQL, or Pulumi Cloud). The system uses protobuf for serialization and gRPC for inter-process communication between engine, language hosts, and providers.
This repository is a comprehensive Terraform module for provisioning and managing AWS EKS (Elastic Kubernetes Service) clusters. It provides a modular, production-grade interface to create clusters with all supporting resources: IAM roles, security groups, VPC networking, encryption (KMS), logging, addons, identity providers (OIDC/IRSA), and access entries. The root module orchestrates multiple sub-modules for compute resources including EKS managed node groups, self-managed node groups (autoscaling groups), Fargate profiles, Karpenter integration, hybrid node roles, and EKS capabilities (ACK, ArgoCD, KRO). The architecture follows standard Terraform module patterns with extensive use of `for_each`, `dynamic` blocks, and conditional creation. The codebase demonstrates high craftsmanship through its modular design, comprehensive test infrastructure, and detailed upgrade guides that document breaking changes across major versions (v17 through v21). It includes an internal user data rendering sub-module that supports AL2, AL2023, Bottlerocket, and Windows AMIs, with both cloud-init and custom template support.
This repository is the official HashiCorp Terraform provider for Microsoft Azure (azurerm). It enables declarative management of Azure infrastructure—resources, data sources, and services—through Terraform configurations. The provider is written in Go and uses the Terraform Plugin SDK and Plugin Framework to implement CRUD operations, state migrations, custom polling for asynchronous operations, and extensive input validation. Its architecture follows a modular service registration pattern: each Azure service (e.g., compute, network, storage, appservice) is self-contained within `internal/services/<service>/`, with its own client construction, resource definitions, validation functions, and acceptance tests. Key entry points include `main.go` for provider initialization, `internal/provider/provider.go` for resource registration, and `internal/services/*/registration.go` for service wiring. Data flows from Terraform configuration through the provider's SDK layer to Azure REST APIs via the `go-azure-sdk` library. The codebase is large (43k+ files) but well-organized, with extensive test coverage and tooling for documentation linting, schema API compatibility checks, and PR guide suggestions. It is actively maintained with frequent releases and a large community (5k+ stars, 5k+ forks).
This repository provides a comprehensive suite of GitHub Actions for automating Terraform and OpenTofu workflows in CI/CD pipelines. Each action (e.g., terraform-apply, terraform-plan, terraform-validate) is implemented as a standalone reusable workflow with standardized inputs, outputs, and Docker-based execution environments. The architecture features a common shell library (actions.sh) that handles tool installation, backend initialization, and shared utilities, while individual actions focus on specific operations like plan generation, state management, or pull request commenting. Key capabilities include version detection from multiple sources, backend fingerprinting for state identification, automated PR commenting with approval workflows, and support for both Terraform and OpenTofu. The project emphasizes reliability through extensive testing across versions and backends, with clear separation of concerns between action definitions, implementation logic, and documentation generation.
This is a Chef cookbook for installing and managing Redis instances and Sentinel. It provides custom resources for installing Redis from packages or source, configuring Redis server instances with systemd service management, and setting up Redis Sentinel for high availability. The cookbook follows modern Chef practices with unified_mode true resources, comprehensive testing, and cross-platform support for Amazon Linux, Debian, Rocky Linux, and Ubuntu. It includes compatibility wrappers for migrating from older attribute-driven configurations to the new resource-based approach.
This repository is the official open-source companion to Anthropic's Claude Code—an agentic AI coding assistant that operates in the terminal. It is not the core Claude Code binary (distributed separately via npm/brew/install scripts), but rather the plugin ecosystem, example configurations, CI automation scripts, and infrastructure-as-code templates that extend and support the tool. The repo contains 13 first-party plugins (e.g., security-guidance, code-review, feature-dev, commit-commands, pr-review-toolkit, hookify, plugin-dev), each defining hooks, commands, agents, and skills that integrate with Claude Code's extensibility framework. It also provides production-grade Terraform modules for deploying a Claude Code Gateway on AWS (ECS Fargate + RDS + Bedrock) and GCP (Cloud Run + Cloud SQL + Vertex AI), along with enterprise MDM settings (macOS plist/mobileconfig, Windows ADMX, Intune scripts) and managed settings templates. A suite of GitHub Actions workflows handles automated issue triage, duplicate detection, lifecycle management, and code review, all using Claude Code itself as the automation engine. The repository is primarily a configuration and extension catalog rather than a standalone application; its value lies in demonstrating the plugin architecture and providing reusable patterns for AI-assisted development workflows.
This repository is ansible-core, the foundational engine of the Ansible IT automation platform. In production, it executes declarative playbooks against remote targets via SSH, WinRM, or local connections, managing configuration, application deployment, and orchestration across heterogeneous systems (Linux, Windows, macOS, network devices). The architecture is plugin-based: a core runtime (playbook parser, task executor, variable and fact management) loads hundreds of plugins (actions, modules, inventory sources, cache backends, callbacks, filters, tests, lookups, connections, become methods, and more). Key entry points are CLI tools (`ansible`, `ansible-playbook`, `ansible-galaxy`, `ansible-test`) that parse arguments, load playbooks/inventories, and orchestrate task execution across a pool of worker processes. Primary data flows include playbook parsing → variable resolution (including Jinja2 templating with data tagging for provenance/trust) → inventory and host matching → fact gathering (via built-in collectors or external tools like Facter/Ohai) → task execution (module payloads are shipped via AnsiballZ, a self-extracting archive) → result collection and callback output. External dependencies include Jinja2, PyYAML, cryptography, and resolvelib; the codebase also vendors a copy of the `distro` library and includes a full test framework (`ansible-test`) with cloud integration and sanity checks.
The AWS Serverless Application Model (SAM) Transformer is a Python library that converts SAM templates into AWS CloudFormation templates. It serves as the core transformation engine for the AWS SAM CLI, enabling developers to define serverless applications using SAM syntax that gets expanded to standard CloudFormation resources. The system follows a modular architecture with distinct layers for parsing, validation, transformation, and resource generation, featuring an extensible plugin system for adding custom transformation logic. Key capabilities include intrinsic function resolution (!Ref, !GetAtt, !Sub), globals and conditions processing, policy template expansion, and resource-specific transformations for AWS services like Lambda, API Gateway, Step Functions, and more.
SrvOS is a production-grade NixOS and nix-darwin configuration framework that provides opinionated, modular server configurations. The codebase exports NixOS modules organized into machine types (common, server, desktop), hardware profiles (Hetzner, AWS, DigitalOcean, Vultr), roles (GitHub Actions runner, Nix remote builder), and mixins (telegraf, nginx, terminfo). It uses Nix flakes for dependency management and includes comprehensive test configurations that validate module evaluation across multiple platforms. The architecture follows NixOS module patterns with clear separation between shared configurations, platform-specific modules, and role-based configurations. Key entry points are default.nix and flake.nix, which expose nixosModules and darwinModules for consumption. The codebase demonstrates strong engineering practices with security-focused defaults (SSH hardening, sudo restrictions), comprehensive systemd service configurations, and production-ready monitoring setups. Notable for its GitHub Actions runner implementation, which includes sophisticated token management via GitHub Apps, ephemeral runner support, and secure systemd sandboxing. The Prometheus alert rules provide production monitoring capabilities with well-defined alert conditions for infrastructure health.
Infrahub is a full-stack infrastructure data management platform that provides a unified data model for network, cloud, and infrastructure resources. It features schema-first graph-based data modeling (using Neo4j), version control for data via branching and proposed changes, automation through generators and transforms, and integration capabilities via APIs, webhooks, and SDKs. The backend is built with Python/FastAPI, Prefect for workflow orchestration, and uses Neo4j as the primary graph database. The frontend is a React/TypeScript application with TanStack Query and Jotai for state management. The system supports IPAM, diff computation, artifact generation, and role-based access control, targeting infrastructure teams seeking repeatable, validated workflows for infrastructure as a service.
terraform-docs is a CLI tool written in Go that automatically generates documentation from Terraform modules. It parses Terraform configuration files (variables, outputs, providers, resources, modules, requirements) using HashiCorp's terraform-config-inspect library, then renders the extracted metadata into multiple output formats including Markdown (table and document), AsciiDoc (table and document), JSON, YAML, TOML, XML, a colorized 'pretty' format, and tfvars (HCL and JSON). The tool supports extensive configuration via a YAML file or CLI flags, allowing users to control which sections are shown, sorting order, output file injection or replacement, recursive submodule processing, and custom headers/footers. It also features a plugin system based on go-plugin for extending formatters, and integrates with CI/CD pipelines, pre-commit hooks, and GitHub Actions. The architecture follows a clean separation of concerns: a cobra-based CLI dispatches to format-specific packages, which use Go templates for rendering. The codebase is well-tested with golden file tests covering edge cases like escape characters, code blocks, and multiline descriptions.
Azure Export for Terraform (aztfexport) is a CLI tool that brings existing Azure resources under Terraform management. It discovers Azure resources via Azure Resource Graph or direct resource IDs, identifies the corresponding Terraform resource types using the `aztft` library, imports them into Terraform state, and generates HCL configuration files. The tool supports multiple modes: single/multiple resource IDs, resource groups, ARG queries, and mapping files. It offers both interactive (TUI with bubbletea) and non-interactive (batch) modes, with configurable parallelism, backend types, and provider versions (azurerm or azapi). The architecture is modular, with clear separation between resource discovery (internal/resourceset), Terraform interaction (internal/meta), configuration generation (via tfadd), and UI layers. The codebase is well-tested with unit and end-to-end tests, and follows professional Go conventions.
The cdk-dia tool is a CLI utility that generates visual diagrams from AWS CDK applications. It reads the synthesized cloud assembly (tree.json) produced by `cdk synth` and constructs a hierarchical tree of CDK constructs. This tree is then transformed into a diagram representation, where nodes represent constructs (annotated with AWS service icons and labels) and edges represent relationships resolved via CloudFormation intrinsic functions. The tool supports customization via CDK construct decorators (e.g., to collapse or ignore nodes) and can output diagrams in two formats: static PNGs via Graphviz or interactive HTML via Cytoscape. The architecture is modular, separating concerns into CDK tree parsing (`src/cdk/`), diagram generation (`src/diagram/`), and rendering (`src/render/`). The diagram generation process involves recursively building a component tree, resolving edges, applying customizations, and post-processing (collapsing/ignoring nodes). Renderers are selected via a strategy pattern, allowing easy extension to new output formats. The tool demonstrates strong encapsulation in its core data structures (Tree and Node classes) and link management (ComponentLinks class), which are largely independent of CDK-specific logic and could be reused in other tree-based applications. Maintenance appears active, with a recent commit history and ongoing issue activity. Dependencies are up-to-date (no Dependabot alerts), and the tool aligns with current CDK v2 practices. Technical drift is low, as the codebase avoids deprecated APIs and maintains compatibility with modern TypeScript and Node.js ecosystems. The project includes comprehensive snapshot tests to ensure correctness across various CDK infrastructure patterns, from simple queue-topic subscriptions to complex CI/CD pipelines.
Kubenix is a Nix-based framework for declarative Kubernetes management. It uses the NixOS module system to define Kubernetes resources, Helm charts, Docker images, and custom resources in a type-safe, composable manner. The project provides a CLI tool for applying manifests with diffing, pruning, and secret injection via vals. At its core, kubenix is a set of Nix library functions and modules that evaluate user configuration to produce Kubernetes YAML/JSON. It supports submodules (nested composable configurations), testing frameworks (including kubetest), and code generation from Kubernetes OpenAPI specs. The architecture is purely functional, leveraging Nix's lazy evaluation to merge and validate resources at build time. This is a hybrid project combining a library (Nix modules and functions) with an application (CLI tool), but it is classified as an application because its primary deliverable is a deployable package and CLI.
This repository is Sentry's self-hosted packaging and operations layer, not the Sentry application itself. It bundles upstream Sentry, Relay, Snuba, Symbolicator, Taskbroker, Vroom, uptime-checker, and launchpad images into a large Docker Compose deployment, and provides idempotent install/upgrade scripts, generated config templates, healthchecks, backup/restore tooling, and optional community patches. The primary entry points are install.sh, which sources a sequence of modular install/ steps, plus operator scripts under scripts/ (reset.sh, backup.sh, restore.sh), sentry-admin.sh for Django admin commands, and a reusable GitHub Action (action.yaml) that downstream Sentry repos use to run self-hosted end-to-end tests against their own images. The runtime architecture is a compose stack: nginx terminates HTTP and routes ingestion to Relay, which validates and buffers events before writing to Kafka; Snuba consumer containers move data from Kafka into ClickHouse; Sentry web and consumer containers read from Kafka/Postgres/Redis and the SeaweedFS S3-compatible object store; Symbolicator handles native symbolication; Taskbroker routes async tasks. The compose file supports an errors-only profile that dramatically reduces the service count and a feature-complete profile that enables transactions, metrics, replays, profiling, uptime, logs, and mobile builds. The codebase is notably well-tested for an infrastructure repo, with bash unit tests under _unit-test/ and pytest integration tests under _integration-test/ that install the full stack and verify event ingestion end to end. Maintenance is active and dependency drift is low: images are bumped regularly via Dependabot, shell scripts are linted with ShellCheck and formatted with shfmt, there is a pre-commit pipeline, and the repo tracks recent upstream replacements such as Valkey for Redis, pgbouncer, taskbroker, and ClickHouse upgrades. The main limitation for reuse is that most of the repository is configuration and deployment glue tied to this specific stack; the few genuinely self-contained, extractable components are small utilities around healthchecks, cryptography/migration, and cron containers.
Kapitan is a configuration-as-code CLI tool that renders infrastructure manifests (Kubernetes, Terraform, Docker, etc.) from a hierarchical YAML inventory and pluggable template engines (Jsonnet, Jinja2, Kadet, Helm, Kustomize, CUE). It manages secrets via references (GPG, cloud KMS, Vault, base64), fetches remote dependencies (Git, HTTP, OCI, Helm charts), and supports multiple inventory backends (Reclass, OmegaConf). The compilation pipeline is inventory-driven: targets define classes and parameters, which are deep-merged and interpolated, then passed to input-type compilers that produce deterministic output files. The architecture is modular—separate packages for inputs, inventory backends, secrets/references, and dependency management—all orchestrated by the `kapitan compile` CLI command. It is not a data research project; it is a production-grade infrastructure tool with a large test suite, CI/CD, and documented extension points.
Jikkou is a declarative infrastructure-as-code tool for managing Apache Kafka and related data infrastructure (Schema Registry, Kafka Connect, Apache Iceberg, Confluent Cloud, Aiven, AWS Glue). It provides both a CLI and a REST API server that reconcile desired resource state (defined as YAML/JSON files) against live cluster state using a Kubernetes-style resource model (apiVersion, kind, metadata, spec). The system computes diffs between declared and actual configurations, then applies only the necessary changes via pluggable controllers and change handlers. Architecturally, the project is a multi-module Maven project with a core library that defines extension points (collectors, controllers, validations, transformations, health indicators, change reporters) and provider modules that implement these interfaces for specific platforms. The CLI uses picocli for command parsing, and the REST API server is built on Micronaut with HATEOAS links. Both share the same core API and extension registry. A GraalVM native-image build is supported for the CLI. The codebase demonstrates strong software engineering with clean interfaces, builder patterns, annotation-driven extension metadata, and comprehensive unit and integration tests using Testcontainers. Some code duplication exists across provider modules, and the large number of generated model classes introduces maintenance overhead. Overall, it is a well-crafted, production-ready tool for Kafka ecosystem resource management.