# Rewrite the checks on plans Turn the CI checks that read the OpenTofu plan JSON into plan policies, and run both until they agree. Level: intermediate · Time: 35 minutes · Needs: Step 5 done: [convert the state](m5-convert-the-state.md). You will learn: How does a check over `tofu show -json` become a policy that pravo judges? Done when: Every old check has a policy, and both give the same verdict on the same changes. A check that runs in CI over the output of `tofu show -json` does not carry over as it is. It reads the OpenTofu plan JSON, and pravo prints a plan document of its own. You rewrite each rule once, in CUE, as a plan policy. A policy is one CUE file that a plan must satisfy. Whoever runs pravo names it with `--policy`. pravo judges the plan before it acts. ## The check you have A common arrangement is a step between `plan` and `apply`: ```sh tofu plan -out=change.plan tofu show -json change.plan > plan.json ./check-plan plan.json tofu apply change.plan ``` The script is a program or a few lines of `jq`. Two typical rules: ```sh # No resource is deleted or replaced. jq -e '[.resource_changes[] | select(.change.actions | index("delete"))] | length == 0' plan.json # A local file that is created or updated has the permission 0600. jq -e 'all(.resource_changes[] | select(.mode == "managed" and .type == "local_file" and (.change.actions | index("create") or index("update"))); .change.after.file_permission == "0600")' plan.json ``` Both exit non-zero when the rule fails, and the job stops. The build of this page does not run OpenTofu. The `tofu` and `jq` lines above are shown for comparison; every `pravo` command below is run. ## Where each rule goes | The rule says | It goes in | Checked | |---|---|---| | An attribute may only take these values. | A constraint on the provider definition. | By `pravo validate`, with no provider started. | | An attribute must be set. | A plan policy. | When a plan is made and when it is applied. | | A plan may not delete, or may change at most N resources. | A plan policy. | When a plan is made and when it is applied. | A constraint on the provider definition rejects a value that is set and wrong. It cannot require that a value is set. See [Policies](../concepts/policies.md) for the two kinds and [Write and roll out plan policies](../how-to/policies.md) for the full how-to. This page rewrites the second and third kinds, which are the ones that read plan JSON. ## The plan document `pravo plan --json` prints the document. The workspace holds a root `infra` with a random pet and a file. Apply it once, so that a plan has records to compare. ```cue file=infra/providers.cue title="infra/providers.cue" package infra import ( rnd "pravo.dev/providers/hashicorp/random" loc "pravo.dev/providers/hashicorp/local" ) $random: rnd.#Provider & {$version: "~> 3.6"} $local: loc.#Provider & {$version: "~> 2.5"} ``` ```cue file=infra/pet.cue title="infra/pet.cue" package infra pet: $random.#Resource.random_pet & {length: 2} ``` ```cue file=infra/note.cue title="infra/note.cue" package infra note: $local.#Resource.local_file & { filename: "out/note.txt" content: "pet: \(pet.id)\n" file_permission: "0600" } ``` ```sh run pravo -C infra init > /dev/null pravo -C infra apply --auto-approve 2>&1 | tail -n 1 ``` ```text out Apply complete! Resources: 2 added, 0 changed, 0 destroyed. [txn ] ``` A policy lives outside the root directory. The root is `infra`, and the policies sit in `policy` beside it. Add one change to the root and look at the document: ```cue file=scenarios/extra.cue title="scenarios/extra.cue" package infra extra: $local.#Resource.local_file & { filename: "out/extra.txt" content: "extra\n" } ``` ```sh run rm -rf trial && cp -R infra trial && cp scenarios/extra.cue trial/ pravo -C trial plan --json 2>/dev/null | head -n 36 ``` ```text out { "format": 1, "created": "