Asset inventory and tag-grouped diagram from plan and synth output (#115)

[ms280690]

Closes #115. Stacked on #164 (issue-114-tagging) for the tagging standard; retarget once that merges. The plan and synth artefacts are produced by the caller (the shared plan step from #89/#93 and the CDK synth from #90/#94 are not built yet), which is how the issue's plan-artifact input is defined anyway.

What

• .github/actions/asset-inventory/inventory.py (stdlib): OpenTofu parser walks planned_values.root_module and nested child_modules, so module, for_each and count instances appear by full address; tags from tags_all, tags, effective_labels or labels; region from configuration.provider_config; data sources skipped; a type with no tags attribute is taggable: false and never gets violations. CDK parser reads every *.template.json, tags from Properties.Tags, source.path from Metadata["aws:cdk:path"], AWS::CDK::Metadata skipped, taggable by a known-type list or Tags presence. tag_violations lists missing required keys (values are the feat: inventory — tagging standard and PR-time enforcement across IaC stacks #114 gate's job). Plan JSON carries no source positions, so source.path/line are null for OpenTofu and account is null unless given (documented).
• Renderers: Graphviz DOT (SVG via dot, present on hosted runners) and Mermaid, both clustered project, environment, owner, filled by data-class, violations outlined red. The report embeds Mermaid up to mermaid-max-nodes, else points at the SVG artefact.
• Diff against a base inventory.json: added, removed, retagged (id, key, before, after); owner changes bold in the report. Report carries the <!-- asset-inventory --> marker.
• Schema: docs/asset-inventory.schema.json (draft 2020-12); docs/asset-inventory.md documents fields, limits, publishing, and inframap/cdk-dia as unwired add-ons.
• Composite: inputs stack, input-dir, required-tags, account, base-inventory, mermaid-max-nodes, output-dir; outputs resource-count, violation-count, added-count, report-path; writes SHA256SUMS. Never fails on findings.
• asset-inventory.yml: inputs from the issue plus required-tags, account, comment, actions-ref. Downloads plan-artifact; on PRs fetches inventory.json from the repo's asset-inventory-latest release (notice if none) and keeps one PR comment (fork PRs skipped); on pushes to the default branch with publish creates or updates that rolling release with inventory.json, inventory.svg, inventory.mmd, SHA256SUMS. Artefact always uploaded.
• CI Asset Inventory job: fixtures suite (installs check-jsonschema), composite on the OpenTofu fixture with the base inventory and on the CDK fixture, output and SVG assertions, SHA256SUMS check. README rows and section.

Tests

tests/asset-inventory/run.sh: exact resource sets for the OpenTofu fixture (two stacks, child and nested modules, for_each keys, count index, Google labels, untaggable random_id, data source skipped) and the CDK fixture (taggable role without tags, partially tagged topic, untaggable permission, metadata skipped); --account and --required-tags; diff categories and the bold owner change; DOT and Mermaid snapshots (fixtures/expected); Mermaid threshold; SVG render when dot is present; schema validation of three inventories with check-jsonschema; empty input and usage errors.

Deferred

• Runs on one Terramate repo and one CDK repo once a plan artefact exists there (after feat: cost — Infracost diff for OpenTofu and Terramate stacks (PR/CI) #89/feat: DR readiness — checkov resilience policy pack for Terraform/OpenTofu (PR/CI) #93/feat: cost — Infracost diff for AWS CDK synth output (PR/CI) #90).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF