13.5The Complete IaC Testing Pipeline

+---------------------------------------------------------------+
| Developer pushes Terraform + K8s changes                      |
|                                                               |
|  Stage 1: Static (seconds)                                    |
|  +-- terraform fmt --check                                    |
|  +-- terraform validate                                       |
|  +-- checkov / tfsec / trivy config                           |
|  +-- kubeval / kubeconform                                    |
|  +-- OPA/Conftest custom policies                             |
|                                                               |
|  Stage 2: Plan Analysis (30 seconds)                          |
|  +-- terraform plan -> JSON                                   |
|  +-- Automated plan assertions (no destroys, no public SGs)   |
|  +-- AI agent review of plan diff                             |
|                                                               |
|  Stage 3: Ephemeral Deploy (5-15 minutes)                     |
|  +-- terraform apply to PR workspace                          |
|  +-- Wait for health checks                                   |
|  +-- Post preview URL                                         |
|                                                               |
|  Stage 4: Integration Tests (5-20 minutes)                    |
|  +-- API tests against ephemeral environment                  |
|  +-- E2E browser tests                                        |
|  +-- Security scan (DAST)                                     |
|  +-- Performance baseline                                     |
|                                                               |
|  Stage 5: Cleanup (on merge/close)                            |
|  +-- terraform destroy PR workspace                           |
+---------------------------------------------------------------+