Your first diff · Diffkeel

Render prod, diff it against what runs, read the result, then gate it in CI. Ten minutes, one repository.

Diffkeel answers one question before a deploy: what changes for this environment, key by key?

1. Name the environment

diffkeel init finds your config files and writes one entry per environment. Check the live line: it is the command that prints the config running now.

[env.prod]
files = ["base.yaml", "prod.yaml", "prod.env"]
live  = "./scripts/read-live-config.sh prod"
mask  = ["DB_PASSWORD", "API_TOKEN"]

2. Diff it

$ diffkeel diff prod
rendered prod from 3 files in 41 ms
3 changes, 1 secret, 0 reviews

Each change prints by key, with the file it came from. A masked secret prints a short hash, so a reviewer sees that it changed and nothing more.

@@ api.yaml @@
-timeout: 30s
+timeout: 5s

3. Gate it in CI

Add one step before the deploy step. It exits 1 while any prod change lacks a review.

- name: config diff
  run: diffkeel check --env prod --require-review

4. Hand it to an agent

--json prints each change as one object, so an agent can explain the diff in a pull request comment.