Investigation
Treat the path itself as part of the incident.
Safe investigation sequence:
- Verify local hooks: Identify whether local pre-commit hooks ran or were bypassed (e.g., using
--no-verify). - Inspect CI path: Review the GitHub Actions logs for plan, approval, and apply evidence.
- Confirm branch rules: Check if the repository’s branch protection rules were ignored or misconfigured.
- Identify the gap: Pinpoint the first missing checkpoint that made the later failure possible.
The goal is to understand how the process was circumvented.
Containment
Containment means restoring the normal, safe path before any subsequent changes are made.
Containment steps:
- Revert/Replay: Revert the unreviewed change or replay it through the approved PR workflow.
- Regenerate Evidence: Generate a fresh Terraform plan and conduct a proper peer review.
- Enforce Rules: Re-enable or fix local hooks and branch protection rules.
- Final Validation: Confirm that the next change must pass through every defense layer.
Pause and Predict: What automated guardrail would have prevented this incident entirely?