Complete drift detection and remediation pipeline via GitHub Agentic Workflow

[arnaudlh]

Description

The manifesto states: "Agents detect drift, propose fixes, generate plans, request approval, and apply remediations." The azure-drift-detector skill exists but is incomplete — missing scripts, no workflow, no auto-remediation. Rather than a traditional scheduled GitHub Actions workflow, this should be implemented as a GitHub Agentic Workflow (gh-aw) — a scheduled agent that runs periodically, inspects deployments, compares state, and opens PRs to resolve drift.

Related: #12 (GitHub Agentic Workflows adoption)

Implementation Approach: gh-aw Agentic Workflow

The drift detection workflow is authored as a Markdown file (.github/workflows/drift-detection.md) and compiled via gh aw compile into a hardened GitHub Actions workflow. The agent:

1. Runs on a schedule (e.g., daily or weekly via cron).
2. Iterates over all tracked deployments in .azure/deployments/.
3. For each deployment with state.json status succeeded, queries live Azure resource state via az CLI.
4. Compares live state against the stored template.json + state.json.
5. If drift is detected:
   • Creates a branch with an updated drift report.
   • Updates the template or state to reconcile (depending on drift category).
   • Opens a PR with the drift findings, categorized by severity.
   • PR includes: what changed, why it likely changed (policy remediation, manual edit, platform update), and proposed fix.
6. If no drift: logs clean status.

Scope

1. Complete azure-drift-detector skill — Replace missing detect-drift.sh with az CLI commands in the skill procedure. Ensure it can be invoked by both the interactive agent and the agentic workflow.
2. drift-detection.md agentic workflow — Author the gh-aw Markdown workflow with schedule trigger, Azure OIDC login, and drift detection logic. Compile to .github/workflows/ via gh aw compile.
3. Drift categorization — Categorize drift by likely cause: (a) manual Portal change, (b) Azure Policy remediation, (c) platform update, (d) unknown.
4. PR-based remediation — Drift resolution is always via PR: agent proposes template or state update, human reviews and merges.
5. @git-ape drift interactive command — For on-demand drift checks in VS Code chat.

Acceptance Criteria

• drift-detection.md agentic workflow authored and compiles via gh aw compile.
• Workflow runs on schedule, iterates deployments, detects drift.
• Drift findings opened as PRs with categorized changes.
• @git-ape drift <deployment-id> works interactively.
• Drift report categorizes changes by severity and likely cause.
• azure-drift-detector skill is functional (no missing scripts).