mani-diffy — workflow validation fork

Attribution: This repository is derived from the public chime/mani-diffy project. It is an independent fork maintained by whathehack81 and is not affiliated with, sponsored by, or endorsed by Chime.

Fork purpose

This fork is retained for authorized CI/CD workflow review, hardening experiments, and source study.

A previously committed local workflow experiment was removed from the default branch. It did not establish a vulnerability in Chime, GitHub Actions, or mani-diffy. Historical experiment commits in this fork must not be interpreted as upstream findings.

No workflow in this repository should be used to access cloud metadata, transmit repository context to third-party collectors, test third-party infrastructure, or interact with systems without explicit authorization.

Upstream project

The upstream tool walks a hierarchy of Argo CD Application templates, renders Kubernetes manifests, and makes the rendered output available for review in a pull request before cluster deployment.

Original project:

• Repository: chime/mani-diffy
• Upstream maintainers and contributors retain credit for the original implementation, documentation, and media assets.
• The existing Go module path is retained for source compatibility with the upstream codebase.

See NOTICE for attribution and fork-specific context.

Usage boundaries

Use this fork only in repositories and CI environments you own or are explicitly authorized to test.

• Do not target Chime systems or contributors.
• Do not request reviews from upstream maintainers through this fork.
• Do not add secrets, webhook collectors, live infrastructure targets, or metadata-service probes.
• Validate workflow-hardening hypotheses with isolated repositories, synthetic data, and least-privilege tokens.
• Treat a workflow concern as reportable only after proving attacker capability, a real trust boundary, and reproducible impact.

Core behavior

mani-diffy can:

1. Render manifests affected by changes to Argo CD application templates.
2. Store generated manifests in the repository for review.
3. Make revision-to-revision manifest differences easier to inspect.
4. Run an optional post-renderer against generated output.

Example post-renderer usage:

mani-diffy -post-renderer="bin/post-render" -output=.zz-auto-generated

License and attribution

This fork preserves the upstream project history and attribution. Review the repository license and NOTICE before redistribution or modification.