# Set Diff Desk

> Paste the JSON of a terraform plan (terraform show -json plan.tfplan). The browser matches the elements of every AzureRM Set-type attribute by its key attribute, sets aside the elements that only moved (order-only "false-positive" diffs), and numbers every real change - replacements and the attributes that force them, creates, deletes, Set elements added, removed or modified, other attributes, and reordered lists the skill's table does not know - for free. Then a review lane rates every real change, writes checks before and after apply, proposes Set-table additions and a pull-request comment, and gives a verdict.

URL: https://setdiff-desk.skillsafe.ai/
API tutorial: https://setdiff-desk.skillsafe.ai/api.html

## Who it is for

Platform and cloud engineers, SREs and reviewers of Terraform pull requests on Azure, whose plans for Application Gateways, Network Security Groups, Load Balancers, Firewall policies, Front Door, route tables or virtual networks show dozens of "changed" elements when one was added - and who need to find the real change, and its risk, before apply.

## The free reading (in the browser, no model)

- Input: the output of terraform show -json, pasted or dropped as plan.json. The human-readable plan text is recognised and refused with the command to produce the JSON.
- The skill's Set analysis, ported: for every azurerm_ resource being updated, every Set attribute in the skill's table (application_gateway listeners, pools, settings, rules, probes, ports, certificates, rewrite rule sets with nested rules, conditions and header configurations, URL path maps with path rules; NSG security_rule; route_table route; virtual_network subnet; lb frontend_ip_configuration; firewall_policy_rule_collection_group rule collections and their rules, ports, addresses and FQDNs; frontdoor backend pools and backends, probes, routing rules; private_endpoint, api_management, cosmosdb_account, virtual_network_gateway, nat_gateway, storage_account, key_vault and kubernetes blocks) is compared element by element on its key. Elements identical but for their position are order-only entries (N01..); elements added, removed or modified are real Set changes. An "ignore case" option mirrors the skill's --ignore-case.
- Beyond the skill: resource-level findings for every provider - replace (with the attributes that force it), create, delete, forget; every other attribute that changes, with its before and after; attributes that become known only after apply, kept apart; lists or blocks the table does not know whose elements are identical once sorted (suspected reorders); a keyless single block (network_acls, network_rules) compared field by field rather than reported as one removed and one added.
- Values Terraform marked sensitive are shown and sent as (sensitive). Text inside planned values that addresses reviewers (an instruction to approve or to treat changes as noise) is flagged.
- Exports: the skill's Markdown report, its JSON format (summary, has_real_changes, resources, warnings) with the exit code (2 replacement, 1 Set change or create/delete, 0 none or order-only), its one-line summary, and the findings as CSV.

## The paid lane (gpt-terra, metered)

- review: one answer per finding, in order - confirmed or disputed, a risk of high, medium, low or none, what the change does to the running resource and why that risk; the order-only entries confirmed or disputed by id; one to six concrete checks before or after apply, each tied to finding ids, every high finding covered before apply; one proposed Set-table addition per confirmed suspected reorder (resource type, attribute, key); the changes compared with the user's one-line intent; any text addressed to reviewers reported, never obeyed; a 3-12 line pull-request comment opening with the verdict; questions for the author; a summary. The verdict follows from the risks: any high gives hold, any medium or low apply with checks, otherwise apply. In production a replace or delete is always high.
- The run is sent the page's reading only - never the plan, its prior state, variables or configuration.

## How replies are held to the input

Every reply is reconciled in the browser against the page's reading: one answer per finding in order with the page's ids; a replace or delete never rated low or none, and high in production; a confirmed suspect rated none; the verdict exactly what the risks give; one to six checks citing real ids, every high finding covered before apply; table additions matching the confirmed suspects' types and paths; the intent status; the injection note naming the address; the PR comment's length and first line; no resource address and no figure the page's reading or the intent does not contain.

## Limits

- The Set table covers the AzureRM types listed above (as of the skill's table, 2026-01-28). Other providers get the resource-level findings and the suspected-reorder check, not key-based Set matching.
- A keyless Set with several blocks changed at once is reported as elements removed and added, as the skill does.
- The review judges risk from the plan's facts; it cannot see live traffic, dependencies outside the plan, or values Terraform hides.
- Bundled examples use invented companies and documentation-range IP addresses.

## Sources

- Agent skill @github/terraform-azurerm-set-diff-analyzer (github/awesome-copilot, MIT): https://skillsafe.ai/skill/@github/terraform-azurerm-set-diff-analyzer - the analyzer (analyze_plan.py), its Markdown, JSON and summary outputs and exit codes, and references/azurerm_set_attributes.json.
- Terraform JSON output format: https://developer.hashicorp.com/terraform/internals/json-format