InfraDiff

Understand Infrastructure Changes Before They Happen.

InfraDiff is a semantic infrastructure analysis platform that explains infrastructure changes in human language before deployment. Instead of showing raw diffs, it analyzes changes and answers: what changed, why it matters, what services are affected, deployment risk, security impact, dependency graph, cost impact, and reviewer guidance.

Features

Core Analysis

Feature	Description
Semantic Diff	Infrastructure changes explained in human language with field-level details
Risk Engine	8-factor deployment risk scoring (0-100) with explanations
Security Analyzer	11 security checks with scoring and recommendations
Cost Analyzer	Cloud cost estimation for 11 AWS resource types
Dependency Graph	Interactive DAG visualization with dagre layout
Blast Radius	Cascade impact analysis when resources change
Compliance	CIS AWS, SOC 2, PCI DSS framework evaluation
Rule Engine	10 configurable compliance rules

Parsers

Parser	Formats
Terraform	HCL with nested blocks, dependencies, tags
Kubernetes	Multi-document YAML, Deployments, Services, ConfigMaps
Helm	Chart.yaml, dependencies, embedded templates
CloudFormation	AWS YAML with Resources, DependsOn, Properties
Pulumi	JSON programs with provider detection

UI Features

Dark mode / Light mode toggle
Responsive design (mobile + desktop)
Loading skeletons on all pages
Empty states with CTAs
Keyboard shortcuts (g+d Dashboard, g+g Graph, n+d New Diff, etc.)
ECharts cost breakdown and risk distribution charts
React Flow interactive dependency graphs
Report export (Markdown, HTML, JSON, PDF via print)
Pull request review generation
Resource search

Tech Stack

Backend

Technology	Version	Purpose
Java	21	Runtime
Kotlin	2.1.20	Language
Spring Boot	3.5.3	Framework
Spring Security	-	Authentication + OAuth2
Spring Data JPA	-	Database access
Hibernate	-	ORM
Spring Validation	-	Request validation
Spring Cache	-	Caching abstraction
Spring Actuator	-	Health/metrics endpoints
Flyway	-	Database migrations
PostgreSQL	-	Database
Caffeine	-	In-memory caching
JWT (jjwt)	0.12.6	Token authentication
OpenAPI (springdoc)	2.8.6	Swagger UI
Micrometer + Prometheus	-	Metrics

Frontend

Technology	Version	Purpose
Next.js	15.3.3	Framework
React	19.1.0	UI library
TypeScript	5.8.3	Type safety
TailwindCSS	4.1	Styling
shadcn/ui	-	UI components
TanStack Query	5.81	Server state
React Flow	11.11	Graph visualization
Apache ECharts	5.6	Charts
React Hook Form	7.57	Form management
Zod	3.25	Schema validation
Axios	1.9	HTTP client

Architecture

backend/
├── controller/       # REST API endpoints (10 controllers)
├── service/          # Business logic (8 services)
├── repository/       # Data access (10 JPA repositories)
├── entity/           # JPA entities (11 entities)
├── dto/              # Data transfer objects (9 DTO files)
├── mapper/           # Entity-to-DTO mapping
├── parser/           # Infrastructure parsers (5 parsers + factory)
├── graph/            # Graph + Diff engines
├── risk/             # Risk assessment engine
├── cost/             # Cost analysis engine
├── security/         # Security analysis engine
├── compliance/       # Compliance framework engine
├── rule/             # Configurable rule engine
├── config/           # Spring configuration (5 config classes)
├── exception/        # Global exception handling
└── util/             # Utilities (Hash, JSON)

frontend/
├── app/              # Next.js App Router pages (15 routes)
├── components/       # React components (15 components)
├── hooks/            # Custom React hooks (7 hooks)
├── lib/              # Utilities (API client, auth, validation)
├── types/            # TypeScript interfaces
└── __tests__/        # Frontend tests

Getting Started

Prerequisites

Java 21 (required for Gradle build)
Node.js 18+ and npm
PostgreSQL 14+ (local or cloud like Neon)

Database Setup

Option A: Local PostgreSQL

# Create the database and user
psql -U postgres -c "CREATE DATABASE infradiff;"
psql -U postgres -c "CREATE USER infradiff WITH PASSWORD 'infradiff';"
psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE infradiff TO infradiff;"
psql -U postgres -d infradiff -c "GRANT ALL ON SCHEMA public TO infradiff;"

Option B: Neon PostgreSQL (cloud)

Create a free account at neon.tech
Create a new project
Copy the connection string

Environment Variables

Create backend/src/main/resources/application-local.yml:

spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/infradiff
    username: infradiff
    password: infradiff

infradiff:
  jwt:
    secret: your-secret-key-must-be-at-least-256-bits-long-for-hmac-sha256

Or set environment variables:

export DATABASE_URL=postgresql://localhost:5432/infradiff
export JWT_SECRET=your-secret-key-must-be-at-least-256-bits-long

Optional: OAuth2 (GitHub/Google login)

export GITHUB_CLIENT_ID=your-github-client-id
export GITHUB_CLIENT_SECRET=your-github-client-secret
export GOOGLE_CLIENT_ID=your-google-client-id
export GOOGLE_CLIENT_SECRET=your-google-client-secret

Running Locally

Backend:

cd backend

# First time: build and run
./gradlew bootRun

# The API will be available at http://localhost:8080

Frontend:

cd frontend

# First time: install dependencies
npm install

# Start development server
npm run dev

# The app will be available at http://localhost:3000

Verify It Works

Open http://localhost:3000 in your browser
Register a new account
Create a project
Add a repository
Upload an infrastructure file
Run a diff analysis
View the results

API Documentation

Once the backend is running, access Swagger UI at:

http://localhost:8080/swagger-ui.html

Key Endpoints

Method	Endpoint	Description
POST	`/api/auth/register`	Register a new user
POST	`/api/auth/login`	Login and get JWT
GET	`/api/auth/me`	Get current user
GET	`/api/projects`	List projects
POST	`/api/projects`	Create project
GET	`/api/projects/{id}`	Get project
PUT	`/api/projects/{id}`	Update project
DELETE	`/api/projects/{id}`	Delete project
GET	`/api/projects/{id}/repositories`	List repositories
POST	`/api/projects/{id}/repositories`	Create repository
POST	`/api/repositories/{id}/versions`	Upload version
GET	`/api/repositories/{id}/versions`	List versions
GET	`/api/repositories/{id}/versions/{vid}/resources`	Get resources
GET	`/api/repositories/{id}/versions/{vid}/search?query=`	Search resources
POST	`/api/diffs`	Create diff analysis
GET	`/api/diffs/{id}`	Get diff report
GET	`/api/risk/{diffVersionId}`	Get risk report
GET	`/api/cost/{diffVersionId}`	Get cost report
GET	`/api/security/{diffVersionId}`	Get security report
GET	`/api/graph/version/{id}`	Get dependency graph
GET	`/api/graph/version/{id}/blast-radius?resourceId=`	Calculate blast radius
GET	`/api/graph/timeline/{repositoryId}`	Get timeline
POST	`/api/reports/export`	Export report (MD/HTML/JSON)
GET	`/api/reports/pull-request/{diffVersionId}`	Generate PR review
GET	`/api/rules`	List compliance rules
GET	`/api/compliance/frameworks`	List compliance frameworks
GET	`/api/audit`	List audit logs

Testing

Run All Tests

# Backend tests (115 tests)
cd backend
export JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home
./gradlew test

# Frontend tests (50 tests)
cd frontend
npm test

Test Coverage

Area	Tests	What's Covered
DiffEngine	13	Add/remove/modify detection, semantic changes, summary, categorization
RiskEngine	14	All 8 risk rules, score capping, downtime estimation
CostAnalyzer	12	EC2/RDS/S3/NAT costs, increase/decrease detection, breakdown
SecurityAnalyzer	17	All 11 security checks, scoring, recommendations, MFA
GraphEngine	11	Graph building, root/leaf identification, blast radius, impact
TerraformParser	8	Format detection, resource extraction, dependencies, providers
KubernetesParser	8	Deployments, Services, multi-document, labels
CloudFormationParser	5	S3, EC2, format detection, invalid content
PulumiParser	4	S3 bucket, JSON parsing, provider detection
HelmParser	8	Chart metadata, dependencies, templates, sub-charts
GraphService	5	Graph building, timeline, empty states, merging
AuditLogService	7	Log creation, filtering, user association
Utils	20	cn, formatCurrency, formatNumber, formatDate, truncate
Types	12	TypeScript interface conformance
API Client	8	Method existence for all API modules
Total	165

Project Structure

InfraDiff/
├── backend/
│   ├── build.gradle.kts          # Build configuration
│   ├── settings.gradle.kts       # Project settings
│   ├── gradlew                   # Gradle wrapper
│   └── src/
│       ├── main/
│       │   ├── java/com/infradiff/
│       │   │   ├── InfraDiffApplication.kt
│       │   │   ├── config/       # Security, Cache, CORS, Jackson, OpenAPI
│       │   │   ├── controller/   # Auth, Project, Repository, Infrastructure,
│       │   │   │                 # Diff, Graph, Report, Audit, Compliance, RuleEngine,
│       │   │   │                 # Risk, Cost, Security
│       │   │   ├── dto/          # Auth, Project, Infrastructure, Diff, Graph,
│       │   │   │                 # Risk, Cost, Security, Report
│       │   │   ├── entity/       # User, Project, Repository, InfrastructureVersion,
│       │   │   │                 # Resource, Dependency, DiffVersion, RiskReport,
│       │   │   │                 # CostReport, SecurityReport, AuditLog
│       │   │   ├── exception/    # GlobalExceptionHandler
│       │   │   ├── mapper/       # EntityMapper
│       │   │   ├── parser/       # Terraform, Kubernetes, Helm, CloudFormation,
│       │   │   │                 # Pulumi, ParserFactory, InfrastructureParser
│       │   │   ├── graph/        # GraphEngine, DiffEngine
│       │   │   ├── risk/         # RiskEngine (8 risk factors)
│       │   │   ├── cost/         # CostAnalyzer (11 resource types)
│       │   │   ├── security/     # SecurityAnalyzer (11 checks)
│       │   │   ├── compliance/   # ComplianceEngine (3 frameworks)
│       │   │   ├── rule/         # RuleEngine (10 rules)
│       │   │   ├── repository/   # 10 JPA repositories
│       │   │   ├── security/     # JWT, OAuth2, CustomUserDetailsService
│       │   │   ├── service/      # 8 services
│       │   │   └── util/         # HashUtils, JsonUtils
│       │   └── resources/
│       │       ├── application.yml
│       │       ├── application-local.yml
│       │       ├── application-production.yml
│       │       └── db/migration/V1__init_schema.sql
│       └── test/                 # 115 backend tests
│
├── frontend/
│   ├── package.json
│   ├── next.config.ts
│   ├── vitest.config.ts
│   └── src/
│       ├── app/                  # 15 page routes
│       │   ├── auth/             # login, register, callback
│       │   ├── dashboard/
│       │   ├── projects/         # list, [id] detail
│       │   ├── repositories/     # [id], [id]/versions/[versionId]
│       │   ├── diff/             # new, [id] report
│       │   ├── graph/
│       │   ├── timeline/
│       │   ├── search/
│       │   ├── security/
│       │   ├── reports/
│       │   └── settings/
│       ├── components/
│       │   ├── layout/           # DashboardLayout, Sidebar, Header
│       │   ├── ui/               # shadcn/ui primitives
│       │   ├── graph/            # DependencyGraphView, BlastRadiusPanel
│       │   └── charts/           # CostBreakdownChart, RiskDistributionChart
│       ├── hooks/                # useProjects, useRepositories, useVersions,
│       │                         # useDiff, useGraph, useKeyboardShortcuts
│       ├── lib/                  # api.ts, auth-context, utils, validations
│       ├── types/                # TypeScript interfaces
│       └── __tests__/            # 50 frontend tests
│
└── README.md

Supported Formats

Format	Detection	Resources Extracted
Terraform HCL	`resource "..." "..." {` blocks	Resources, nested config, tags, dependencies
Kubernetes YAML	`apiVersion:` + `kind:` + `metadata:`	Deployments, Services, ConfigMaps, etc.
Helm Chart	`apiVersion: v2` + `chart:` or `appVersion:`	Chart metadata, sub-charts, templates
CloudFormation	`AWSTemplateFormatVersion:` or `AWS::` resources	Resources, DependsOn, Properties
Pulumi	`Resources:` with `Type:` fields	Resources with provider detection

Deployment

Frontend (Vercel)

# Push to GitHub, then connect to Vercel
# Set environment variable:
NEXT_PUBLIC_API_URL=https://your-backend-url.railway.app

Backend (Railway)

# Push to GitHub, then connect to Railway
# Set environment variables:
DATABASE_URL=postgresql://user:pass@host:5432/dbname
JWT_SECRET=your-production-secret
GITHUB_CLIENT_ID=...
GITHUB_CLIENT_SECRET=...
GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...

Database (Neon)

Create a Neon project at neon.tech
Copy the connection string
Set as DATABASE_URL in Railway
Flyway auto-runs migrations on first boot

Keyboard Shortcuts

Shortcut	Action
`g` then `d`	Go to Dashboard
`g` then `p`	Go to Projects
`g` then `g`	Go to Graph
`g` then `t`	Go to Timeline
`g` then `r`	Go to Reports
`g` then `s`	Go to Security
`g` then `/`	Go to Search
`g` then `,`	Go to Settings
`n` then `d`	New Diff
`n` then `p`	New Project

License

MIT

Name		Name	Last commit message	Last commit date
Latest commit History 25 Commits
backend		backend
frontend		frontend
.gitignore		.gitignore
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

InfraDiff

Table of Contents

Features

Core Analysis

Parsers

UI Features

Tech Stack

Backend

Frontend

Architecture

Getting Started

Prerequisites

Database Setup

Environment Variables

Running Locally

Verify It Works

API Documentation

Key Endpoints

Testing

Run All Tests

Test Coverage

Project Structure

Supported Formats

Deployment

Frontend (Vercel)

Backend (Railway)

Database (Neon)

Keyboard Shortcuts

License

About

Contributors

Languages

Folders and files

Latest commit

History

Repository files navigation

InfraDiff

Table of Contents

Features

Core Analysis

Parsers

UI Features

Tech Stack

Backend

Frontend

Architecture

Getting Started

Prerequisites

Database Setup

Environment Variables

Running Locally

Verify It Works

API Documentation

Key Endpoints

Testing

Run All Tests

Test Coverage

Project Structure

Supported Formats

Deployment

Frontend (Vercel)

Backend (Railway)

Database (Neon)

Keyboard Shortcuts

License

About

Topics

Resources

Stars

Watchers

Forks

Contributors

Languages