V.A.L.I.D.

V.A.L.I.D. — Verification and Analysis Layer for Infrastructure Diffs

V.A.L.I.D. is a GitHub Action that reviews AWS Terraform pull requests and turns scanner findings into a clear PR verdict and a practical fix plan.

How it works

Checkov plus custom literal-HCL rules scan the Terraform source.
Findings are normalized and passed to a deterministic risk engine that issues PASS / REVIEW / HIGH RISK / INCOMPLETE verdicts and exit codes.
A bounded AI explanation step calls an NVIDIA Nemotron model (nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B) through the Nebius Token Factory inference API (OpenAI-compatible), producing evidence-linked impact explanations and proposed review actions.
Results are published as a sticky PR comment, a job summary, and downloadable artifacts (verdict, fix plan, and detector evidence with stable evidence IDs).

The deterministic engine — not the AI — owns the findings, verdicts, and exit codes. Generated advice is labeled as AI-generated so reviewers can tell what the model produced.

Live demo evidence

The working demonstration is PR #5 (https://github.com/Mukeshkr-19/V.A.L.I.D/pull/5), kept open as demo evidence: a risky-to-fixed review where the risky input produced HIGH RISK (exit 1) and the fixed input produced REVIEW (exit 0), with generated advice tied to detector evidence. Both live calls returned HTTP 200 from the exact requested model through Nebius Token Factory.

Honest limits

Static Terraform analysis only; no infrastructure is deployed.
No automatic remediation: the tool cannot change code, merge a PR, or deploy anything — it proposes actions for a human reviewer.
AI-generated advice requires human review; advice-source labels distinguish AI-generated advice from basic deterministic guidance.