Skip to content
AletheiaAletheiaAletheia docs

Repositories and IaC projects

A repository is what you connected. An IaC project is a single Terraform or OpenTofu root inside it — one directory with its own state. A monorepo with ten roots is one repository and ten IaC projects.

The distinction matters because state, plans, and mapping all attach to the root, not to the repository.

Detection

Section titled “Detection”

After a repository is selected, Aletheia scans it for infrastructure-as-code roots. A directory is a root when it declares Terraform or OpenTofu configuration of its own rather than being a module consumed by something else.

Where a root declares an S3 backend, Aletheia records that too — it is the strongest hint about which state source belongs to that project.

Detection re-runs when the default branch changes, and you can trigger a rescan by hand from the repository page (/repositories).

What a repository records

Section titled “What a repository records”
  • The IaC projects found in it, each with its path.
  • CODEOWNERS, parsed into ownership rules Aletheia can attribute code to.
  • Pull requests that touch infrastructure code, with the projects they affect.
  • The last indexed commit, so you can tell how current the picture is.

What an IaC project records

Section titled “What an IaC project records”
  • Its path within the repository, and its workspace where one applies.
  • The state source it reads, once designated.
  • How many of the resources in that state Aletheia matched to live resources, and which state entries it could not match.

The matched proportion is the useful number. A project at 100% means every resource its state claims was found in AWS. Anything lower has a reason, and the project page lists the unmatched entries so you can see which.

Associating repositories with applications

Section titled “Associating repositories with applications”

A repository can be associated with the applications it deploys. This is a declaration, not an inference: you are stating that this code produces that application. Associations feed the application pages, so a change to the code shows up against the thing it affects.

Automation grants

Section titled “Automation grants”

Automation is granted per repository, not per organization. A repository with no grant is read and indexed but is not eligible for any automation, now or later.

In the shipped product this is a preparatory control — nothing writes to your repositories yet. Setting it now means the boundary exists before anything could use it.

Where to go next

Section titled “Where to go next”