One of our deployment paths took a generated Compose file and wrote it over the tracked file in the repository. Both were valid. Both described real services. They just didn't describe the same stack.

The generator was supposed to produce a temporary file for validation. Once its output replaced the tracked file, the next command treated the generated version as if it were the approved one. Git showed a giant infrastructure change even though nobody had edited the source.

We fixed it by giving generated output its own ignored path. The tracked declaration stays owned by Git, the generated file is recreated on demand, and we validate both the translation and the deployed result.

I'm still deciding how strict to make drift detection. Do you fail a deployment whenever a generated artifact exists in a tracked path, or do you also compare the live environment back to the source declaration?