From 57a878340270988e79d3e3da675153aba1b9cb84 Mon Sep 17 00:00:00 2001
From: Michael Tarassov <michael@tarassov.me>
Date: Sun, 26 Jul 2026 04:59:30 +0800
Subject: [PATCH] fix: reject non-plan input, report unknown costs instead of
 guessing, expose Action outputs

The tool could report a confidently wrong number, and the Action exposed
nothing to the calling workflow. Six confirmed defects:

- Any valid JSON parsed as a plan. Feeding it `terraform show -json` of
  *state*, or a truncated artifact download, rendered a reassuring
  '$0.00/mo - No cost-relevant changes detected' comment and exited 0.
  Plan documents are now validated and bad input exits 2 with a message
  naming the likely cause.

- Unknown prices became invented numbers. An unrecognised instance_type
  fell back to a guessed $0.05/hr, so an m5.24xlarge (~$3,363/mo) was
  reported as $36.50/mo and passed a --threshold 100 gate. An attribute
  not known until apply (Terraform writes null) became $0.00 silently.
  Estimators now return None for unknown; such resources are listed in a
  'Cost unknown' table, excluded from the total, and the headline is
  marked (partial).

- NaN/Infinity in a price sheet disabled the threshold gate. json.load
  accepts them, every comparison against NaN is False, so the run exited
  0 while rendering '$nan'. Non-finite JSON constants and non-finite
  --threshold values are now rejected.

- A hostile for_each key broke out of the Markdown table. A backtick
  closed the code span, letting '<!--' comment out every row below it;
  pipes forged columns and newlines split the table. Cells are now
  sanitised.

- Comments over GitHub's 65536-char limit were rejected with HTTP 422 and
  a traceback, posting nothing on exactly the large plans people most
  want reviewed. The body is now fitted, keeping the biggest deltas.

- action.yml declared no outputs:, so nothing the tool computed was
  readable by the workflow, and working-directory: ${{ github.action_path }}
  made the documented relative 'plan: plan.json' resolve inside the action
  checkout rather than the workspace - the action could not work as
  documented. Eight outputs are now declared and written before the
  threshold gate; inputs reach the script via env: instead of being
  interpolated into it.

Also: paginate the sticky-comment search (a PR with >100 comments got a
duplicate comment every run), add a 30s API timeout, treat comment
posting as best effort so fork PRs with a read-only token still gate, and
round money to cents so table rows add up to the headline total.

Tests go 6 -> 46, including action.yml/CLI contract tests that fail if the
outputs drift apart again. Each fix was verified to fail its test when
reverted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml |   4 +-
 README.md                |  61 ++++++++++++++-
 action.yml               |  59 +++++++++++---
 pyproject.toml           |   5 +-
 tests/test_action.py     |  65 ++++++++++++++++
 tests/test_cli.py        | 162 +++++++++++++++++++++++++++++++++++++++
 tests/test_plan.py       | 127 +++++++++++++++++++++++++++++-
 tests/test_report.py     | 103 +++++++++++++++++++++++++
 tf_cost_diff/__init__.py |  61 ++++++++++++++-
 tf_cost_diff/__main__.py | 100 +++++++++++++++++++++---
 tf_cost_diff/github.py   |  71 ++++++++++++++---
 tf_cost_diff/plan.py     | 148 +++++++++++++++++++++++++++++------
 tf_cost_diff/pricing.py  | 149 ++++++++++++++++++++++++-----------
 tf_cost_diff/report.py   | 129 +++++++++++++++++++++++++++----
 14 files changed, 1124 insertions(+), 120 deletions(-)
 create mode 100644 tests/test_action.py
 create mode 100644 tests/test_cli.py
 create mode 100644 tests/test_report.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d72feb..3ec0ae9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-      - run: pip install -e . pytest
+      - run: pip install -e '.[dev]'
       - run: pytest
diff --git a/README.md b/README.md
index e42fe7b..738c261 100644
--- a/README.md
+++ b/README.md
@@ -13,8 +13,11 @@ pull request. Optionally fails the check when the delta crosses a threshold.
 ## How it works
 
 1. Parses `terraform show -json <plan>` into create / update / destroy sets.
+   Input that is not plan JSON — state output, a truncated download — is
+   **rejected**, never reported as "no changes".
 2. Prices cost-relevant resources with a small built-in AWS sheet (override with
-   your own JSON via `--price-sheet`).
+   your own JSON via `--price-sheet`). A resource whose cost cannot be
+   determined is reported as **unknown**, never counted as $0.
 3. Renders a Markdown table and upserts one sticky PR comment.
 
 ## CLI
@@ -53,12 +56,61 @@ steps:
       terraform plan -out tf.plan
       terraform show -json tf.plan > plan.json
   - uses: moveeeax/tf-cost-diff@v0
+    id: cost
     with:
-      plan: plan.json
+      plan: plan.json       # relative to the workspace
       threshold: "100"      # optional: fail if Δ > $100/mo
       # price-sheet: prices.json   # optional override
 ```
 
+### Outputs
+
+Every figure the tool computes is readable by later steps. They are written
+*before* the threshold gate is applied, so they are still available on the run
+where the gate fails — use `if: always()` to read them there.
+
+| Output | Example | Meaning |
+| --- | --- | --- |
+| `total-delta` | `97.96` | Monthly delta in dollars (negative when the plan saves money). |
+| `created` / `updated` / `destroyed` | `2` / `1` / `1` | Cost-relevant resource counts. |
+| `unpriced` | `0` | Resources excluded from the total because their cost is unknown. |
+| `complete` | `true` | `false` when `unpriced > 0`, i.e. the total is a partial figure. |
+| `threshold-exceeded` | `false` | Whether the delta crossed `threshold`. |
+| `comment-url` | `https://github.com/...` | The sticky comment, empty if none was posted. |
+
+```yaml
+  - if: always() && steps.cost.outputs.complete == 'false'
+    run: echo "::warning::${{ steps.cost.outputs.unpriced }} resources could not be priced"
+```
+
+### Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Success. |
+| `1` | The delta exceeded `--threshold`. |
+| `2` | Bad input: not a Terraform plan, unreadable file, or an invalid price sheet. |
+
+Posting the comment is best effort: a pull request from a fork gets a read-only
+`GITHUB_TOKEN`, so the comment is skipped with a warning rather than failing the
+run. The threshold gate still applies.
+
+## Unknown costs
+
+The built-in sheet covers a handful of resource types and a handful of instance
+sizes within them. Anything outside that is treated as **unknown**, not free:
+
+- A resource type with no price model (IAM roles, security groups) is excluded
+  from the estimate silently — the comment carries a standing caveat.
+- A *modelled* type the sheet cannot price for this configuration — an
+  unrecognised `instance_type`, or a size that is not known until apply — is
+  listed in a separate "Cost unknown" table, excluded from the total, and the
+  headline is marked `(partial)`.
+
+This matters for the threshold gate: guessing a rate for an unrecognised
+`m5.24xlarge` would report ~$36/mo for a resource that really costs over
+$3,000/mo, and it would sail straight through `threshold: 100`.
+
 ## Price sheet override
 
 `--price-sheet prices.json` where the file maps a Terraform resource type to a
@@ -71,12 +123,13 @@ flat monthly price:
 }
 ```
 
-Anything not in the built-in sheet or your override is treated as $0 and skipped.
+Values must be finite, non-negative numbers; anything else is rejected with exit
+code `2` rather than silently producing a nonsense total.
 
 ## Development
 
 ```bash
-pip install -e . pytest
+pip install -e '.[dev]'
 pytest
 ```
 
diff --git a/action.yml b/action.yml
index eb577c1..80a6001 100644
--- a/action.yml
+++ b/action.yml
@@ -5,29 +5,70 @@ branding:
   color: "green"
 inputs:
   plan:
-    description: "Path to `terraform show -json` output (a JSON file)."
+    description: "Path to `terraform show -json` output (a JSON file), relative to the workspace."
     required: true
   threshold:
     description: "Fail the check when the monthly delta exceeds this many dollars."
     required: false
   price-sheet:
-    description: "Optional path to a JSON price-sheet override."
+    description: "Optional path to a JSON price-sheet override, relative to the workspace."
     required: false
   github-token:
     description: "Token used to post the PR comment."
     required: false
     default: ${{ github.token }}
+outputs:
+  total-delta:
+    description: "Estimated monthly cost delta in dollars, e.g. `-12.40`."
+    value: ${{ steps.cost.outputs.total-delta }}
+  created:
+    description: "Number of cost-relevant resources being created."
+    value: ${{ steps.cost.outputs.created }}
+  updated:
+    description: "Number of cost-relevant resources being changed or replaced."
+    value: ${{ steps.cost.outputs.updated }}
+  destroyed:
+    description: "Number of cost-relevant resources being destroyed."
+    value: ${{ steps.cost.outputs.destroyed }}
+  unpriced:
+    description: "Number of resources excluded from the total because their cost is unknown."
+    value: ${{ steps.cost.outputs.unpriced }}
+  complete:
+    description: "`true` when every cost-relevant resource could be priced."
+    value: ${{ steps.cost.outputs.complete }}
+  threshold-exceeded:
+    description: "`true` when the delta exceeded `threshold`."
+    value: ${{ steps.cost.outputs.threshold-exceeded }}
+  comment-url:
+    description: "URL of the sticky pull request comment, empty if none was posted."
+    value: ${{ steps.cost.outputs.comment-url }}
 runs:
   using: "composite"
   steps:
-    - shell: bash
+    - id: cost
+      shell: bash
+      # Inputs are passed through the environment rather than interpolated into
+      # the script, so a value containing shell metacharacters cannot execute.
+      # PYTHONPATH (not working-directory) makes the package importable, so that
+      # `plan` stays relative to the caller's workspace as documented.
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
         GITHUB_REPOSITORY: ${{ github.repository }}
+        PYTHONPATH: ${{ github.action_path }}
+        TFCD_PLAN: ${{ inputs.plan }}
+        TFCD_PRICE_SHEET: ${{ inputs.price-sheet }}
+        TFCD_THRESHOLD: ${{ inputs.threshold }}
+        TFCD_PR: ${{ github.event.pull_request.number }}
       run: |
-        python3 -m tf_cost_diff \
-          --plan "${{ inputs.plan }}" \
-          ${{ inputs.price-sheet && format('--price-sheet {0}', inputs.price-sheet) || '' }} \
-          ${{ inputs.threshold && format('--threshold {0}', inputs.threshold) || '' }} \
-          ${{ github.event.pull_request.number && format('--pr {0}', github.event.pull_request.number) || '' }}
-      working-directory: ${{ github.action_path }}
+        set -euo pipefail
+        args=(--plan "$TFCD_PLAN" --github-output "$GITHUB_OUTPUT")
+        if [ -n "${TFCD_PRICE_SHEET:-}" ]; then
+          args+=(--price-sheet "$TFCD_PRICE_SHEET")
+        fi
+        if [ -n "${TFCD_THRESHOLD:-}" ]; then
+          args+=(--threshold "$TFCD_THRESHOLD")
+        fi
+        if [ -n "${TFCD_PR:-}" ]; then
+          args+=(--pr "$TFCD_PR")
+        fi
+        python3 -m tf_cost_diff "${args[@]}"
diff --git a/pyproject.toml b/pyproject.toml
index 52fccdd..ce63f9c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tf-cost-diff"
-version = "0.1.0"
+version = "0.2.0"
 description = "Estimate the monthly cost delta of a Terraform plan and post it to a pull request."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -12,6 +12,9 @@ license = { text = "MIT" }
 authors = [{ name = "Michael Tarassov", email = "michael@tarassov.me" }]
 keywords = ["terraform", "finops", "cost", "github-actions", "aws"]
 
+[project.optional-dependencies]
+dev = ["pytest>=7", "pyyaml>=6"]
+
 [project.urls]
 Homepage = "https://github.com/moveeeax/tf-cost-diff"
 
diff --git a/tests/test_action.py b/tests/test_action.py
new file mode 100644
index 0000000..9df8056
--- /dev/null
+++ b/tests/test_action.py
@@ -0,0 +1,65 @@
+"""Keep action.yml honest about what the CLI actually produces.
+
+The failure mode this guards against is drift: the tool computes numbers, the
+Action declares no `outputs:` for them, and the calling workflow silently has
+nothing to read.
+"""
+import pathlib
+
+import pytest
+
+yaml = pytest.importorskip("yaml")
+
+ACTION = pathlib.Path(__file__).resolve().parent.parent / "action.yml"
+
+
+@pytest.fixture(scope="module")
+def action():
+    return yaml.safe_load(ACTION.read_text(encoding="utf-8"))
+
+
+def _cli_output_names(tmp_path):
+    from tf_cost_diff.__main__ import write_github_output
+    from tf_cost_diff.plan import PlanSummary
+
+    out = tmp_path / "gh-output"
+    write_github_output(str(out), PlanSummary(resources=[]), False, "")
+    return {line.split("=", 1)[0] for line in out.read_text().splitlines()}
+
+
+def test_action_declares_every_output_the_cli_writes(action, tmp_path):
+    declared = set(action.get("outputs") or {})
+    assert declared == _cli_output_names(tmp_path)
+
+
+def test_every_declared_output_is_wired_to_the_step(action):
+    step_ids = {s.get("id") for s in action["runs"]["steps"]}
+    for name, spec in action["outputs"].items():
+        assert spec.get("description"), f"output {name} has no description"
+        value = spec["value"]
+        step = value.split("steps.", 1)[1].split(".", 1)[0]
+        assert step in step_ids, f"output {name} references unknown step {step}"
+        assert value.endswith(f"outputs.{name} }}}}"), f"output {name} is mis-wired"
+
+
+def test_inputs_are_passed_through_env_not_interpolated_into_the_script(action):
+    """`run:` must not interpolate inputs, or a crafted value runs as shell."""
+    for step in action["runs"]["steps"]:
+        assert "${{" not in step.get("run", ""), "inputs must reach the script via env:"
+
+
+def test_plan_path_is_resolved_against_the_workspace(action):
+    # working-directory: ${{ github.action_path }} would make the documented
+    # relative `plan: plan.json` resolve inside the action checkout instead.
+    for step in action["runs"]["steps"]:
+        assert "working-directory" not in step
+    assert "PYTHONPATH" in action["runs"]["steps"][0]["env"]
+
+
+def test_declared_inputs_are_all_consumed(action):
+    script = "".join(s.get("run", "") for s in action["runs"]["steps"])
+    env = {k: str(v) for s in action["runs"]["steps"] for k, v in (s.get("env") or {}).items()}
+    for name in action["inputs"]:
+        referenced = any(f"inputs.{name}" in value for value in env.values())
+        assert referenced, f"input {name} is declared but never used"
+    assert "--plan" in script
diff --git a/tests/test_cli.py b/tests/test_cli.py
new file mode 100644
index 0000000..d9ef241
--- /dev/null
+++ b/tests/test_cli.py
@@ -0,0 +1,162 @@
+"""End-to-end CLI behaviour: exit codes, the threshold gate, Action outputs."""
+import json
+
+import pytest
+
+from tf_cost_diff import CostDiffError
+from tf_cost_diff.__main__ import EXIT_ERROR, EXIT_OK, EXIT_OVER_THRESHOLD, main
+from tf_cost_diff.pricing import PriceSheet
+
+PLAN = {
+    "format_version": "1.2",
+    "resource_changes": [
+        {
+            "address": "aws_instance.web",
+            "type": "aws_instance",
+            "change": {
+                "actions": ["create"],
+                "before": None,
+                "after": {"instance_type": "m5.large"},
+            },
+        }
+    ],
+}
+
+
+def _write(tmp_path, name, payload):
+    path = tmp_path / name
+    path.write_text(payload if isinstance(payload, str) else json.dumps(payload))
+    return str(path)
+
+
+def test_under_threshold_exits_zero(tmp_path, capsys):
+    plan = _write(tmp_path, "plan.json", PLAN)
+    assert main(["--plan", plan, "--threshold", "1000"]) == EXIT_OK
+
+
+def test_over_threshold_exits_one(tmp_path, capsys):
+    plan = _write(tmp_path, "plan.json", PLAN)
+    assert main(["--plan", plan, "--threshold", "10"]) == EXIT_OVER_THRESHOLD
+    assert "exceeds threshold" in capsys.readouterr().err
+
+
+def test_state_output_fails_loudly_instead_of_reporting_no_changes(tmp_path, capsys):
+    state = _write(
+        tmp_path,
+        "state.json",
+        {"format_version": "1.0", "values": {"root_module": {"resources": []}}},
+    )
+    assert main(["--plan", state, "--threshold", "10"]) == EXIT_ERROR
+    err = capsys.readouterr().err
+    assert "::error::" in err and "state" in err
+
+
+def test_truncated_plan_fails_with_a_message_not_a_traceback(tmp_path, capsys):
+    plan = _write(tmp_path, "plan.json", '{"resource_changes":[{"addre')
+    assert main(["--plan", plan]) == EXIT_ERROR
+    assert "not valid JSON" in capsys.readouterr().err
+
+
+def test_missing_plan_file_is_reported_cleanly(tmp_path, capsys):
+    assert main(["--plan", str(tmp_path / "nope.json")]) == EXIT_ERROR
+    assert "not found" in capsys.readouterr().err
+
+
+def test_nan_price_sheet_is_rejected_rather_than_disabling_the_gate(tmp_path, capsys):
+    plan = _write(tmp_path, "plan.json", PLAN)
+    sheet = _write(tmp_path, "prices.json", '{"aws_instance": NaN}')
+    # Previously this produced "$nan" and quietly returned 0 from the gate.
+    assert main(["--plan", plan, "--price-sheet", sheet, "--threshold", "1"]) == EXIT_ERROR
+    assert "non-finite" in capsys.readouterr().err
+
+
+def test_nan_threshold_is_rejected(tmp_path):
+    plan = _write(tmp_path, "plan.json", PLAN)
+    with pytest.raises(SystemExit):
+        main(["--plan", plan, "--threshold", "nan"])
+
+
+def test_negative_price_in_sheet_is_rejected(tmp_path):
+    sheet = _write(tmp_path, "prices.json", {"aws_instance": -5})
+    with pytest.raises(CostDiffError, match="negative"):
+        PriceSheet.load(sheet)
+
+
+def test_non_numeric_price_is_rejected(tmp_path):
+    sheet = _write(tmp_path, "prices.json", {"aws_instance": "cheap"})
+    with pytest.raises(CostDiffError, match="finite number"):
+        PriceSheet.load(sheet)
+
+
+def test_github_output_is_written(tmp_path):
+    plan = _write(tmp_path, "plan.json", PLAN)
+    out = tmp_path / "gh-output"
+    assert main(["--plan", plan, "--threshold", "10", "--github-output", str(out)]) == (
+        EXIT_OVER_THRESHOLD
+    )
+    values = dict(line.split("=", 1) for line in out.read_text().splitlines())
+    assert values == {
+        "total-delta": "70.08",
+        "created": "1",
+        "updated": "0",
+        "destroyed": "0",
+        "unpriced": "0",
+        "complete": "true",
+        # Written even though the gate failed on this same run.
+        "threshold-exceeded": "true",
+        "comment-url": "",
+    }
+
+
+def test_github_output_reports_unpriced_resources(tmp_path):
+    plan = _write(
+        tmp_path,
+        "plan.json",
+        {
+            "resource_changes": [
+                {
+                    "address": "aws_instance.big",
+                    "type": "aws_instance",
+                    "change": {
+                        "actions": ["create"],
+                        "after": {"instance_type": "m5.24xlarge"},
+                    },
+                }
+            ]
+        },
+    )
+    out = tmp_path / "gh-output"
+    assert main(["--plan", plan, "--github-output", str(out)]) == EXIT_OK
+    values = dict(line.split("=", 1) for line in out.read_text().splitlines())
+    assert values["unpriced"] == "1"
+    assert values["complete"] == "false"
+
+
+def test_pr_without_token_warns_and_does_not_crash(tmp_path, capsys, monkeypatch):
+    monkeypatch.delenv("GITHUB_TOKEN", raising=False)
+    monkeypatch.delenv("GITHUB_REPOSITORY", raising=False)
+    plan = _write(tmp_path, "plan.json", PLAN)
+    assert main(["--plan", plan, "--pr", "7"]) == EXIT_OK
+    assert "::warning::" in capsys.readouterr().err
+
+
+def test_failure_to_comment_does_not_mask_the_threshold_verdict(
+    tmp_path, capsys, monkeypatch
+):
+    def boom(*_args, **_kwargs):
+        raise CostDiffError("HTTP 403")
+
+    monkeypatch.setattr("tf_cost_diff.__main__.upsert_comment", boom)
+    plan = _write(tmp_path, "plan.json", PLAN)
+    code = main(
+        ["--plan", plan, "--pr", "7", "--repo", "o/n", "--token", "t", "--threshold", "10"]
+    )
+    assert code == EXIT_OVER_THRESHOLD
+    err = capsys.readouterr().err
+    assert "could not post the PR comment" in err
+    assert "exceeds threshold" in err
+
+
+def test_bundled_example_plan_parses(capsys):
+    assert main(["--plan", "examples/plan.json"]) == EXIT_OK
+    assert "Terraform monthly cost estimate" in capsys.readouterr().out
diff --git a/tests/test_plan.py b/tests/test_plan.py
index 23bd805..6c22d27 100644
--- a/tests/test_plan.py
+++ b/tests/test_plan.py
@@ -1,4 +1,7 @@
-from tf_cost_diff.plan import parse_plan
+import pytest
+
+from tf_cost_diff import CostDiffError
+from tf_cost_diff.plan import parse_plan, validate_plan_document
 from tf_cost_diff.pricing import PriceSheet
 from tf_cost_diff.report import MARKER, render
 
@@ -62,6 +65,7 @@ def test_zero_cost_resources_are_skipped():
     plan = _plan(_change("aws_iam_role.r", "aws_iam_role", ["create"], after={}))
     summary = parse_plan(plan, PriceSheet())
     assert summary.resources == []
+    assert summary.unpriced == []
 
 
 def test_price_sheet_override_wins():
@@ -82,3 +86,124 @@ def test_render_contains_marker_and_total():
     assert MARKER in body
     assert "+$3.60/mo" in body
     assert "`aws_eip.nat`" in body
+
+
+def test_no_op_and_read_actions_are_ignored():
+    plan = _plan(
+        _change("aws_eip.a", "aws_eip", ["no-op"], before={}, after={}),
+        _change("aws_eip.b", "aws_eip", ["read"], after={}),
+    )
+    summary = parse_plan(plan, PriceSheet())
+    assert summary.resources == []
+    assert summary.created == 0
+
+
+def test_rows_sum_to_the_headline_total():
+    plan = _plan(
+        _change("aws_eip.a", "aws_eip", ["create"], after={}),
+        _change("aws_eip.b", "aws_eip", ["create"], after={}),
+        _change("aws_ebs_volume.c", "aws_ebs_volume", ["create"], after={"size": 33}),
+    )
+    summary = parse_plan(plan, PriceSheet())
+    assert summary.total_delta == round(sum(r.delta for r in summary.resources), 2)
+    assert summary.total_delta == 9.84
+
+
+# --- input validation: not every valid JSON document is a Terraform plan -----
+
+
+def test_state_output_is_rejected_not_reported_as_no_changes():
+    state = {
+        "format_version": "1.0",
+        "terraform_version": "1.9.0",
+        "values": {"root_module": {"resources": []}},
+    }
+    with pytest.raises(CostDiffError, match="state"):
+        validate_plan_document(state, "plan.json")
+
+
+def test_arbitrary_json_is_rejected():
+    with pytest.raises(CostDiffError, match="not a Terraform plan"):
+        validate_plan_document({"hello": "world"}, "plan.json")
+
+
+def test_non_object_json_is_rejected():
+    with pytest.raises(CostDiffError, match="JSON object"):
+        validate_plan_document([1, 2, 3], "plan.json")
+
+
+def test_empty_plan_with_no_changes_is_accepted():
+    doc = {"format_version": "1.2", "planned_values": {"root_module": {}}}
+    assert validate_plan_document(doc, "plan.json") is doc
+    assert parse_plan(doc, PriceSheet()).resources == []
+
+
+def test_resource_changes_must_be_a_list():
+    with pytest.raises(CostDiffError, match="must be a list"):
+        validate_plan_document({"resource_changes": {}}, "plan.json")
+
+
+def test_malformed_resource_change_raises_rather_than_costing_zero():
+    with pytest.raises(CostDiffError, match="change"):
+        parse_plan({"resource_changes": [{"address": "a", "type": "aws_eip"}]}, PriceSheet())
+
+
+# --- unknown prices are reported, never silently turned into a number -------
+
+
+def test_unknown_instance_type_is_unpriced_not_guessed():
+    plan = _plan(
+        _change(
+            "aws_instance.big",
+            "aws_instance",
+            ["create"],
+            after={"instance_type": "m5.24xlarge"},
+        )
+    )
+    summary = parse_plan(plan, PriceSheet())
+    assert summary.resources == []
+    assert [u.address for u in summary.unpriced] == ["aws_instance.big"]
+    assert summary.total_delta == 0.0
+    assert summary.is_complete is False
+    assert summary.created == 1
+
+
+def test_attribute_unknown_until_apply_is_unpriced_not_zero():
+    plan = _plan(
+        _change("aws_ebs_volume.d", "aws_ebs_volume", ["create"], after={"size": None}),
+        _change("aws_instance.w", "aws_instance", ["create"], after={"instance_type": None}),
+    )
+    summary = parse_plan(plan, PriceSheet())
+    assert len(summary.unpriced) == 2
+    assert summary.total_delta == 0.0
+
+
+def test_unpriced_resources_are_flagged_in_the_report():
+    plan = _plan(
+        _change(
+            "aws_db_instance.main",
+            "aws_db_instance",
+            ["create"],
+            after={"instance_class": "db.r5.24xlarge"},
+        )
+    )
+    body = render(parse_plan(plan, PriceSheet()))
+    assert "could not be priced" in body
+    assert "(partial)" in body
+    assert "`aws_db_instance.main`" in body
+
+
+def test_replace_with_unknown_after_side_is_unpriced():
+    plan = _plan(
+        _change(
+            "aws_instance.web",
+            "aws_instance",
+            ["create", "delete"],
+            before={"instance_type": "t3.small"},
+            after={"instance_type": "x9.enormous"},
+        )
+    )
+    summary = parse_plan(plan, PriceSheet())
+    assert summary.resources == []
+    assert len(summary.unpriced) == 1
+    assert summary.updated == 1
diff --git a/tests/test_report.py b/tests/test_report.py
new file mode 100644
index 0000000..16a2a9a
--- /dev/null
+++ b/tests/test_report.py
@@ -0,0 +1,103 @@
+"""The rendered comment must survive hostile resource addresses and big plans."""
+import re
+
+from tf_cost_diff.plan import PlanSummary, ResourceDelta, UnpricedResource
+from tf_cost_diff.report import COMMENT_LIMIT, MARKER, render
+
+
+def _delta(address, after=10.0, action="create"):
+    return ResourceDelta(
+        address=address,
+        resource_type="aws_eip",
+        action=action,
+        before_monthly=0.0,
+        after_monthly=after,
+    )
+
+
+def _outside_code_spans(body):
+    """The comment with every `code span` removed, i.e. what Markdown parses."""
+    return re.sub(r"`[^`\n]*`", "", body.replace(MARKER, ""))
+
+
+def test_backtick_in_for_each_key_cannot_close_the_code_span():
+    # `for_each` keys are arbitrary strings. A backtick that closes the span
+    # lets the rest be parsed as raw HTML, and a bare `<!--` would comment out
+    # -- and therefore hide -- every table row below it.
+    summary = PlanSummary(
+        resources=[_delta('aws_eip.e["x`</code><!--"]'), _delta("aws_eip.visible")]
+    )
+    body = render(summary)
+    rows = [line for line in body.splitlines() if line.startswith("| `")]
+    assert len(rows) == 2
+    assert "`aws_eip.visible`" in body
+    # Nothing the attacker supplied escaped its code span, so no markup of
+    # theirs reaches the Markdown parser.
+    assert "<" not in _outside_code_spans(body)
+    for row in rows:
+        assert row.count("`") == 2
+
+
+def test_pipe_in_address_cannot_forge_table_columns():
+    body = render(PlanSummary(resources=[_delta("aws_eip.e[\"a | b\"]")]))
+    row = next(line for line in body.splitlines() if line.startswith("| `"))
+    assert row.count("|") - row.count("\\|") == 6  # 5 cells => 6 unescaped pipes
+    assert "\\|" in row
+
+
+def test_newline_in_address_cannot_split_the_table():
+    body = render(PlanSummary(resources=[_delta('aws_eip.e["a\nb"]'), _delta("aws_eip.z")]))
+    rows = [line for line in body.splitlines() if line.startswith("| `")]
+    assert len(rows) == 2
+
+
+def test_absurdly_long_address_is_truncated():
+    body = render(PlanSummary(resources=[_delta("aws_eip.e" + "x" * 5000)]))
+    row = next(line for line in body.splitlines() if line.startswith("| `"))
+    assert len(row) < 300
+
+
+def test_empty_address_still_renders_valid_markdown():
+    body = render(PlanSummary(resources=[_delta("   ")]))
+    assert "`(unnamed)`" in body
+
+
+def test_huge_plan_is_truncated_to_fit_githubs_comment_limit():
+    # Ordered biggest-delta-first, as parse_plan() sorts them.
+    summary = PlanSummary(
+        resources=[
+            _delta(f"aws_eip.instance_number_{i}", after=float(i))
+            for i in range(5999, -1, -1)
+        ]
+    )
+    body = render(summary)
+    # Previously this was posted whole, GitHub answered HTTP 422, and the run
+    # ended with no comment at all.
+    assert len(body) <= COMMENT_LIMIT
+    assert "omitted to stay within GitHub's comment size limit" in body
+    # The headline total still counts every resource, and the biggest rows are
+    # the ones that survive.
+    assert f"{summary.total_delta:,.2f}" in body
+    assert "`aws_eip.instance_number_5999`" in body
+    assert "`aws_eip.instance_number_0`" not in body
+
+
+def test_small_plan_is_not_truncated():
+    body = render(PlanSummary(resources=[_delta("aws_eip.a")]))
+    assert "omitted" not in body
+
+
+def test_no_changes_message():
+    body = render(PlanSummary(resources=[]))
+    assert "_No cost-relevant changes detected._" in body
+    assert "(partial)" not in body
+
+
+def test_unpriced_only_plan_does_not_claim_no_changes():
+    summary = PlanSummary(
+        resources=[],
+        unpriced=[UnpricedResource("aws_instance.big", "aws_instance", "create", "why")],
+    )
+    body = render(summary)
+    assert "_No cost-relevant changes detected._" not in body
+    assert "could not be priced" in body
diff --git a/tf_cost_diff/__init__.py b/tf_cost_diff/__init__.py
index e5af7ab..a2b8a30 100644
--- a/tf_cost_diff/__init__.py
+++ b/tf_cost_diff/__init__.py
@@ -1,3 +1,62 @@
 """tf-cost-diff: estimate the monthly cost delta of a Terraform plan."""
+from __future__ import annotations
 
-__version__ = "0.1.0"
+import json
+import math
+from typing import Any
+
+__version__ = "0.2.0"
+
+__all__ = ["CostDiffError", "load_json_document", "finite", "__version__"]
+
+
+class CostDiffError(Exception):
+    """A user-facing error: bad input, unusable price sheet, failed API call.
+
+    Raised instead of letting a raw traceback escape, so the Action shows an
+    actionable message rather than a stack trace.
+    """
+
+
+def _reject_constant(token: str) -> float:
+    # json.load() accepts NaN/Infinity/-Infinity by default. A NaN price makes
+    # every comparison False, so the --threshold gate would silently pass while
+    # the comment rendered "$nan". Refuse the document instead.
+    raise CostDiffError(
+        f"refusing {token!r}: cost inputs must be finite numbers, "
+        "but this JSON contains a non-finite constant."
+    )
+
+
+def load_json_document(path: str, what: str) -> Any:
+    """Load a JSON file, rejecting non-finite numbers and unreadable files."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            return json.load(fh, parse_constant=_reject_constant)
+    except FileNotFoundError:
+        raise CostDiffError(f"{what} not found: {path}") from None
+    except IsADirectoryError:
+        raise CostDiffError(f"{what} is a directory, not a file: {path}") from None
+    except UnicodeDecodeError:
+        raise CostDiffError(
+            f"{what} {path} is not UTF-8 text. Did you pass the binary plan file "
+            "instead of `terraform show -json tf.plan > plan.json` output?"
+        ) from None
+    except json.JSONDecodeError as exc:
+        raise CostDiffError(
+            f"{what} {path} is not valid JSON ({exc}). A truncated download or an "
+            "empty file will look like this."
+        ) from None
+    except OSError as exc:
+        raise CostDiffError(f"could not read {what} {path}: {exc}") from None
+
+
+def finite(value: Any) -> float | None:
+    """Coerce to a finite float, or return None when that is not possible."""
+    if value is None or isinstance(value, bool):
+        return None
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return None
+    return number if math.isfinite(number) else None
diff --git a/tf_cost_diff/__main__.py b/tf_cost_diff/__main__.py
index e8f407f..6f68fd9 100644
--- a/tf_cost_diff/__main__.py
+++ b/tf_cost_diff/__main__.py
@@ -1,14 +1,32 @@
 from __future__ import annotations
 
 import argparse
+import math
 import os
 import sys
 
+from . import CostDiffError, __version__
 from .github import upsert_comment
-from .plan import load_plan, parse_plan
+from .plan import PlanSummary, load_plan, parse_plan
 from .pricing import PriceSheet
 from .report import render
 
+EXIT_OK = 0
+EXIT_OVER_THRESHOLD = 1
+EXIT_ERROR = 2
+
+
+def _threshold(raw: str) -> float:
+    try:
+        value = float(raw)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"{raw!r} is not a number") from None
+    if not math.isfinite(value):
+        # float("nan") parses happily, and every comparison against NaN is
+        # False, so a NaN threshold would disable the gate without saying so.
+        raise argparse.ArgumentTypeError(f"{raw!r} must be a finite number")
+    return value
+
 
 def _build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(
@@ -20,7 +38,7 @@ def _build_parser() -> argparse.ArgumentParser:
     p.add_argument("--price-sheet", help="Optional JSON price-sheet override.")
     p.add_argument(
         "--threshold",
-        type=float,
+        type=_threshold,
         default=None,
         help="Fail (exit 1) when the monthly delta exceeds this many dollars.",
     )
@@ -29,10 +47,37 @@ def _build_parser() -> argparse.ArgumentParser:
     p.add_argument(
         "--token", help="GitHub token; defaults to $GITHUB_TOKEN.", default=None
     )
+    p.add_argument(
+        "--github-output",
+        help="Append `name=value` result lines to this file (pass $GITHUB_OUTPUT).",
+    )
+    p.add_argument("--version", action="version", version=f"tf-cost-diff {__version__}")
     return p
 
 
-def main(argv: list[str] | None = None) -> int:
+def write_github_output(
+    path: str, summary: PlanSummary, exceeded: bool, comment_url: str
+) -> None:
+    """Emit the results as GitHub Actions step outputs.
+
+    Written before the threshold gate is applied, so a workflow can still read
+    the numbers on the run where the gate fails -- which is the run that matters.
+    """
+    lines = [
+        f"total-delta={summary.total_delta:.2f}",
+        f"created={summary.created}",
+        f"updated={summary.updated}",
+        f"destroyed={summary.destroyed}",
+        f"unpriced={len(summary.unpriced)}",
+        f"complete={'true' if summary.is_complete else 'false'}",
+        f"threshold-exceeded={'true' if exceeded else 'false'}",
+        f"comment-url={comment_url.replace(chr(10), '').replace(chr(13), '')}",
+    ]
+    with open(path, "a", encoding="utf-8") as fh:
+        fh.write("\n".join(lines) + "\n")
+
+
+def run(argv: list[str] | None = None) -> int:
     args = _build_parser().parse_args(argv)
 
     sheet = PriceSheet.load(args.price_sheet)
@@ -42,19 +87,54 @@ def main(argv: list[str] | None = None) -> int:
 
     repo = args.repo or os.environ.get("GITHUB_REPOSITORY")
     token = args.token or os.environ.get("GITHUB_TOKEN")
-    if args.pr and repo and token:
-        url = upsert_comment(repo, args.pr, token, body)
-        if url:
-            print(f"Comment: {url}", file=sys.stderr)
+    comment_url = ""
+    if args.pr:
+        if not repo or not token:
+            missing = "repository" if not repo else "token"
+            print(
+                f"::warning::--pr {args.pr} was given but no {missing} is available; "
+                "not posting a comment.",
+                file=sys.stderr,
+            )
+        else:
+            try:
+                comment_url = upsert_comment(repo, args.pr, token, body)
+            except CostDiffError as exc:
+                # Posting is best effort: a fork PR has a read-only token, and
+                # failing to comment must not mask the threshold verdict below.
+                print(f"::warning::could not post the PR comment: {exc}", file=sys.stderr)
+            else:
+                if comment_url:
+                    print(f"Comment: {comment_url}", file=sys.stderr)
 
-    if args.threshold is not None and summary.total_delta > args.threshold:
+    exceeded = args.threshold is not None and summary.total_delta > args.threshold
+
+    if args.github_output:
+        write_github_output(args.github_output, summary, exceeded, comment_url)
+
+    if summary.unpriced:
+        print(
+            f"::warning::{len(summary.unpriced)} resource(s) could not be priced and "
+            "are excluded from the total; the real delta differs.",
+            file=sys.stderr,
+        )
+
+    if exceeded:
         print(
             f"::error::monthly cost delta ${summary.total_delta:.2f} "
             f"exceeds threshold ${args.threshold:.2f}",
             file=sys.stderr,
         )
-        return 1
-    return 0
+        return EXIT_OVER_THRESHOLD
+    return EXIT_OK
+
+
+def main(argv: list[str] | None = None) -> int:
+    try:
+        return run(argv)
+    except CostDiffError as exc:
+        print(f"::error::{exc}", file=sys.stderr)
+        return EXIT_ERROR
 
 
 if __name__ == "__main__":
diff --git a/tf_cost_diff/github.py b/tf_cost_diff/github.py
index b073cea..3434c19 100644
--- a/tf_cost_diff/github.py
+++ b/tf_cost_diff/github.py
@@ -3,12 +3,17 @@
 
 import json
 import urllib.error
+import urllib.parse
 import urllib.request
 from typing import Any
 
-from .report import MARKER
+from . import CostDiffError
+from .report import COMMENT_LIMIT, MARKER
 
 _API = "https://api.github.com"
+_TIMEOUT = 30  # seconds; without this a hung API call hangs the whole job
+_PER_PAGE = 100
+_MAX_PAGES = 20
 
 
 def _request(method: str, url: str, token: str, body: dict[str, Any] | None = None) -> Any:
@@ -17,25 +22,71 @@ def _request(method: str, url: str, token: str, body: dict[str, Any] | None = No
     req.add_header("Authorization", f"Bearer {token}")
     req.add_header("Accept", "application/vnd.github+json")
     req.add_header("X-GitHub-Api-Version", "2022-11-28")
-    with urllib.request.urlopen(req) as resp:  # noqa: S310 - api.github.com only
-        return json.loads(resp.read() or "null")
+    if data is not None:
+        req.add_header("Content-Type", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=_TIMEOUT) as resp:  # noqa: S310
+            return json.loads(resp.read() or "null")
+    except urllib.error.HTTPError as exc:
+        detail = ""
+        try:
+            detail = (exc.read() or b"").decode("utf-8", "replace")[:400]
+        except OSError:  # pragma: no cover - body already consumed
+            pass
+        hint = ""
+        if exc.code in (401, 403):
+            hint = (
+                " (the token cannot write to this pull request; note that "
+                "GITHUB_TOKEN is read-only on pull requests from forks, and the "
+                "workflow needs `permissions: pull-requests: write`)"
+            )
+        raise CostDiffError(
+            f"GitHub API {method} {url} failed: HTTP {exc.code}{hint}. {detail}"
+        ) from None
+    except (urllib.error.URLError, TimeoutError, OSError) as exc:
+        raise CostDiffError(f"GitHub API {method} {url} failed: {exc}") from None
+    except json.JSONDecodeError as exc:
+        raise CostDiffError(f"GitHub API {method} {url} returned invalid JSON: {exc}") from None
 
 
 def _find_sticky(repo: str, pr: int, token: str) -> int | None:
-    url = f"{_API}/repos/{repo}/issues/{pr}/comments?per_page=100"
-    for comment in _request("GET", url, token) or []:
-        if MARKER in (comment.get("body") or ""):
-            return int(comment["id"])
+    """Find our previous comment, walking every page.
+
+    Only checking the first page means that on a busy pull request the sticky
+    comment is never found again and a fresh duplicate is posted on every run.
+    """
+    for page in range(1, _MAX_PAGES + 1):
+        url = (
+            f"{_API}/repos/{repo}/issues/{pr}/comments"
+            f"?per_page={_PER_PAGE}&page={page}"
+        )
+        batch = _request("GET", url, token)
+        if not isinstance(batch, list) or not batch:
+            return None
+        for comment in batch:
+            if isinstance(comment, dict) and MARKER in (comment.get("body") or ""):
+                return int(comment["id"])
+        if len(batch) < _PER_PAGE:
+            return None
     return None
 
 
 def upsert_comment(repo: str, pr: int, token: str, body: str) -> str:
     """Post a new comment or edit the existing sticky one. Returns its URL."""
-    existing = _find_sticky(repo, pr, token)
+    if "/" not in repo:
+        raise CostDiffError(f"repository must be in owner/name form, got {repo!r}")
+    if len(body) > COMMENT_LIMIT:  # belt and braces; render() already fits it
+        body = body[: COMMENT_LIMIT - 40].rstrip() + "\n\n_…comment truncated._\n"
+    owner, name = repo.split("/", 1)
+    safe_repo = f"{urllib.parse.quote(owner)}/{urllib.parse.quote(name)}"
+
+    existing = _find_sticky(safe_repo, pr, token)
     if existing is None:
-        url = f"{_API}/repos/{repo}/issues/{pr}/comments"
+        url = f"{_API}/repos/{safe_repo}/issues/{pr}/comments"
         result = _request("POST", url, token, {"body": body})
     else:
-        url = f"{_API}/repos/{repo}/issues/comments/{existing}"
+        url = f"{_API}/repos/{safe_repo}/issues/comments/{existing}"
         result = _request("PATCH", url, token, {"body": body})
+    if not isinstance(result, dict):
+        return ""
     return str(result.get("html_url", ""))
diff --git a/tf_cost_diff/plan.py b/tf_cost_diff/plan.py
index edb2c63..aace347 100644
--- a/tf_cost_diff/plan.py
+++ b/tf_cost_diff/plan.py
@@ -1,10 +1,10 @@
 """Parse ``terraform show -json <plan>`` output into cost-relevant changes."""
 from __future__ import annotations
 
-import json
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from typing import Any
 
+from . import CostDiffError, load_json_document
 from .pricing import PriceSheet
 
 # Terraform resource_changes[].change.actions values we care about.
@@ -12,6 +12,10 @@
 _DELETE = "delete"
 _UPDATE = "update"
 
+# Money is rounded to whole cents everywhere, so the rows in the rendered table
+# always add up to the headline total.
+_CENTS = 2
+
 
 @dataclass
 class ResourceDelta:
@@ -23,28 +27,53 @@ class ResourceDelta:
 
     @property
     def delta(self) -> float:
-        return round(self.after_monthly - self.before_monthly, 4)
+        return round(self.after_monthly - self.before_monthly, _CENTS)
+
+
+@dataclass
+class UnpricedResource:
+    """A resource of a modelled type whose cost we could not work out.
+
+    Reported explicitly rather than counted as $0, so the reader can see that
+    the headline total is incomplete.
+    """
+
+    address: str
+    resource_type: str
+    action: str
+    reason: str
 
 
 @dataclass
 class PlanSummary:
     resources: list[ResourceDelta]
+    unpriced: list[UnpricedResource] = field(default_factory=list)
 
     @property
     def total_delta(self) -> float:
-        return round(sum(r.delta for r in self.resources), 2)
+        return round(sum(r.delta for r in self.resources), _CENTS)
+
+    def _count(self, action: str) -> int:
+        return sum(1 for r in self.resources if r.action == action) + sum(
+            1 for r in self.unpriced if r.action == action
+        )
 
     @property
     def created(self) -> int:
-        return sum(1 for r in self.resources if r.action == _CREATE)
+        return self._count(_CREATE)
 
     @property
     def updated(self) -> int:
-        return sum(1 for r in self.resources if r.action == _UPDATE)
+        return self._count(_UPDATE)
 
     @property
     def destroyed(self) -> int:
-        return sum(1 for r in self.resources if r.action == _DELETE)
+        return self._count(_DELETE)
+
+    @property
+    def is_complete(self) -> bool:
+        """True when every cost-relevant resource could be priced."""
+        return not self.unpriced
 
 
 def _classify(actions: list[str]) -> str | None:
@@ -59,34 +88,109 @@ def _classify(actions: list[str]) -> str | None:
     return None
 
 
+def validate_plan_document(doc: Any, source: str) -> dict[str, Any]:
+    """Reject anything that is not Terraform plan JSON.
+
+    Without this, *any* valid JSON parses to "no changes" and the Action posts a
+    reassuring "$0.00/mo" comment. The two realistic ways to get there are
+    passing ``terraform show -json`` of **state** instead of of a **plan file**,
+    and a truncated or empty artifact download.
+    """
+    if not isinstance(doc, dict):
+        raise CostDiffError(
+            f"{source} is not a Terraform plan: expected a JSON object at the top "
+            f"level, got {type(doc).__name__}."
+        )
+    if "resource_changes" in doc or "planned_values" in doc:
+        changes = doc.get("resource_changes", [])
+        if not isinstance(changes, list):
+            raise CostDiffError(
+                f"{source}: 'resource_changes' must be a list, got "
+                f"{type(changes).__name__}."
+            )
+        return doc
+    if "values" in doc and "planned_values" not in doc:
+        raise CostDiffError(
+            f"{source} looks like `terraform show -json` output for **state**, not "
+            "for a plan: it has 'values' but no 'resource_changes'. Run "
+            "`terraform plan -out tf.plan && terraform show -json tf.plan > plan.json`."
+        )
+    raise CostDiffError(
+        f"{source} is not a Terraform plan: no 'resource_changes' or "
+        "'planned_values' key. Check that the file is the full output of "
+        "`terraform show -json <planfile>` and was not truncated."
+    )
+
+
 def parse_plan(plan_json: dict[str, Any], sheet: PriceSheet) -> PlanSummary:
     deltas: list[ResourceDelta] = []
-    for rc in plan_json.get("resource_changes", []):
-        change = rc.get("change", {})
-        action = _classify(list(change.get("actions", [])))
+    unpriced: list[UnpricedResource] = []
+
+    for index, rc in enumerate(plan_json.get("resource_changes") or []):
+        if not isinstance(rc, dict):
+            raise CostDiffError(
+                f"resource_changes[{index}] must be an object, got "
+                f"{type(rc).__name__}."
+            )
+        change = rc.get("change")
+        if not isinstance(change, dict):
+            raise CostDiffError(
+                f"resource_changes[{index}] has no usable 'change' object."
+            )
+        action = _classify(list(change.get("actions") or []))
         if action is None:
             continue
-        rtype = rc.get("type", "")
-        before = change.get("before") or {}
-        after = change.get("after") or {}
-        before_cost = sheet.monthly(rtype, before) if action != _CREATE else 0.0
-        after_cost = sheet.monthly(rtype, after) if action != _DELETE else 0.0
+
+        rtype = str(rc.get("type", ""))
+        address = str(rc.get("address") or rtype or f"resource_changes[{index}]")
+
+        # Resource types we do not model at all (IAM roles, security groups,
+        # and most usage-billed services) are excluded from the estimate; the
+        # rendered report carries a standing caveat saying so.
+        if not sheet.has_model(rtype):
+            continue
+
+        before = change.get("before") if isinstance(change.get("before"), dict) else {}
+        after = change.get("after") if isinstance(change.get("after"), dict) else {}
+        before_cost = 0.0 if action == _CREATE else sheet.monthly(rtype, before)
+        after_cost = 0.0 if action == _DELETE else sheet.monthly(rtype, after)
+
+        # A modelled type whose attributes we could not read: unknown, not zero.
+        if before_cost is None or after_cost is None:
+            side = "before" if before_cost is None else "after"
+            unpriced.append(
+                UnpricedResource(
+                    address=address,
+                    resource_type=rtype,
+                    action=action,
+                    reason=(
+                        f"no price for the *{side}* configuration: an unmodelled "
+                        "size/class, or a value not known until apply"
+                    ),
+                )
+            )
+            continue
+
+        before_cost = round(before_cost, _CENTS)
+        after_cost = round(after_cost, _CENTS)
         # Skip resources that carry no modelled cost on either side.
         if before_cost == 0.0 and after_cost == 0.0:
             continue
         deltas.append(
             ResourceDelta(
-                address=rc.get("address", rtype),
+                address=address,
                 resource_type=rtype,
                 action=action,
-                before_monthly=round(before_cost, 4),
-                after_monthly=round(after_cost, 4),
+                before_monthly=before_cost,
+                after_monthly=after_cost,
             )
         )
-    deltas.sort(key=lambda d: abs(d.delta), reverse=True)
-    return PlanSummary(resources=deltas)
+
+    deltas.sort(key=lambda d: (-abs(d.delta), d.address))
+    unpriced.sort(key=lambda u: u.address)
+    return PlanSummary(resources=deltas, unpriced=unpriced)
 
 
 def load_plan(path: str) -> dict[str, Any]:
-    with open(path, encoding="utf-8") as fh:
-        return json.load(fh)
+    """Load and validate ``terraform show -json`` plan output."""
+    return validate_plan_document(load_json_document(path, "plan file"), path)
diff --git a/tf_cost_diff/pricing.py b/tf_cost_diff/pricing.py
index b93f4c0..c514252 100644
--- a/tf_cost_diff/pricing.py
+++ b/tf_cost_diff/pricing.py
@@ -3,56 +3,94 @@
 Prices are deliberately approximate on-demand list prices (us-east-1) and are
 only meant to give an order-of-magnitude delta in a pull request. Override the
 sheet with a JSON file via ``--price-sheet`` when you need accuracy.
+
+Design rule: an estimator returns ``None`` -- meaning *unknown* -- whenever it
+cannot honestly price a resource. It never falls back to a guessed rate and
+never falls back to ``0.0``. A wrong number stated confidently in a PR comment
+is worse than an admitted gap: an unrecognised ``m5.24xlarge`` priced at a
+guessed $0.05/hr reads as $36/mo when the real figure is over $3,000/mo, and it
+would sail through a ``--threshold`` gate.
 """
 from __future__ import annotations
 
-import json
-from dataclasses import dataclass
 from typing import Any, Callable
 
+from . import CostDiffError, finite, load_json_document
+
 HOURS_PER_MONTH = 730
 
+# An estimator maps a resource's attribute map to $/month, or None for unknown.
+Estimator = Callable[[dict[str, Any]], "float | None"]
+
+
+def _hourly_by_attribute(attribute: str, table: dict[str, float]) -> Estimator:
+    """Price a resource from a lookup table keyed on one attribute.
+
+    Returns None when the attribute is absent, is still unknown at plan time
+    (Terraform writes null), or names a size we have no price for.
+    """
 
-@dataclass(frozen=True)
-class Price:
-    """A monthly-cost estimator for one resource type."""
+    def estimate(attrs: dict[str, Any]) -> float | None:
+        raw = attrs.get(attribute)
+        if raw is None:
+            return None
+        hourly = table.get(str(raw))
+        if hourly is None:
+            return None
+        return hourly * HOURS_PER_MONTH
 
-    estimate: Callable[[dict[str, Any]], float]
+    return estimate
 
 
-def _instance(hourly: float) -> Price:
-    return Price(lambda attrs: hourly * HOURS_PER_MONTH)
+def _per_unit(attribute: str, unit_price: float) -> Estimator:
+    """Price a resource as ``quantity * unit_price`` (e.g. GB-month)."""
 
+    def estimate(attrs: dict[str, Any]) -> float | None:
+        quantity = finite(attrs.get(attribute))
+        if quantity is None or quantity < 0:
+            return None
+        return quantity * unit_price
 
-# Minimal built-in sheet: resource_type -> function(values) -> $/month.
-_BUILTIN: dict[str, Callable[[dict[str, Any]], float]] = {
+    return estimate
+
+
+def _flat(hourly: float) -> Estimator:
+    return lambda attrs: hourly * HOURS_PER_MONTH
+
+
+# Minimal built-in sheet: resource_type -> estimator.
+_BUILTIN: dict[str, Estimator] = {
     # EC2 on-demand, a few common sizes.
-    "aws_instance": lambda a: {
-        "t3.micro": 0.0104,
-        "t3.small": 0.0208,
-        "t3.medium": 0.0416,
-        "t3.large": 0.0832,
-        "m5.large": 0.096,
-        "m5.xlarge": 0.192,
-        "c5.large": 0.085,
-    }.get(str(a.get("instance_type", "t3.micro")), 0.05)
-    * HOURS_PER_MONTH,
+    "aws_instance": _hourly_by_attribute(
+        "instance_type",
+        {
+            "t3.micro": 0.0104,
+            "t3.small": 0.0208,
+            "t3.medium": 0.0416,
+            "t3.large": 0.0832,
+            "m5.large": 0.096,
+            "m5.xlarge": 0.192,
+            "c5.large": 0.085,
+        },
+    ),
     # EBS gp3: $0.08 per GB-month.
-    "aws_ebs_volume": lambda a: float(a.get("size", 0) or 0) * 0.08,
-    # Elastic IP: charged when allocated, ~$3.6/mo.
-    "aws_eip": lambda a: 3.6,
-    # NAT Gateway hourly component.
-    "aws_nat_gateway": lambda a: 0.045 * HOURS_PER_MONTH,
+    "aws_ebs_volume": _per_unit("size", 0.08),
+    # Elastic IP: charged whenever allocated, ~$3.6/mo.
+    "aws_eip": lambda attrs: 3.6,
+    # NAT Gateway hourly component (data processing not modelled).
+    "aws_nat_gateway": _flat(0.045),
     # RDS instance (rough, per-class hourly).
-    "aws_db_instance": lambda a: {
-        "db.t3.micro": 0.017,
-        "db.t3.small": 0.034,
-        "db.t3.medium": 0.068,
-        "db.m5.large": 0.171,
-    }.get(str(a.get("instance_class", "db.t3.micro")), 0.05)
-    * HOURS_PER_MONTH,
-    # ALB/NLB hourly base.
-    "aws_lb": lambda a: 0.0225 * HOURS_PER_MONTH,
+    "aws_db_instance": _hourly_by_attribute(
+        "instance_class",
+        {
+            "db.t3.micro": 0.017,
+            "db.t3.small": 0.034,
+            "db.t3.medium": 0.068,
+            "db.m5.large": 0.171,
+        },
+    ),
+    # ALB/NLB hourly base (LCU charges not modelled).
+    "aws_lb": _flat(0.0225),
 }
 
 
@@ -65,17 +103,40 @@ def __init__(self, overrides: dict[str, float] | None = None) -> None:
     def load(cls, path: str | None) -> "PriceSheet":
         if not path:
             return cls()
-        with open(path, encoding="utf-8") as fh:
-            data = json.load(fh)
-        return cls(overrides={str(k): float(v) for k, v in data.items()})
+        data = load_json_document(path, "price sheet")
+        if not isinstance(data, dict):
+            raise CostDiffError(
+                f"price sheet {path} must be a JSON object mapping resource type "
+                'to a monthly price, e.g. {"aws_nat_gateway": 32.85}'
+            )
+        overrides: dict[str, float] = {}
+        for key, value in data.items():
+            price = finite(value)
+            if price is None:
+                raise CostDiffError(
+                    f"price sheet {path}: price for {key!r} must be a finite "
+                    f"number, got {value!r}"
+                )
+            if price < 0:
+                raise CostDiffError(
+                    f"price sheet {path}: price for {key!r} is negative ({price})"
+                )
+            overrides[str(key)] = price
+        return cls(overrides=overrides)
+
+    def has_model(self, resource_type: str) -> bool:
+        """True when this sheet claims to be able to price the resource type."""
+        return resource_type in self._overrides or resource_type in _BUILTIN
 
-    def monthly(self, resource_type: str, values: dict[str, Any]) -> float:
+    def monthly(self, resource_type: str, values: dict[str, Any]) -> float | None:
+        """Monthly cost in dollars, or None when the cost is unknown."""
         if resource_type in self._overrides:
             return self._overrides[resource_type]
-        fn = _BUILTIN.get(resource_type)
-        if fn is None:
-            return 0.0
+        estimator = _BUILTIN.get(resource_type)
+        if estimator is None:
+            return None
         try:
-            return round(float(fn(values or {})), 4)
-        except (TypeError, ValueError):
-            return 0.0
+            result = estimator(values or {})
+        except (TypeError, ValueError, AttributeError):
+            return None
+        return finite(result)
diff --git a/tf_cost_diff/report.py b/tf_cost_diff/report.py
index aa85249..20fb9aa 100644
--- a/tf_cost_diff/report.py
+++ b/tf_cost_diff/report.py
@@ -1,12 +1,39 @@
 """Render a PlanSummary as a Markdown PR comment."""
 from __future__ import annotations
 
+import re
+
 from .plan import PlanSummary
 
 MARKER = "<!-- tf-cost-diff -->"
 
+# GitHub rejects an issue-comment body longer than this with HTTP 422, which
+# would mean posting nothing at all on exactly the large plans people most want
+# reviewed. Stay under it and say what was dropped.
+COMMENT_LIMIT = 65536
+
 _ARROW = {"create": "🟢 create", "update": "🟡 update", "delete": "🔴 delete"}
 
+_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
+_CELL_MAX = 200
+
+
+def _code(text: str) -> str:
+    """Render untrusted text as a Markdown code span that cannot break out.
+
+    Resource addresses embed ``for_each`` keys, which are arbitrary attacker- or
+    typo-supplied strings. A backtick would close the code span and let the rest
+    of the key be interpreted as Markdown or raw HTML -- ``<!--`` alone hides
+    every row below it in the rendered comment. A newline would end the table
+    and a pipe would forge extra columns.
+    """
+    safe = _CONTROL.sub(" ", str(text))
+    safe = safe.replace("`", "'").replace("|", "\\|")
+    if len(safe) > _CELL_MAX:
+        safe = safe[: _CELL_MAX - 1] + "…"
+    safe = safe.strip()
+    return f"`{safe}`" if safe else "`(unnamed)`"
+
 
 def _money(value: float) -> str:
     if value < 0:
@@ -15,25 +42,95 @@ def _money(value: float) -> str:
     return f"{sign}${value:,.2f}"
 
 
-def render(summary: PlanSummary) -> str:
+def _assemble(head: str, blocks: list[list[str]], notes: list[str], dropped: int) -> str:
+    # A block is a table: header row + separator + entries. Render it only while
+    # it still has entries.
+    parts = [head] + ["\n".join(b) for b in blocks if len(b) > 2]
+    tail = list(notes)
+    if dropped:
+        tail.append(
+            f"_{dropped} further row(s) omitted to stay within GitHub's comment "
+            "size limit; the total above still counts them._"
+        )
+    return "\n\n".join(parts + tail) + "\n"
+
+
+def _fit(head: str, blocks: list[list[str]], notes: list[str], limit: int) -> str:
+    """Assemble the comment, dropping trailing rows until it fits ``limit``.
+
+    ``blocks`` arrive ordered most-significant first, so the rows dropped are
+    the least interesting ones.
+    """
+    dropped = 0
+    while True:
+        body = _assemble(head, blocks, notes, dropped)
+        if len(body) <= limit:
+            return body
+        live = [b for b in blocks if len(b) > 2]
+        if not live:
+            return body[: max(0, limit - 1)].rstrip() + "…"
+        # Estimate how many rows to drop in one go so this converges in a couple
+        # of passes rather than one re-render per row.
+        entries = [line for b in live for line in b[2:]]
+        average = max(1, sum(len(line) + 1 for line in entries) // len(entries))
+        drop_now = min(len(entries), max(1, (len(body) - limit) // average + 1))
+        for _ in range(drop_now):
+            candidates = [b for b in blocks if len(b) > 2]
+            if not candidates:
+                break
+            max(candidates, key=len).pop()
+            dropped += 1
+
+
+def render(summary: PlanSummary, limit: int = COMMENT_LIMIT) -> str:
     total = summary.total_delta
+    qualifier = " (partial)" if summary.unpriced else ""
     head = (
         f"{MARKER}\n"
-        f"### 💸 Terraform monthly cost estimate: **{_money(total)}/mo**\n\n"
+        f"### 💸 Terraform monthly cost estimate: **{_money(total)}/mo**{qualifier}\n\n"
         f"`{summary.created} to create · {summary.updated} to change · "
-        f"{summary.destroyed} to destroy`\n"
+        f"{summary.destroyed} to destroy`"
     )
-    if not summary.resources:
-        return head + "\n_No cost-relevant changes detected._\n"
-
-    rows = [
-        "| Resource | Action | Before | After | Δ/mo |",
-        "| --- | --- | ---: | ---: | ---: |",
-    ]
-    for r in summary.resources:
-        rows.append(
-            f"| `{r.address}` | {_ARROW.get(r.action, r.action)} | "
-            f"${r.before_monthly:,.2f} | ${r.after_monthly:,.2f} | "
-            f"**{_money(r.delta)}** |"
+
+    if not summary.resources and not summary.unpriced:
+        return head + "\n\n_No cost-relevant changes detected._\n"
+
+    blocks: list[list[str]] = []
+    if summary.resources:
+        rows = [
+            "| Resource | Action | Before | After | Δ/mo |",
+            "| --- | --- | ---: | ---: | ---: |",
+        ]
+        for r in summary.resources:
+            rows.append(
+                f"| {_code(r.address)} | {_ARROW.get(r.action, _code(r.action))} | "
+                f"${r.before_monthly:,.2f} | ${r.after_monthly:,.2f} | "
+                f"**{_money(r.delta)}** |"
+            )
+        blocks.append(rows)
+
+    notes: list[str] = []
+    if summary.unpriced:
+        unknown = [
+            "**⚠️ Cost unknown — excluded from the total above**\n\n"
+            "| Resource | Action | Why |",
+            "| --- | --- | --- |",
+        ]
+        for u in summary.unpriced:
+            # u.reason is our own static text, so it needs no sanitising.
+            unknown.append(
+                f"| {_code(u.address)} | {_ARROW.get(u.action, _code(u.action))} | "
+                f"{u.reason} |"
+            )
+        blocks.append(unknown)
+        notes.append(
+            f"> ⚠️ **{len(summary.unpriced)} resource(s) could not be priced** and "
+            "are *not* included in the total above, so the real delta differs. "
+            "Add them to a `--price-sheet` override to get a complete figure."
         )
-    return head + "\n" + "\n".join(rows) + "\n"
+
+    notes.append(
+        "_Estimate only: a small set of resource types is priced, and usage-based "
+        "charges (data transfer, requests, storage growth) are never included._"
+    )
+    return _fit(head, blocks, notes, limit)