index
More actions
Plan OpenTofu in the pull request. Merge it, and approve the deployment to apply it.
It does what HCP Terraform's (formerly Terraform Cloud) VCS workflow does, with GitHub Actions alone. There is no server to run, and the state stays in your own backend.
How it works
Plan
Every pull request plans each workspace it changes, and the plan is posted on the pull request.
Merge
The push to the default branch plans every workspace again, and the plan comment of the merged pull request shows the new plan.
Approve
The apply job waits on the workspace's GitHub environment until a required reviewer approves it. A workspace set to auto apply skips this.
Apply
The apply makes a fresh plan and goes ahead only when it matches the one that was approved.
With apply-before-merge, a pull request is approved and applied first and merges once the apply succeeds, so the default branch holds only what was applied.
What is in it
Called once in each job of your workflow, with step naming the job.
Creates the environments the apply waits on, with their required reviewers.
HCP Terraform also estimates what a run costs. This project leaves that to tools made for it, such as the Infracost GitHub app, which comments the estimate on the pull request beside the plan.