setup-opentofu
A GitHub Action to install and configure the OpenTofu CLI for infrastructure-as-code workflows.
What is setup-opentofu?
opentofu/setup-opentofu is a GitHub Action that installs and configures the OpenTofu CLI in GitHub Actions workflows. It solves the problem of manually setting up OpenTofu for infrastructure-as-code automation by providing a reusable, configurable step that handles version installation, credential setup, and output management.
DevOps engineers and developers who use GitHub Actions for CI/CD and need to run OpenTofu commands for infrastructure provisioning and management as part of their automated pipelines.
Developers choose this action because it offers a streamlined, official-feeling setup for OpenTofu within GitHub Actions, with features like version flexibility, credential integration, and output wrapping that enhance workflow automation and reliability.
Overview
The opentofu/setup-opentofu action is a tool for GitHub Actions that automates the setup of the OpenTofu CLI. It enables developers to seamlessly integrate infrastructure-as-code practices into their CI/CD pipelines by providing the necessary command-line tools directly in their workflow runners.
Key Features
- Version Management — Installs a specific version of OpenTofu CLI or reads it from a version file, supporting semantic versioning ranges and pre-release versions.
- Wrapper Script — Optionally wraps the
tofubinary to expose its STDOUT, STDERR, and exit code as outputs for subsequent steps. - Credential Configuration — Configures credentials for Terraform Cloud or Terraform Enterprise instances directly from GitHub Secrets.
- Binary Caching — Supports caching of the OpenTofu binary to reduce download times on subsequent runs, particularly beneficial for self-hosted runners.
- Multi-Platform Support — Runs on Ubuntu, Windows, and macOS GitHub Actions runners, with Bash shell support on Windows.
Philosophy
The action is designed to be a reliable, community-maintained utility that simplifies OpenTofu integration in automated workflows, emphasizing flexibility through configurable inputs and outputs.
Use Cases
Best For
- Automating OpenTofu plan and apply steps in CI/CD pipelines
- Setting up OpenTofu in GitHub Actions for infrastructure testing
- Integrating Terraform Cloud/Enterprise credentials into automated workflows
- Running OpenTofu commands and capturing their outputs for PR comments
- Managing multiple OpenTofu versions across different projects in GitHub Actions
- Reducing setup time for OpenTofu in ephemeral CI environments
Not Ideal For
- Projects using CI/CD platforms other than GitHub Actions (e.g., GitLab CI, Jenkins)
- Simple, infrequent OpenTofu runs where manual CLI installation is sufficient
- Workflows requiring direct, unmodified access to OpenTofu's STDOUT/STDERR without output wrapping
- Teams relying on binary caching with GitHub-hosted runners, where ephemeral environments limit cache benefits
Pros & Cons
Pros
Supports specific versions, version files, and semantic versioning ranges including pre-releases, as shown in the README with examples like '1.6.0' or '.opentofu-version' files.
Configures Terraform Cloud/Enterprise credentials directly from GitHub Secrets via inputs like cli_config_credentials_token, simplifying secure authentication in workflows.
When enabled, the wrapper script captures STDOUT, STDERR, and exit codes as outputs, facilitating advanced automation like PR comments, as demonstrated in the usage examples.
Runs on Ubuntu, Windows, and macOS GitHub Actions runners, with Bash shell support on Windows, ensuring broad environment coverage.
Cons
The README notes that users may experience trouble with exit codes or output format, requiring them to set tofu_wrapper to false as a workaround, indicating potential instability.
Marked as community-maintained, the OpenTofu team does not fix non-critical bugs or add features, which could lead to slower updates and limited support for edge cases.
Binary caching is primarily useful for self-hosted runners; on GitHub-hosted runners, the ephemeral nature limits persistence, reducing its practical benefit as admitted in the README.
Frequently Asked Questions
Related Projects
tofu-controllerA GitOps OpenTofu and Terraform controller for Flux
terraform-github-actionsGitHub actions for Terraform and OpenTofu
TF-via-PRPlan and apply Terraform/OpenTofu via PR automation, using best practices for secure and scalable IaC workflows.
AtlantisAutomating workflows via pull requests
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.