TF-via-PR
A GitHub Action for automating Terraform/OpenTofu plan and apply workflows via pull requests with security and scalability best practices.
What is TF-via-PR?
TF-via-PR is a GitHub Action that automates Terraform and OpenTofu workflows through pull request-based automation. It solves the problem of manual, error-prone infrastructure deployments by integrating plan and apply operations directly into the GitHub CI/CD pipeline, ensuring changes are reviewed, secure, and consistent. It provides encrypted plan artifacts, detailed PR comments with diffs, and supports various triggers for flexible workflow design.
DevOps engineers, platform engineers, and infrastructure teams who manage cloud resources with Terraform/OpenTofu and want to implement secure, scalable GitOps practices. It's also for maintainers seeking to empower development teams with self-service infrastructure provisioning while maintaining security controls.
Developers choose TF-via-PR because it offers a secure, out-of-the-box solution for IaC automation that emphasizes encryption, drift prevention, and seamless GitHub integration. Unlike generic CI/CD scripts, it provides built-in features like plan encryption, PR comment updates, and support for complex workflows (e.g., matrix strategies, manual triggers), reducing custom scripting and security risks.
Overview
Plan and apply Terraform/OpenTofu via PR automation, using best practices for secure and scalable IaC workflows.
Use Cases
Best For
- Implementing GitOps workflows for Terraform/OpenTofu in GitHub repositories
- Securing infrastructure pipelines with encrypted plan artifacts and OIDC integration
- Automating multi-environment deployments using GitHub Actions matrix strategies
- Enabling self-service infrastructure changes for development teams via PR reviews
- Detecting and alerting on configuration drift with scheduled refresh-only runs
- Running Terraform plans/applies on self-hosted GitHub runners for compliance
Not Ideal For
- Teams using CI/CD platforms other than GitHub Actions, such as GitLab CI or Jenkins
- Projects requiring rapid, direct infrastructure changes without pull request reviews for agility
- Complex deployments needing custom artifact management between plan and apply stages
Pros & Cons
Pros
Integrates Terraform plan and apply directly into pull requests, automatically posting detailed comments with diffs and logs, as shown in the usage examples.
Encrypts Terraform plan artifacts at rest using AES-256-CTR encryption to protect sensitive data, with decryption instructions provided in the README.
Supports multiple GitHub events like pull_request, push, merge_group, and scheduled cron jobs, enabling diverse workflow triggers as detailed in the examples.
Passes through all standard Terraform/OpenTofu CLI arguments, including -var, -target, and -backend-config, ensuring full command-line functionality.
Cons
The README admits issues with handling inputs containing spaces or commas, requiring workarounds like using TF_CLI_ARGS environment variables.
Incomplete handling of interim artifacts between plan and apply commands, with a workaround that forces auto-approve, as noted in the To-Do section.
Tightly coupled with GitHub Actions, making it unsuitable for teams using other CI/CD systems or requiring platform-agnostic solutions.
Frequently Asked Questions
Related Projects
tofu-controllerA GitOps OpenTofu and Terraform controller for Flux
terraform-github-actionsGitHub actions for Terraform and OpenTofu
setup-opentofuThe `opentofu/setup-opentofu` action is a tool for GitHub Actions that automates the setup of the OpenTofu CLI. It enables developers to seamlessly integrate infrastructure-as-code practices into their CI/CD pipelines by providing the necessary command-line tools directly in their workflow runners. ## Key Features - **Version Management** — Installs a specific version of OpenTofu CLI or reads it from a version file, supporting semantic versioning ranges and pre-release versions. - **Wrapper Script** — Optionally wraps the `tofu` binary to expose its STDOUT, STDERR, and exit code as outputs for subsequent steps. - **Credential Configuration** — Configures credentials for Terraform Cloud or Terraform Enterprise instances directly from GitHub Secrets. - **Binary Caching** — Supports caching of the OpenTofu binary to reduce download times on subsequent runs, particularly beneficial for self-hosted runners. - **Multi-Platform Support** — Runs on Ubuntu, Windows, and macOS GitHub Actions runners, with Bash shell support on Windows. ## Philosophy The action is designed to be a reliable, community-maintained utility that simplifies OpenTofu integration in automated workflows, emphasizing flexibility through configurable inputs and outputs.
AtlantisAutomating workflows via pull requests
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.