Repolode
Submit
diggerhq

diggerhq/digger

Open-source IaC orchestration that runs Terraform and OpenTofu inside your existing CI pipeline, with plan and apply driven from pull request comments.

Open-source alternative to:Terraform CloudSpacelift

View on GitHubWebsite
Stars
5,056
Forks
610
Open issues
501
Last commit
9 days ago

What is it?

Digger is a tool for running Infrastructure as Code (Terraform, and OpenTofu) directly inside your existing CI system, such as GitHub Actions, instead of through a separate hosted service. It is built to avoid the usual trade-off of TACOS platforms: cloud credentials stay in your own CI environment and you do not pay for extra compute just to run Terraform.

The project has two parts: a CLI that runs inside your CI and invokes Terraform with the right arguments, and a minimal orchestrator, which can also be self-hosted, that triggers CI jobs in response to events such as PR comments. PR-level locks and plan cache are stored in your own cloud account, for example DynamoDB and S3 on AWS.

Features include plan and apply from pull request comments, OPA-based RBAC, Terragrunt and workspace support, drift detection, and static analysis via Checkov.

Key features

  • 01Terraform plan and apply triggered from pull request comments
  • 02Runs in your existing CI, so no separate runners to maintain
  • 03Open Policy Agent (OPA) support for RBAC and policies
  • 04PR-level locks to avoid race conditions across multiple PRs
  • 05Drift detection and Terragrunt/workspace support

Use cases

  • Teams running Terraform on AWS or GCP who want PR-based plan and apply without sharing cloud secrets with a third party
  • Organizations that want to avoid paying for extra compute just to run infrastructure pipelines
  • Teams migrating from Atlantis who want a hosted-or-self-hosted orchestrator with OPA policies

Quick start

  1. 1

    Follow the GitHub Actions + AWS getting started guide in the Digger docs

Things to know

  • The Web UI is cloud-based, not something you run yourself.
  • Locks and plan cache are stored in your own cloud account (DynamoDB and S3 on AWS), so you must provision that infrastructure.

Topics

#terraform#infrastructure-as-code#ci-cd#github-actions#opentofu#devops#hacktoberfest#tacos#terraform-aws#terraform-gcp

FAQ

What is digger?
Open-source IaC orchestration that runs Terraform and OpenTofu inside your existing CI pipeline, with plan and apply driven from pull request comments. Digger is a tool for running Infrastructure as Code (Terraform, and OpenTofu) directly inside your existing CI system, such as GitHub Actions, instead of through a separate hosted service. It is built to avoid the usual trade-off of TACOS platforms: cloud credentials stay in your own CI environment and you do not pay for extra compute just to run Terraform.
Is digger free to use? What license does it have?
digger is open source under the MIT license. Check the license terms before using it in commercial products.
Is digger still maintained?
Actively maintained. The last commit to digger was on Oct 11, 2026.
What can I use digger for?
Teams running Terraform on AWS or GCP who want PR-based plan and apply without sharing cloud secrets with a third party Organizations that want to avoid paying for extra compute just to run infrastructure pipelines Teams migrating from Atlantis who want a hosted-or-self-hosted orchestrator with OPA policies
How do I install digger?
Follow the GitHub Actions + AWS getting started guide in the Digger docs
Where can I get digger?
The source code and installation instructions are on GitHub: https://github.com/diggerhq/digger

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects