Terraform in CI/CD: Plan/Apply Gates with GitHub Actions

Description and use

A GitHub Actions pipeline enforces review, audit, credential hygiene, and repeatability for Terraform changes by using a plan artifact and OIDC, with environment gates for production.

Problem

Engineers still run Terraform apply from laptops, leading to unreviewed, unlogged, and unrepeatable deployments.

Outcome

The pipeline ensures that every Terraform change is reviewed, auditable, credential‑secure, and repeatable, preventing accidental or malicious deployments.

Workflow

• Run terraform fmt -check on every PR
• Run terraform init -backend=false and terraform validate on every PR
• Run terraform init against real backend and terraform plan -out=tfplan, save artifact
• Render plan to text and post as PR comment
• On merge to main, download plan artifact and run terraform apply
• Apply only in environments with required reviewers (e.g., production gate)

Evidence

Laptop applies are unreviewed, unlogged, and unrepeatable.

Source

The plan file is saved as an artifact. On pull requests, the human-readable plan is posted as an PR comment.

Source

Only on merge to main. Downloads the exact plan artifact from the plan stage and applies it. Never re-plans at apply time.

Source

The workflow needs one permission block: permissions: id-token: write contents: read pull-requests: write

Source