![digger-opensource-gitops-banner](https://private-user-images.githubusercontent.com/1280498/237385522-7fb44db3-38ca-4021-8714-87a2f1a14982.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDY0MjYsIm5iZiI6MTcyNDgwNjEyNiwicGF0aCI6Ii8xMjgwNDk4LzIzNzM4NTUyMi03ZmI0NGRiMy0zOGNhLTQwMjEtODcxNC04N2EyZjFhMTQ5ODIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyOCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjhUMDA0ODQ2WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9Yzc4N2ZkODVmY2YxOWE2OTY1YzdhNmUwZjJiMTAzZjdkMjFjYzUwODQ3M2RhMGIxMzUzOTNkMjViOWQxMjdiOCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.zBnQpzZeIqjKmRZi7XxbKEjSeu5ODk38Sf_r6cUEfUs)
CI/CD for Terraform is tricky. To make life easier, specialised CI systems aka TACOS exist - Terraform Cloud, Spacelift, Atlantis, etc.
But why have 2 CI systems? Why not reuse the async jobs infrastructure with compute, orchestration, logs, etc of your existing CI?
Digger runs terraform natively in your CI. This is:
- Secure, because cloud access secrets aren't shared with a third-party
- Cost-effective, because you are not paying for additional compute just to run your terraform
- Terraform plan and apply in pull request comments
- Private runners - thanks to the fact that there are no separate runners! Your existing CI's compute environment is used
- Open Policy Agent (OPA) support for RBAC
- PR-level locks (on top of Terraform native state locks, similar to Atlantis) to avoid race conditions across multiple PRs
- Terragrunt, Workspaces, multiple Terraform versions, static analysis via Checkov, plan persistence, ...
- Drift detection
Digger has 2 main components:
- CLI that runs inside your CI and calls terraform with the right arguments
- Orchestrator - a minimal backend (that can also be self-hosted) that triggers CI jobs in response to events such as PR comments
Digger also stores PR-level locks and plan cache in your cloud account (DynamoDB + S3 on AWS, equivalents in other cloud providers)
- No need to host and maintain a server (although you can)
- Secure by design: jobs run in your CI, so sensitive data stays there
- Scalable compute: jobs can run in parallel
- RBAC and policies via OPA
- Drift detection
- Apply-after-merge workflows
- Web UI (cloud based)
- Read more about differences with Atlantis in our blog post
- Open source; orchestrator can be self-hosted
- Unlimited runs and unlimited resources-under-management on all tiers
- Jobs run in your CI, not on a third-party server
- Supports PR automation (apply before merge)
- No duplication of the CI/CD stack
- Secrets not shared with a third party
We love contributions. Check out our contributing guide to get started.
Not sure where to get started? You can:
- Book a free, non-pressure pairing session / code walkthrough with one of our teammates!
- Join our Slack, and ask us any questions there.
Digger collects anonymized telemetry. See usage.go for detail. You can disable telemetry collection either by setting telemetry: false
in digger.yml, or by setting the TELEMETRY
env variable to false
.
atlas migrate apply --url $DATABASE_URL