Digger

Specialized CI systems for Terraform exist because collaboration on infrastructure code is awkward, but adopting one means running a second CI beside your existing one. Digger runs Terraform natively inside the CI you already have, reusing its compute, orchestration and logs.

Two components do the work. A CLI runs inside the CI job and calls Terraform with the right arguments, and a minimal orchestrator, which can be self-hosted, triggers those jobs in response to events such as pull request comments. Locks and plan cache live in your own cloud account, on DynamoDB and S3 for AWS.

What that buys over Atlantis and the hosted alternatives is concrete.

• Secrets stay put: cloud access credentials are never shared with a third party, since jobs run in your CI.
• No second compute bill: you are not paying twice to run the same plan.
• Pull request locks: layered on top of native state locks, they avoid race conditions across open pull requests.
• Policy control: Open Policy Agent provides role-based access control over who can run what.
• Drift detection: changes made outside the code get surfaced.
• Tooling coverage: Terragrunt, workspaces, several Terraform versions, Checkov static analysis and plan persistence.

Getting started guides cover GitHub Actions with AWS and with GCP, and the orchestrator can be deployed with Helm if you want to host it. Anonymous telemetry is collected and can be switched off in digger.yml or by environment variable. As of November 2025 the project has been renamed OpenTaco, while the company is still called Digger.