Digger

Digger executes infrastructure automation directly inside existing continuous integration runners instead of spinning up an external execution cluster. Over five thousand GitHub stars track this Go orchestrator, which triggers Terraform and OpenTofu jobs through pull request comments. By keeping cloud credentials and state files inside private runners, it removes the need to share administrative keys with external services.

Why Digger instead of Terraform

Terraform provisions cloud resources through declarative code, but team collaboration often pushes companies toward HashiCorp's proprietary platform, Terraform Cloud. That model requires exporting cloud credentials to a third-party service and paying per-user or per-resource subscriptions. Digger preserves the standard Terraform or OpenTofu workflow while replacing the proprietary management layer, running plans and applies inside existing GitHub Actions or GitLab CI environments.

Operationally, this architecture eliminates the overhead of managing a separate execution platform. Teams lock runs and cache plan files using native cloud storage like AWS DynamoDB and S3 rather than an external control plane. The trade-off is infrastructure responsibility: internal operations must handle runner sizing, concurrency limits, and IAM configurations instead of relying on a vendor to manage execution capacity.

What it does well

• Pull request visibility: Infrastructure plans render directly in pull request comments, letting non-technical stakeholders review planned cloud modifications before approval.
• Zero secret export: Administrative cloud credentials stay inside your private pipeline runners, eliminating exposure to third-party data breaches.
• Concurrency locks: Pull-request locks prevent overlapping applies across branches, safeguarding shared environments from concurrent state corruption.
• Open-source engine support: Native execution of both Terraform and OpenTofu avoids proprietary vendor lock-in without altering existing configurations.
• Familiar review workflows: Team members collaborate using standard pull requests, avoiding the need to learn specialized web dashboards.
• Predictable costs: Reusing existing runner infrastructure sidesteps per-seat licenses and resource-under-management surcharges as infrastructure scales.

Limitations