terraform-github-actions-deploy

To set up secure GitHub Actions workflows for Terraform, generate pipelines that enforce SHA-pinned actions, proper permissions, and concurrency controls. These workflows validate infrastructure changes with a PR plan and execute automatic apply on merge using Workload Identity Federation or OIDC.

Yes, this CI/CD pipeline supports Terragrunt deployments alongside Terraform. It uses Workload Identity Federation or OIDC for robust access controls, applying per-environment safeguards during the automatic apply on merge process.

To run a Terraform plan on pull requests, configure a workflow triggered on pull_request events for your infrastructure/ directory. This validates infrastructure changes before merge by automatically executing the plan and checking for issues.

To integrate tfsec and checkov security scans into your Terraform GitHub Actions, generate workflows that automatically include these scanners. This security hardening ensures your infrastructure code is checked for vulnerabilities during the CI/CD process.

The best way to manage per-environment Terraform deployments is using per-environment workflows and reusable templates. This standardizes deployments and enforces robust access controls with per-environment safeguards during the apply step.

You should pin GitHub Actions by SHA for Terraform CI/CD pipelines to enforce security hardening. This prevents unauthorized modifications from affecting your infrastructure deployments, complementing proper permissions and concurrency controls.