OpenTacoTerraform and OpenTofu orchestration with pull-request automation, CI integration, locking, and drift detection.MIT
Terraform and OpenTofu orchestration with pull-request automation, CI integration, locking, and drift detection.
OpenTaco, formerly Digger, coordinates Terraform workflows using existing CI infrastructure. A command-line component runs infrastructure commands, while an orchestrator triggers jobs from events such as pull-request comments. Features include plan and apply actions, pull-request locks, policy checks and drift detection. The orchestrator can be self-hosted, and jobs execute in the configured CI environment.
OpenTaco official README · Reviewed 2026-10-14
- 01 / Feature notePull-request Terraform commands
Trigger Terraform plan and apply operations through pull-request comments, with jobs running in the existing CI environment.
Feature source ↗ - 02 / Feature noteInfrastructure coordination
Use pull-request-level locks, Open Policy Agent checks and drift detection alongside Terraform workflows.
Feature source ↗
GitHub stars
5,063
Detected license
MIT
Repository created
2023-02-24
Repository push
2026-10-30
2023-02-24GitHub release
2026-10-30 · v0.6.155Repository push
2026-10-30
GitHub stars
Unknown
i
Cached history uses a different month window; chart withheld until aligned.
Latest attempt: ok · Checked 2026-10-15T23:34:55.975088+00:00 · Last successful fetch 2026-10-15T23:34:55.975088+00:00 · Provider source
Hacker News stories
Unknown
i
OpenSSF Scorecard
4.9/10
Scanned 2026-10-19 · 14 scored / 14 returned
i
- Code-Review · 8/10
Found 24/30 approved changesets -- score normalized to 8
- Maintained · 7/10
8 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 7
- Dangerous-Workflow · 10/10
no dangerous workflow patterns detected
- Binary-Artifacts · 10/10
no binaries found in the repo
- Token-Permissions · 0/10
detected GitHub workflow tokens with excessive permissions
- CII-Best-Practices · 0/10
no effort to earn an OpenSSF best practices badge detected
- License · 10/10
license file detected
- Fuzzing · 0/10
project is not fuzzed
- Security-Policy · 0/10
security policy file not detected
- Branch-Protection · 6/10
branch protection is not maximal on development and all release branches
- Signed-Releases · 0/10
Project has not signed or included provenance with any releases.
- Packaging · 10/10
packaging workflow detected
- Pinned-Dependencies · 1/10
dependency not pinned by hash detected -- score normalized to 1
- SAST · 0/10
SAST tool is not run on all commits -- score normalized to 0
Repository commit 853f6abf3f7a · Scorecard v5.6.0
Checked 2026-10-29T03:07:42Z · Last successful fetch 2026-10-29T03:07:42Z · Value fetched 2026-10-29T03:07:42Z · Provider source
GitHub release
Published 2026-10-30
i
Checked 2026-11-04T04:26:56Z · Last successful fetch 2026-11-04T04:26:56Z · Value fetched 2026-11-04T04:26:56Z · Provider source
Unknown
