How to Run terraform plan on Pull Requests in CI

Running terraform plan on the pull request shows the exact resource diff a merge would apply, which is the core of plan-review-before-apply.

Generate the plan on pull_request with read-only credentials, save it with -out, and keep the apply for the merge job. Never apply from the PR job.

Steps

• Authenticate with read-only cloud credentials (OIDC preferred).
• Run terraform init then terraform plan -out=tfplan -input=false.
• Upload tfplan as an artifact or post its summary as a PR comment.

Workflow

on:
  pull_request:
permissions:
  contents: read
  id-token: write
jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init -input=false
      - run: terraform plan -out=tfplan -input=false -no-color

Gotchas

• Give the PR job read-only cloud permissions so a plan can never mutate infrastructure.
• A saved tfplan is tied to a state version; a later apply may reject a stale plan.

Related guides