Digger
Open-source Terraform CI inside your own pipeline; rebranded to OpenTaco in late 2025.
Rebranded
project rebranded to OpenTaco Nov 2025
About
Digger is an open-source IaC orchestration tool that runs Terraform and OpenTofu natively inside your existing CI (e.g. GitHub Actions) instead of requiring a separate server like Atlantis or a third-party TACO platform. Jobs run on your CI's compute so cloud secrets never leave your infrastructure; a minimal orchestrator backend handles PR-comment triggers, PR-level locks, plan caching, drift detection, and OPA-based RBAC policies.
Heads-up on naming: in November 2025 the Digger project rebranded to OpenTaco while the company remains Digger, with the same engine now positioned as the way to run Terraform or OpenTofu in production. Compared to Atlantis it needs no hosted server and scales on CI parallelism; compared to Terraform Cloud it offers unlimited runs without a third-party holding your state. Limitations: the rebrand means docs and naming are in transition, advanced collaboration features trail the big commercial TACOs, and you still own your CI runners.
What it can do
- Terraform in your own CI
- PR plan/apply automation
- PR-level locking
- Drift detection
- OPA policy-as-code RBAC
- Self-hostable orchestrator
Setup
Add the Digger workflow to your GitHub Actions repo and connect the orchestrator; docs at digger.dev.
Prerequisites
A GitHub (or GitLab) repo with Terraform/OpenTofu code and CI runners with cloud credentials.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 66; Trending score 66/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.