dflook/tofu-plan

Create an OpenTofu plan

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Jan 13, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: dflook/tofu-plan@3f5dc358343fb58cd60f83b019e810315aa8258f # v2.2.3

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
path	The path to the OpenTofu root module to generate a plan for.	no	.
workspace	OpenTofu workspace to run the plan for.	no	default
label	A friendly name for the environment the OpenTofu configuration is for. This will be used in the PR comment for easy identification. If this is set, it must be the same as the `label` used in any corresponding [`dflook/tofu-apply`](https://github.com/dflook/terraform-github-actions/tree/main/tofu-apply) action.	no	""
variables	Variables to set for the tofu plan. This should be valid OpenTofu syntax - like a [variable definition file](https://opentofu.org/docs/language/values/variables/#variable-definitions-tfvars-files). Variables set here override any given in `var_file`s.	no	—
var_file	List of tfvars files to use, one per line. Paths should be relative to the GitHub Actions workspace	no	—
backend_config	List of OpenTofu backend config values, one per line.	no	""
backend_config_file	List of OpenTofu backend config files to use, one per line. Paths should be relative to the GitHub Actions workspace	no	""
replace	List of resources to replace, one per line.	no	""
target	List of resources to target, one per line. The plan will be limited to these resources and their dependencies.	no	""
exclude	List of resources to exclude from operations, one per line. The plan will include all resources except the specified ones and their dependencies. Requires OpenTofu 1.9+.	no	""
destroy	Set to `true` to generate a plan to destroy all resources. This generates a plan in [destroy mode](https://opentofu.org/docs/cli/commands/plan/#planning-modes).	no	false
refresh	Set to `false` to skip synchronisation of the OpenTofu state with actual resources. This will make the plan faster but may be out of date with the actual resources, which can lead to incorrect plans.	no	true
add_github_comment	Controls whether a comment is added to the PR with the generated plan. The default is `true`, which adds a comment to the PR with the results of the plan. Set to `changes-only` to add a comment only when the plan indicates there are changes to apply. Set to `always-new` to always create a new comment for each plan, instead of updating the previous comment. Set to `false` to disable the comment - the plan will still appear in the workflow log.	no	true
parallelism	Limit the number of concurrent operations	no	0

Outputs

name	description
changes	Set to 'true' if the plan would apply any changes, 'false' if it wouldn't.
plan_path	This is the path to the generated plan in an opaque binary format. The path is relative to the Actions workspace. The plan can be used as the `plan_file` input to the [dflook/tofu-apply](https://github.com/dflook/terraform-github-actions/tree/main/tofu-apply) action. OpenTofu plans often contain sensitive information, so this output should be treated with care.
json_plan_path	This is the path to the generated plan in [JSON Output Format](https://opentofu.org/docs/internals/json-format/). The path is relative to the Actions workspace. OpenTofu plans often contain sensitive information, so this output should be treated with care.
text_plan_path	This is the path to the generated plan in a human-readable format. The path is relative to the Actions workspace.
to_add	The number of resources that would be affected by this operation.
to_change	The number of resources that would be affected by this operation.
to_destroy	The number of resources that would be affected by this operation.
to_move	The number of resources that would be affected by this operation.
to_import	The number of resources that would be affected by this operation.
run_id	If the root module uses the `remote` or `cloud` backend in remote execution mode, this output will be set to the remote run id.