diggerhq/run-digger

Manage terraform collaboration

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 28, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: diggerhq/digger@6baf84cd9cd7c6522b98504f4a2258474d6c2de3 # v0.6.147

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
local-dev-mode	run digger for local development?	no	false
local-dev-cli-path	The path to where the compiled digger cli on the self-hosted runner exists (absolute path)	no	./digger
ee	use ee cli?	no	false
fips	build with fips140 standard?	no	false
setup-aws	Setup AWS	no	false
aws-access-key-id	AWS access key id	no	—
aws-secret-access-key	AWS secret access key	no	—
aws-role-to-assume	ARN of AWS IAM role to assume using OIDC	no	—
aws-web-identity-token-file	Location of the Web Identity Token File for assuming a role using OIDC	no	—
aws-region	AWS region	no	us-east-1
aws-role-duration-seconds	AWS role duration in seconds. Acceptable values range from 15 minutes (900 seconds) to 12 hours (43200 seconds).	no	3600
setup-google-cloud	Setup google cloud	no	false
google-auth-credentials	Service account key used got Google auth (mutually exclusive with 'google-workload-identity-provider' input)	no	—
google-workload-identity-provider	Workload identity provider to be used for Google OIDC auth (mutually exclusive with 'google-auth-credentials' input)	no	—
google-workload-identity-provider-audience	'audience' parameter configured in Google's Workload Identity Provider (if specified). To be used when the 'google-workload-identity-provider' input is specified	no	—
google-service-account	Service account to be used when the 'google-workload-identity-provider' input is specified)	no	—
google-lock-bucket	The GCP bucket to use for locks	no	—
setup-azure	Setup Azure	no	false
azure-client-id	Azure Client ID to be used for Azure OIDC auth	no	—
azure-tenant-id	AzureAD ID of the organization you are using	no	—
azure-subscription-id	Subscription ID of you are using	no	—
setup-terragrunt	Setup terragrunt	no	false
setup-opentofu	Setup OpenToFu	no	false
opentofu-tfe-token	the cli credentials token to use with opentofu	no	""
opentofu-tfe-hostname	the cli hostname auth to use with opentofu	no	""
setup-pulumi	Setup Pulumi	no	false
terragrunt-version	Terragrunt version	no	v0.73.7
opentofu-version	OpenTofu version	no	v1.6.1
pulumi-version	Pulumi version	no	v3.3.0
setup-terraform	Setup terraform	no	false
terraform-version	Terraform version	no	v1.5.5
terraform-tfe-token	the cli credentials token to use with opentofu	no	""
terraform-tfe-hostname	the cli hostname auth to use with opentofu	no	""
configure-checkout	Configure checkout. Beware that this will overwrite any changes in the working directory	no	true
upload-plan-destination	Destination to upload the plan to. azure, gcp, github and aws are currently supported.	no	—
upload-plan-destination-s3-bucket	Name of the destination bucket for AWS S3. Should be provided if destination == aws	no	—
upload-plan-destination-s3-encryption-enabled	If encryption is to be enabled for s3 bucket	no	false
upload-plan-destination-s3-encryption-type	the type of encryption to use for the S3 bucket, either AES256 or KMS	no	AES256
upload-plan-destination-s3-encryption-kms-key-id	for encryption of type KMS you need to specify the KMS key ID to use	no	—
upload-plan-destination-azure-container	Name of the destination storage account container for Azure blob storage. Should be provided if destination == azure	no	—
upload-plan-destination-azure-storage-account	Name of the destination storage account for Azure blob storage. Should be provided if destination == azure	no	—
upload-plan-destination-gcp-bucket	Name of the destination bucket for a GCP bucket. Should be provided if destination == gcp	no	—
setup-checkov	Setup Checkov	no	false
checkov-version	Checkov version	no	3.2.22
disable-locking	Disable locking (deprecated, use pr_locks on digger.yml instead)	no	false
digger-filename	Alternative Digger configuration file name	no	—
digger-private-key	Digger private key (for digger team and next only)	no	—
digger-token	Digger token	no	—
digger-hostname	Digger hostname	no	https://cloud.digger.dev
digger-organisation	The name of your digger organisation	no	—
setup-tfenv	Setup tfenv	no	false
post-plans-as-one-comment	Post plans as one comment	no	false
reporting-strategy	comments_per_run or latest_run_comment, anything else will default to original behavior of multiple comments	no	comments_per_run
mode	manual, drift-detection or otherwise	no	""
no-backend	run cli-only, without an orchestrator backend	no	false
command	digger plan or digger apply in case of manual mode	no	""
project	project name for digger to run in case of manual mode	no	""
drift-detection-slack-notification-url	drift-detection slack drift url	no	""
drift-detection-advanced-slack-notification-url	drift-detection slack drift url (advanced mode, ee only)	no	""
cache-dependencies	Leverage actions/cache to cache dependencies to speed up execution	no	false
terraform-cache-dir	allows overriding of the terraform cache dir which defaults to ${github.workspace}/cache	no	""
cache-dependencies-s3	Use S3 for caching terraform/terragrunt dependencies	no	false
cache-dependencies-s3-bucket	S3 bucket name for caching without the leading s3 (e.g. mybucket)	no	""
cache-dependencies-s3-bucket-prefix	S3 bucket prefix for caching (e.g. cache)	no	""
cache-dependencies-s3-region	AWS region for S3 cache bucket	no	us-east-1
digger-spec	(orchestrator only) the spec to pass onto digger cli	no	""
digger-version	Pre-compiled version of digger CLI to install. Must correspond to a valid release tag (vX.Y.Z). This value overrides the version derived from the github.action_ref.	no	""
digger-os	OS variant of the digger CLI to install. Valid configurable values are: windows, linux, darwin, freebsd.	no	Linux
digger-arch	Architecture of the digger CLI to install. Valid configurable values are: amd64, arm64, 386.	no	X64
log-level	Log level for digger CLI. Valid values are: DEBUG, INFO, WARN, ERROR.	no	INFO

Outputs

name	description
output	The terraform output