knowre-dev/run-digger
Manage terraform collaboration
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Apr 7, 2025
- License
- Apache 2.0
Pinned Snippet
uses: knowre-dev/digger@c7328a0f2803986c8e40ef26f541334c81402443 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| ee | use ee cli? | no | false |
| setup-aws | Setup AWS | no | false |
| aws-access-key-id | AWS access key id | no | — |
| aws-secret-access-key | AWS secret access key | no | — |
| aws-role-to-assume | ARN of AWS IAM role to assume using OIDC | no | — |
| aws-region | AWS region | no | us-east-1 |
| setup-google-cloud | Setup google cloud | no | false |
| google-auth-credentials | Service account key used got Google auth (mutually exclusive with 'google-workload-identity-provider' input) | no | — |
| google-workload-identity-provider | Workload identity provider to be used for Google OIDC auth (mutually exclusive with 'google-auth-credentials' input) | no | — |
| google-workload-identity-provider-audience | 'audience' parameter configured in Google's Workload Identity Provider (if specified). To be used when the 'google-workload-identity-provider' input is specified | no | — |
| google-service-account | Service account to be used when the 'google-workload-identity-provider' input is specified) | no | — |
| google-lock-bucket | The GCP bucket to use for locks | no | — |
| setup-azure | Setup Azure | no | false |
| azure-client-id | Azure Client ID to be used for Azure OIDC auth | no | — |
| azure-tenant-id | AzureAD ID of the organization you are using | no | — |
| azure-subscription-id | Subscription ID of you are using | no | — |
| setup-terragrunt | Setup terragrunt | no | false |
| setup-opentofu | Setup OpenToFu | no | false |
| setup-pulumi | Setup Pulumi | no | false |
| terragrunt-version | Terragrunt version | no | v0.73.7 |
| opentofu-version | OpenTofu version | no | v1.6.1 |
| pulumi-version | Pulumi version | no | v3.3.0 |
| setup-terraform | Setup terraform | no | false |
| terraform-version | Terraform version | no | v1.5.5 |
| configure-checkout | Configure checkout. Beware that this will overwrite any changes in the working directory | no | true |
| upload-plan-destination | Destination to upload the plan to. azure, gcp, github and aws are currently supported. | no | — |
| upload-plan-destination-s3-bucket | Name of the destination bucket for AWS S3. Should be provided if destination == aws | no | — |
| upload-plan-destination-s3-encryption-enabled | If encryption is to be enabled for s3 bucket | no | false |
| upload-plan-destination-s3-encryption-type | the type of encryption to use for the S3 bucket, either AES256 or KMS | no | AES256 |
| upload-plan-destination-s3-encryption-kms-key-id | for encryption of type KMS you need to specify the KMS key ID to use | no | — |
| upload-plan-destination-azure-container | Name of the destination storage account container for Azure blob storage. Should be provided if destination == azure | no | — |
| upload-plan-destination-azure-storage-account | Name of the destination storage account for Azure blob storage. Should be provided if destination == azure | no | — |
| upload-plan-destination-gcp-bucket | Name of the destination bucket for a GCP bucket. Should be provided if destination == gcp | no | — |
| setup-checkov | Setup Checkov | no | false |
| checkov-version | Checkov version | no | 3.2.22 |
| disable-locking | Disable locking (deprecated, use pr_locks on digger.yml instead) | no | false |
| digger-filename | Alternative Digger configuration file name | no | — |
| digger-private-key | Digger private key (for digger team and next only) | no | — |
| digger-token | Digger token | no | — |
| digger-hostname | Digger hostname | no | https://cloud.digger.dev |
| digger-organisation | The name of your digger organisation | no | — |
| setup-tfenv | Setup tfenv | no | false |
| post-plans-as-one-comment | Post plans as one comment | no | false |
| reporting-strategy | comments_per_run or latest_run_comment, anything else will default to original behavior of multiple comments | no | comments_per_run |
| mode | manual, drift-detection or otherwise | no | "" |
| no-backend | run cli-only, without an orchestrator backend | no | false |
| command | digger plan or digger apply in case of manual mode | no | "" |
| project | project name for digger to run in case of manual mode | no | "" |
| drift-detection-slack-notification-url | drift-detection slack drift url | no | "" |
| cache-dependencies | Leverage actions/cache to cache dependencies to speed up execution | no | false |
| terraform-cache-dir | allows overriding of the terraform cache dir which defaults to ${github.workspace}/cache | no | "" |
| digger-spec | (orchestrator only) the spec to pass onto digger cli | no | "" |
Outputs
| name | description |
|---|---|
| output | The terraform output |