nakamasato/Terraform Auto Approver
Auto-approve Terraform pull requests when the terraform plan JSON matches declarative safety rules, using a GitHub App identity so the approval counts toward required reviews.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub App installation token with `pull-requests: write`. Generate it in your workflow with actions/create-github-app-token and pass its output here. Do NOT use the default GITHUB_TOKEN: github-actions[bot] cannot approve PRs. | yes | — |
| plan-files | Glob pattern(s) or newline-separated paths to the terraform plan JSON file(s) to evaluate (produced by `terraform show -json <planfile>`). Every matched plan must satisfy at least one rule for the PR to be approved. | yes | — |
| config | Path to the rules config YAML. | no | .github/tf-pr-approver.yml |
| allow-empty-plans | Treat "no plan file matched" as OK instead of failing the job. Enable it when a PR that is in scope can legitimately produce no plan JSON (e.g. a docs-only change in a monorepo). Requires `target_paths` in the config: without a scope check an empty plan set would approve any PR. | no | false |
| pull-request-number | Pull request number to approve. Defaults to the PR from the event context. | no | "" |
| approve-message | Body text used for the approval review. | no | Auto-approved by tf-pr-approver: the terraform plan matched the configured safe-change rules. |
Outputs
| name | description |
|---|---|
| approved | "true" if the PR was approved (or already approved), "false" otherwise. |
| matched-rules | JSON object mapping each evaluated plan file to the rule name it matched (or null). |
| out-of-scope-files | JSON array of changed files outside `target_paths` (empty when the scope check passed). |