OpenTaco is a CI/CD orchestrator for Terraform that automatically runs terraform plan on pull‑request creation, posts the results as a comment, and triggers an automated apply when the PR is merged. It adds PR‑level state locking, RBAC‑controlled versioned state storage, scheduled drift detection with issue creation, and executes Terraform via the TFE protocol within existing CI pipelines, all in a self‑hosted, open‑source package.
Funding
Funding not disclosed
Founders
Product
Problem
Many organizations run Terraform manually or rely on third‑party services, leading to fragmented CI pipelines, risk of state conflicts, and exposure of cloud credentials. Detecting infrastructure drift and coordinating approvals across pull‑request workflows often requires custom scripts and adds operational overhead.
Solution
OpenTaco is a CI/CD orchestrator built specifically for Terraform that embeds planning and apply steps directly into existing pull‑request workflows. When a PR is opened, OpenTaco automatically executes a terraform plan and posts the results as a comment; merging the PR triggers an automated apply. PR‑level state locking and configurable approval gates prevent concurrent modifications and ensure compliance. State files are versioned with role‑based access control and support cross‑account scenarios, enabling one‑click rollbacks. Scheduled drift scans compare live infrastructure against the desired state and automatically raise tickets in GitHub, Jira, Linear, or Slack. All Terraform commands run natively in the user’s CI environment via the TFE protocol, so cloud credentials never leave the organization’s infrastructure. The platform is self‑hosted, open source, and eliminates vendor lock‑in.
Target Audience
The primary users are platform engineering, DevOps, and SRE teams that manage infrastructure-as-code with Terraform and need secure, automated CI/CD integration without exposing credentials.
Features
- Auto‑plan on pull request with results posted as a GitHub comment, and auto‑apply on merge
- PR‑level state locking and configurable approval gates to avoid concurrent updates
- Versioned state storage with RBAC, cross‑account support, and one‑click rollback capability
- Scheduled drift detection that creates issues in GitHub, Jira, Linear, or Slack
- Remote execution of Terraform commands via the TFE protocol with live log streaming to CI pipelines
- Self‑hosted deployment model; open‑source codebase with no third‑party compute or secret sharing
- Integration hooks for popular issue‑tracking and collaboration tools (GitHub, Jira, Linear, Slack)
- Support for multi‑cloud environments and seamless integration with existing CI systems (GitHub Actions, GitLab CI, Jenkins, etc.)