OSS Tanbou
View on GitHub

Digger / OpenTaco — IaC orchestration that runs Terraform and OpenTofu inside your existing CI

OSS health 89
About these scores

Discovery score is an unbounded weighted, log-compressed index of stars, watchers, forks, and contributors. Growth momentum is its change over the observed period; OSS health is a 0–100 score from available repository recency, Community Health, and release data.

Stars
5,047
Primary language
Go
License
MIT
Repository last updated
Sep 15, 2026

Overview

Digger is an IaC orchestration tool that runs Terraform or OpenTofu plan/apply jobs inside existing CI runners such as GitHub Actions. It provides PR-comment workflows, OPA policies, PR-level locks, Terragrunt, Checkov, drift detection, and an optional self-hosted orchestrator. The project has been rebranding to OpenTaco since November 2025; the latest GitHub release checked on September 17, 2026 is v0.6.151.

Features and best fit

Based on official documentation; not hands-on tested · Content checked:

Run Terraform and OpenTofu jobs inside the security boundary of existing CI

The Digger CLI invokes Terraform or OpenTofu with the required arguments inside CI jobs, keeping cloud credentials in the CI environment rather than handing them to a separate runner service. It reuses existing CI compute, logs, and parallel execution.

Sources: [2]

Add PR automation, policy, locking, and drift detection through the orchestrator

It supports plan/apply from PR comments, OPA-based RBAC and policies, PR-level locks, Terragrunt, multiple Terraform versions, Checkov, plan persistence, and drift detection. The orchestrator triggers CI jobs and can also be self-hosted.

Sources: [2]

For teams that want IaC governance without adding a separate Terraform runner platform

It fits teams that want to keep cloud credentials within their current CI boundary while adding PR workflows, policy, locks, and drift detection.

Sources: [2]

Account for the Digger-to-OpenTaco rebrand, telemetry, and state/cache

README and documentation currently mix Digger and OpenTaco naming and URLs. Anonymous telemetry can be disabled in configuration or with TELEMETRY=false. PR locks and plan cache also keep state in your cloud account—DynamoDB and S3 on AWS—so permissions, lifecycle, and backups need to be designed. The repository LICENSE itself is MIT.

Sources: [2][4][3]

Official sources

  1. [1]diggerhq/digger — GitHub repository metadata(2026-09-17)
  2. [2]Digger / OpenTaco — README(2026-09-17)
  3. [3]Digger v0.6.151 release(2026-09-17)
  4. [4]Digger — MIT LICENSE(2026-09-17)
Supplemental curator note

Focus on its design of reusing existing CI compute, logs, and secret boundaries instead of introducing a second IaC runner platform.

Try it in 3 steps

  1. 1

    Get the source

    git clone --depth 1 https://github.com/diggerhq/digger.git
  2. 2

    Enter the repository

    cd digger
  3. 3

    Check the official steps

    Continue with the commands in the README Installation, Quick Start, or Getting Started section.

    find . -maxdepth 1 -iname 'README*' -exec sed -n '1,220p' {} \; -quit
Check the official README

Growth

Growth trends · Last 30 days

5,047 Stars

Trend data is still being collected.

Development activity

Last 90 days · weekly

Commits (last 30 days)
4
Open PRs
71

Development activity is still being collected.

Built with

Categories and tags

Categories

Tags

GitHub data

GitHub dataView detailed GitHub data
View on GitHub

GitHub Topics

  • infrastructure-as-code
  • terraform
  • terraformcloud
  • tacos
  • github-actions
  • terraform-aws
  • terraform-gcp
  • terraform-github-actions
  • hacktoberfest
Stars
5,047
Forks
611
Watchers
18
Open issues
417
Primary language
Go
License
MIT
Repository last updated
Sep 15, 2026
Write a related article

Share a guide or use case for this OSS in Markdown. Articles are published after administrator approval.

Report incorrect information

Tell us if any listing information is incorrect or outdated.