What it does
OpenTaco is an open-source infrastructure-as-code orchestration platform built around pull requests and existing CI runners. Its PR automation runs plans for Terraform, OpenTofu, and Terragrunt changes, then gates applies through review requirements; related capabilities include versioned state with access controls and scheduled drift detection. Unlike a general CI provider, OpenTaco adds infrastructure-aware operations to a team's CI workflow and can be self-hosted.
Keep the plan and apply in the pull-request workflow
OpenTaco's PR automation is designed to reuse a team's existing CI rather than provide a separate general-purpose build system. The documented onboarding path installs the OpenTaco GitHub App, adds a digger.yml file describing projects and workflows, and configures a GitHub Actions workflow. When a pull request changes infrastructure, the plan can be posted for review; comment-driven operations and approval requirements control subsequent actions. The workflow also supports PR-level locks to reduce conflicts between concurrent infrastructure changes.
A useful first deployment is one repository with a small Terraform project and a single apply gate. OpenTaco supports Terraform, OpenTofu, and Terragrunt, while the cloud credentials and IaC execution remain in the configured CI environment. Teams can later add state management, version history and rollback, or scheduled drift detection with notifications and remediation. The product's site says its self-hosted option keeps the system on the team's infrastructure.
What to evaluate before adopting it
Expect to configure a GitHub App, the CI workflow, and the project's IaC settings; OpenTaco augments those systems rather than replacing them. The official documentation labels remote runs as beta, so teams evaluating that capability should distinguish it from the established PR automation path. The repository still uses the name Digger, and some docs, commands, and variables retain that legacy naming after the product rebrand.
Strengths
- Plans and applies are associated with pull requests and can use approval, mergeability, and concurrency controls.
- Infrastructure runs in the existing CI environment, avoiding a separate runner fleet for the IaC workflow.
- The project combines PR automation with optional state versioning, rollback, drift detection, and notification workflows.
Watch out for
- PR automation requires a configured GitHub App, project configuration, and an existing CI workflow.
- The documentation marks remote runs as beta.
Best for
- Teams that want Terraform or OpenTofu plans reviewed and applied through pull requests
- Platform teams reusing their existing GitHub Actions runners for infrastructure automation
- Organizations that want drift checks and state controls alongside CI-based IaC execution
Sources
- OpenTaco – Terraform automation that feels invisible (Oct 26, 2026)
- About OpenTaco — Digger (Oct 26, 2026)
- PR Automation — Digger (Oct 26, 2026)
- GitHub - diggerhq/digger: Digger is an open source IaC orchestration tool (Oct 26, 2026)