Stop running Terraform from laptops. How I automated it.

In many teams, Terraform is still run from someone's laptop. They pull the latest code, run plan , look at it, run apply . It works, until it doesn't: someone applies an old branch, two people apply at once, the laptop has different provider versions, or the only person with production credentials is on holiday.

The fix is a simple, well-known workflow: plan on pull request, apply on merge . Here's how I set it up.

The workflow

A developer changes infrastructure code on a branch and opens a pull request.

CI runs terraform plan and posts the plan as a comment on the pull request.

Reviewers look at both the code and the plan.

After approval, the pull request is merged.

CI runs terraform apply with the plan, from the main branch.

Everything is reviewed, everything is logged, nobody needs production credentials on their laptop, and the main branch always reflects what's deployed.

The plan is the real change.…