Runs and approvals
Terraform CI/CD with an approval before every apply.
StackShip is a managed OpenTofu runner for pull request workflows. It plans every change, checks policy, and applies only the plan you approved.
run_01K3F8PJ2M
network-foundationmain8f4b0ac
- PlanSucceeded
- PolicyPassed
- ApprovalWaiting
- ApplyPending
$ tofu plan
# aws_s3_bucket.artifacts will be created
+ resource "aws_s3_bucket" "artifacts" {
# aws_iam_role.deployer will be updated in-place
~ resource "aws_iam_role" "deployer" {
Plan: 3 to add, 1 to change, 0 to destroy.
Awaiting approval
The run
Plan, check, approve, apply.
- 01
Pull request plans
Speculative plans report to pull requests as GitHub checks.
- 02
Policy on every plan
Rego policies evaluate every plan before approval.
- 03
Required approval
Owners and admins approve. Nothing auto-applies.
- 04
Exact-plan apply
Apply reuses the approved plan, providers, and modules.
CLI and CI
Run from your terminal or any CI pipeline.
Use the tofu CLI you already know. Output streams to your terminal; the run lives in StackShip.
tofu planStarts a plan-only run with policy checks.tofu applyPlans, checks policy, then waits for your approval.TF_TOKEN_stackship_runA workspace token for GitHub Actions or any CI.
# CI secret from the workspace's CLI access pageexport TF_TOKEN_stackship_run=$STACKSHIP_TOKENtofu init -input=falsetofu plan # Plans and applies run in StackShip,# with the workspace's version and credentials.Run environment
Managed runners. Nothing to install.
Isolated runs
A fresh Linux environment for each plan and apply, discarded after.
Pinned OpenTofu versions
Pin an exact OpenTofu version, 1.6.0 or newer, per workspace.
Live logs
Plan and apply logs stream live to the dashboard and your terminal.
FAQ
Terraform approval workflow questions
How do approvals work?
A plan with changes waits at Awaiting approval. An owner or admin reviews the plan and policy results, then approves. The apply runs exactly that plan, with the same providers and modules.
Can StackShip auto-apply?
No. Every plan with changes needs an approval before it applies. Plans with no changes finish without an apply.
What if the state changes before approval?
StackShip rejects the approval and asks the reviewer to reload. An approval only ever applies to the plan, policy result, and state the reviewer saw.
Does StackShip work with GitHub Actions?
Yes. Create a workspace token, store it as a CI secret, and expose it as TF_TOKEN_stackship_run. Then run tofu plan or tofu apply in GitHub Actions or any other CI system.
Get started
Run your first plan today.
Free for every organization. Sign up with email or Google.