// the find
diggerhq/digger
Digger is an open source IaC orchestration tool. Digger allows you to run IaC in your existing CI pipeline ⚡️
Digger (now rebranding to OpenTaco) runs Terraform/OpenTofu plan and apply directly inside your existing CI pipeline instead of in a separate TACOS system. You get PR comment automation, state locking, and drift detection without handing your cloud credentials to a third party. The target audience is teams already on GitHub Actions who want Atlantis-style workflows without hosting a server.
The core architecture decision — CI jobs run in your own compute, secrets never leave your environment — is a real security win over Spacelift or Terraform Cloud. PR-level locking backed by DynamoDB/S3 (your own account) is a solid approach to the race condition problem. OPA integration for RBAC is genuinely useful for teams with multiple engineers touching infra. The self-hostable orchestrator backend means you're not locked into their SaaS if you outgrow the free tier.
The rebrand mid-stream (Digger → OpenTaco, docs split across docs.digger.dev and docs.opentaco.dev) is actively confusing — the README still says Digger, the new getting-started links go to opentaco.dev, and it's unclear which is canonical. The orchestrator backend is a Go monolith with 60+ SQL migrations managed via Atlas — not lightweight to self-host and the operational story for upgrades is thin in the docs. GitLab and Bitbucket support exists in the code but is clearly second-class compared to GitHub Actions. Telemetry is on by default with an opt-out; teams in regulated environments will need to remember to disable it.