DEV Community

Nicolas Balmaceda
Nicolas Balmaceda

Posted on

I Got Tired of Reading thousands-line Terraform Plans, So I Built an Open-Source CLI to AI-Triage Them.

#ai #terraform #opensource #devops

We’ve all been there. You open a Pull Request, scroll down to the CI/CD pipeline output to verify an infrastructure change, and you're hit with a massive, unreadable wall of red and green JSON text.

Finding the real structural risks or accidental resource destructions feels like searching for a needle in a haystack. Senior engineers spend hours squinting at logs just to make sure nothing breaks production.

I got completely tired of that workflow bottleneck, so I built a fix: tf-triage.

It’s a lightweight Go-based CLI tool designed to completely automate how teams audit infrastructure updates by converting messy raw plans into clean, actionable, markdown summaries directly inside your developer workflow.

The Core Concept

Instead of wasting your context window (and your budget) parsing irrelevant metadata, tf-triage intercepts the standard JSON payload, isolates the critical resource changes, and routes them to an LLM provider to draft a structural impact review.


Automating infrastructure validation at the PR Level

Here is why it's built differently:

  • 🔒 100% Local & Private: Security teams hate sending cloud layouts to third-party endpoints. tf-triage integrates natively with local Ollama instances. You can run llama3.2 completely offline on your laptop for $0.
  • ☁️ Ultra-Low Cost Cloud Routing: If you prefer cloud speeds without high token bills, it supports highly efficient endpoints like DeepSeek (V4) and Google Gemini using lightweight, raw HTTP clients.
  • 🤖 Native CI/CD PR Comments: It doesn't just print output to the screen; it includes an automatic comment sub-command that auto-detects if it's running inside GitHub Actions, GitLab CI, or Bitbucket, posting the summary straight onto the PR.

Quickstart: Try It Locally in 30 Seconds

If you are on macOS or Linux, you can install the CLI tool instantly using Homebrew:

brew tap balmha/tap
brew install tf-triage
Enter fullscreen mode Exit fullscreen mode

Running Natively Offline with Ollama

Make sure you have Ollama running on your machine with your model downloaded (ollama pull llama3.2), then pipe your plan directly into the binary:

terraform plan -json | tf-triage --provider ollama
Enter fullscreen mode Exit fullscreen mode

The tool will parse the changes and automatically generate a beautifully formatted tf-triage-results.md file right inside your working directory.

Automating Your Pull Requests (CI/CD GitOps Flow)

The real magic happens when you drop this into your team's code review workflow. Because the tool natively reads standard runner environment variables, setting up automated PR comments requires exactly zero configuration.

Here is a minimalist GitHub Actions step configuration using DeepSeek to automatically review every infrastructure change:

- name: Triage Terraform Infrastructure Plan
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
  run: |
    terraform plan -json > plan.json

    # 1. Analyze the plan and create the markdown report
    tf-triage --file plan.json --provider deepseek

    # 2. Automatically post the report as an interactive PR comment
    tf-triage comment
Enter fullscreen mode Exit fullscreen mode

When the pipeline runs, tf-triage figures out the context, looks at the active pull request number, and drops a cleanly formatted security and resource impact review right into the comment feed. If you push a new commit, it intelligently updates its existing comment rather than spamming the thread.

What Do You Think?

I built this tool to scratch my own itch, keep infrastructure data locked down safely, and make code reviews vastly less tedious for platform teams.

The project is fully open-source and active. If you want to check out the Go source code, submit an issue, or help support the tool with a GitHub star, drop by the repository!

👉 [https://github.com/balmha/tf-triage]

Top comments (0)