Plan Explainer: the PR comment that stops your client from saying 'looks good' to 2 deleted databases

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Your client opens the pull request and sees this:

Plan: 3 to add, 1 to change, 2 to destroy.

They reply "looks good". Or they panic and block everything. Both are wrong, because "2 to destroy" might be a test bucket or it might be the orders database.

Plan Explainer is a GitHub Action that translates the plan for the person who has to sign off.

• Plain code decides. It reads the plan JSON, and anything that deletes or replaces a resource requires sign-off. The model never makes this call.
• A local Gemma model explains. It writes a short comment in plain English, ending with the questions the client must answer first.

Who would pay: freelance infrastructure consultants and small agencies. Their clients must approve every change but can't read a plan, so the consultant carries all the risk of a blind "yes". The consultant pays for a paper trail that says the client was asked about backups before approving. It protects the next invoice and the relationship, and it is an easy upsell as a "change-approval report" line item on a retainer.

It works with OpenTofu too.

Demo

There is no hosted demo, because it runs inside CI on the pull request itself. This is the format of the comment the client sees:

Sign-off required. This replaces aws_db_instance.orders, so the database is destroyed and rebuilt. Do you have a backup from today?

Code

Source code: https://github.com/srivatsan084/Plan-explainer

How I Built It

The open-source AI is Gemma, an open-weight model, run locally with Ollama on the consultant's own CI runner. The project is built around a strict split: rules decide, the model only explains.

The rules are plain Python reading resource_changes[] from terraform show -json:

def classify(rc):
    a = rc["change"]["actions"]
    if a == ["delete"]:
        return "destroy"
    if set(a) == {"delete", "create"}:
        return "replace"
    if a == ["update"] and rc["type"] in STATEFUL:
        return "update-stateful"
    return None

Destroys and replaces fail the check until the client signs off. Only then is the model called, and it receives resource addresses, types and actions, never values. If Ollama is down, the Action posts a plain template comment instead, so the gate never depends on the model.

I used Claude to draft the rules and script, then checked the logic against Terraform's JSON plan format.

Why Does Open Innovation Matter?

A Terraform plan is a map of someone else's infrastructure. Most clients won't let that leave their CI, which rules out a closed API for this job.

• Zero leakage: Gemma runs on the consultant's own runner. Even then, the model only sees addresses and actions, because terraform show -json can print sensitive values in plain text.
• Zero marginal cost: no per-token bill, so it can be bundled into a retainer.
• No lock-in: swapping models is one environment variable, and the client can audit exactly what is running.

Prize Categories

• Best Use of Gemma: Gemma, served locally via Ollama, writes the client-facing explanation and the approval questions.