Digger is a self-hosted IaC orchestrator that runs Terraform and OpenTofu plan and apply workflows inside your existing CI instead of on a separate runner fleet. Teams review formatted plan output as pull-request comments and gate applies with approvals and policies, while cloud credentials never leave their own CI. Since November 2025 the project ships under the OpenTaco name while the company remains Digger.[1]
Quick verdict
Platform and DevOps teams running Terraform or OpenTofu across many state files get the most from Digger: plans render as pull-request comments, applies gate on approvals and OPA policies, and secrets never leave your own CI. The decisive tradeoff is operational ownership plus rebrand churn, since the project is now OpenTaco with legacy digger naming still in flight; teams wanting a managed control plane with no self-hosting should choose a hosted TACO instead.[1][2]
Key features
Plan and apply inside pull requests Plan and apply inside pull requests: Terraform runs execute in your CI and formatted plan output lands as PR comments, so review happens where code already gets reviewed.[1]
No separate runner fleet No separate runner fleet: jobs reuse your existing CI compute, orchestration, and logs instead of duplicating that stack for infrastructure changes.[1]
Secrets stay in your CI Secrets stay in your CI: cloud access credentials are never shared with a third-party runner service, which is the core security argument over hosted TACOs.[1]
Apply gates with approvals and OPA policies Apply gates with approvals and OPA policies: merges, mergeability checks, and Open Policy Agent rules decide which applies proceed and who can trigger them.[1][2]
PR-level locks over state locks PR-level locks over state locks: per-pull-request locking avoids race conditions across parallel jobs, layered on top of native Terraform state locking.[1]
Terragrunt, workspaces, and multi-version support Terragrunt, workspaces, and multi-version support: one workflow covers Terragrunt layouts, workspaces, and multiple Terraform versions, with Checkov static analysis and plan persistence.[1][2]
Drift detection with Slack and GitHub Issues delivery Drift detection with Slack and GitHub Issues delivery: scheduled drift summaries notify the team in Slack or get filed as GitHub Issues for follow-up applies.[1][2]
OpenTaco platform paths beyond PR automation OpenTaco platform paths beyond PR automation: state management with an HCP Terraform-compatible interface, beta remote runs, and drift remediation extend the historical PR-automation core for teams that want more.[1]
Who will love it
Platform teams already on GitHub Actions: the CLI-plus-orchestrator model drops into existing CI with no new runner infrastructure to fund or harden.[1]
Regulated shops that cannot share cloud keys: keeping credentials and execution inside your own CI and cloud account is the whole pitch, and self-hosting preserves it end to end.[1][2]
Atlantis operators wanting less toil: no server to maintain, parallel jobs, and built-in drift detection address the documented Atlantis pain points directly.[1]
Who should avoid it
Teams without Terraform fluency: configuration, digger.yml projects, and OPA policies assume infrastructure-as-code skills no orchestration UI can replace.[1][2]
Buyers wanting a settled product name: the OpenTaco transition means legacy digger commands, variables, and pages coexist, so expect renaming churn in docs and tooling.[1]
Teams wanting zero operational ownership: self-hosting means running the orchestrator plus your own lock and plan-cache storage, which is real ops work compared with a managed TACO.[1]
Alternatives and compatibility
Atlantis is the documented open-source incumbent: the README frames Digger as a solid improvement upon it, removing the server while adding parallel compute, RBAC via OPA, drift detection, and apply-after-merge workflows.[1]
Terraform Cloud and hosted TACOs trade control for convenience: they run jobs on third-party servers with per-seat pricing, while Digger keeps execution and secrets in your CI with unlimited runs on all tiers.[1]
OpenTaco state management suits teams outgrowing plain backends: the HCP Terraform-compatible interface offers a drop-in migration path once centralized state with access controls matters.[1]
Questions worth asking
What is the best Digger alternative for non-technical users?
Atlantis is the closest documented open-source incumbent: the README positions Digger as an improvement upon it with no server to maintain, parallel jobs, and drift detection. Teams wanting a fully managed control plane instead would look at Terraform Cloud or Spacelift-style platforms, accepting third-party runners and per-seat pricing.[1]
Is Digger really no-code?
How much does Digger cost per month?
No per-month figure is documented on the inspected official pages. The README states unlimited runs and unlimited resources-under-management on all tiers, with Team and Enterprise tiers for managed additions; self-hosted cost is your own CI compute plus cloud storage for locks and plan cache. Checked October 9, 2026.[1]
Can you self-host Digger?
Sources and editorial review
Source research. Reviewed on October 9, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- diggerhq/digger README (official)
official · Observed October 9, 2026
Official repo README: CI-native Terraform execution, feature list, Atlantis/TACO comparisons, rebrand notice, self-host pointer.
- OpenTaco docs introduction (official)
official · Observed October 9, 2026
Official docs intro: OpenTaco four capabilities, onboarding paths, self-hosting note, legacy digger naming warning.