Skip to main content
emisar

HCP Terraform run review and gating

v0.2.0

Review HCP Terraform (formerly Terraform Cloud) and Terraform Enterprise runs and gate what happens next: list workspaces and runs, project a run's plan into a summary that carries no resource or output values, queue a speculative plan-only run, and confirm, discard, or cancel a run through emisar's policy and approval path instead of the HCP UI.

8 allowed by default 1 need approval by default
Pack ID
hcp-terraform
Vendor
emisar
OS
linux
Actions
9
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
curl jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install hcp-terraform --hash sha256:c47bfbc1673f90329c0d862366f6c6409235299f7d411bc02f86f941f7b92c07

Actions 9 total

View on GitHub
  • tfc.apply_run script high

    POST /runs/<id>/actions/apply

    Confirm a planned run so HCP Terraform applies it. This is the real apply — it creates, changes, and destroys whatever the plan says, and it cannot be undone from here. Review the plan first with tfc.plan_summary or tfc.run_details. Returns the run's state after confirmation.

    View source on GitHub
  • tfc.cancel_run script medium

    POST /runs/<id>/actions/cancel

    Interrupt a run that is currently planning or applying. Cancelling mid-apply stops Terraform partway, so the workspace can be left with some changes made and others not; prefer discard_run for a run that has only planned. Returns the run's state afterwards.

    View source on GitHub
  • tfc.create_plan_only_run script medium

    POST /runs (plan-only)

    Queue a speculative plan-only run against a workspace's current configuration. A plan-only run can never be applied, so this asks "what would change?" without putting an applyable plan in front of anyone. Review the result with tfc.plan_summary once it finishes.

    View source on GitHub
  • tfc.discard_run script medium

    POST /runs/<id>/actions/discard

    Discard a run awaiting confirmation so its plan is never applied and the workspace unlocks for the next run. Discards no infrastructure — it throws away the pending plan. Returns the run's state afterwards.

    View source on GitHub
  • tfc.list_organizations script low

    GET /organizations

    List the HCP Terraform organizations this token can see, with the contact email and creation date of each. Use it to confirm the token authenticates and to find the organization name the workspace actions need.

    View source on GitHub
  • tfc.list_runs script low

    GET /workspaces/<id>/runs

    List a workspace's runs with status, the operator's message, whether the run destroys or is plan-only, and which of confirm/discard/cancel the run will currently accept. Use it to find a run awaiting confirmation.

    View source on GitHub
  • tfc.list_workspaces script low

    GET /organizations/<name>/workspaces

    List an organization's workspaces with their execution mode, Terraform version, auto-apply setting, lock state, and resource count. Use it to find the workspace ID the run actions need, or to see which workspaces apply without review.

    View source on GitHub
  • tfc.plan_summary script low

    Project an HCP Terraform plan into a reviewable summary

    List every resource a run's plan would create, update, delete, or replace, with per-action counts, drift, and planned output changes. Attribute and output VALUES are never emitted — only addresses, types, actions, and names — because the structured plan HCP Terraform serves carries every value in cleartext, sensitive ones included. Needs a user or team token with admin access to the workspace; tfc.run_details gives counts on a read-only token.

    View source on GitHub
  • tfc.run_details script low

    GET /runs/<id>?include=plan

    Show one run with its plan's add / change / destroy / import counts. This is the review a token holding only "read runs" can perform — tfc.plan_summary returns the per-resource detail but requires workspace admin. Use it to size a run's blast radius before confirming it.

    View source on GitHub
← Back to registry
Pack reference Publish your own →