Skip to main content
emisar

Terraform read-only ops

v0.1.6

Read-only Terraform CLI actions for inspecting a workspace. NO apply, NO destroy, NO state mutation — those should happen in CI, not via a runner. Operates in the directory given by TF_DIR env var.

8 allowed by default
Pack ID
terraform-readonly
Vendor
emisar
OS
linux
Actions
8
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
terraform

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install terraform-readonly --hash sha256:2eaf1873fe68be51c15c9de9c85028056c7b518961b9d19d6a5e25e3c0af07e8

Actions 8 total

View on GitHub
  • tf.output exec low

    terraform output -json

    Show the workspace's output values (terraform output -json). The -json form deliberately un-masks outputs marked `sensitive`, so the values routinely carry secrets (a db_password, a kubeconfig, provider credentials) in cleartext; scope it by policy. The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can't reliably mask output values whose arbitrary names and shapes match no rule.

    View source on GitHub
  • tf.plan_no_save exec medium

    terraform plan

    Computes a plan but does NOT save it (no -out). Cannot be applied from this run. May call out to providers (read API quotas).

    View source on GitHub
  • tf.providers exec low

    terraform providers

    List all providers declared in the workspace + their constraints.

    View source on GitHub
  • tf.show_json exec low

    terraform show -json

    Show the full workspace state as JSON (terraform show -json), for programmatic queries. This dumps every resource's attributes, including ones marked `sensitive` (passwords, private keys, tokens), in cleartext; scope it by policy. The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can't reliably mask secrets whose names and shapes match no rule.

    View source on GitHub
  • tf.state_list exec low

    terraform state list

    List all resource addresses currently in state.

    View source on GitHub
  • tf.state_show exec low

    terraform state show <address>

    Show attributes of one resource in state. May contain secrets — relies on audit redaction.

    View source on GitHub
  • tf.validate exec low

    terraform validate

    Validates the workspace's HCL files. No state read or write.

    View source on GitHub
  • tf.version exec low

    terraform version

    Show the Terraform binary version + provider versions.

    View source on GitHub
← Back to registry
Pack reference Publish your own →