Digger
Runs Terraform and OpenTofu plans inside your own CI, so no third party ever holds your cloud credentials
Quick Overview
| Company | Digger |
|---|---|
| Category | DevOps & Infrastructure as Code |
| Headquarters | London, United Kingdom |
| Founded | 2022 |
| EU Presence | Yes - United Kingdom |
| Data Location | Your own CI infrastructure |
| Open Source | Yes (Apache 2.0) |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - orchestrator can be self-hosted |
| Main Features | Runs in GitHub Actions and GitLab CI, PR-based plan and apply, OPA policies, drift detection, state locking, no credential sharing |
| Pricing | Free and open source / Digger Pro and Enterprise pricing on request |
| Best For | Teams that want Terraform Cloud-style workflows without giving credentials to a vendor |
| Replaces | Terraform Cloud, Spacelift, Atlantis |
Detailed Review
Digger begins from a specific objection: hosted infrastructure-as-code platforms require you to hand cloud credentials to a third party, and for many security teams that is the end of the conversation. Digger runs the plans and applies inside the CI system you already have, so the credentials stay in the same place they already live.
It is Apache-licensed, developed from London, and deliberately smaller in scope than the platforms it competes with.
The Credential Argument
With Terraform Cloud or a hosted platform, the vendor's runners execute your changes and therefore hold keys to your infrastructure. Digger inverts that: the orchestrator decides what should run and when, but the execution happens in your GitHub Actions or GitLab CI runners using secrets you already manage.
For organisations that have already hardened their CI and audited its access, this reuses that work rather than creating a second privileged system to secure.
Pull Request Workflow
Digger comments plan output on pull requests, supports apply-on-merge or apply-before-merge, handles state locking to prevent concurrent applies, and enforces Open Policy Agent rules. That is the core of what teams actually use a platform for, without the rest.
Cost
Because compute comes from CI minutes you are already paying for, Digger avoids the per-run or per-resource pricing that makes hosted platforms expensive at scale. For a small or mid-sized team, the difference against Spacelift is substantial.
Limitations to Consider
Digger is a smaller project with a smaller company behind it, and the feature surface is correspondingly narrower — no rich dashboards, less sophisticated dependency modelling, fewer integrations than Spacelift. Running inside CI also means you inherit your CI's limitations on concurrency and runtime. And it is UK-based rather than EU-established.
Who Should Use Digger
Teams whose security posture rules out sharing cloud credentials with a vendor, and cost-conscious teams that want pull-request-driven IaC workflows without paying platform pricing on top of CI they already run.
Pros and Cons
Pros
- Credentials never leave your CI
- Reuses CI infrastructure you already secure
- Apache 2.0 open source
- No per-run platform pricing
- Standard PR-based plan and apply workflow
Cons
- Narrower feature set than Spacelift
- Inherits your CI's concurrency limits
- Small company, UK jurisdiction
Alternatives to Digger
Other European devops & infrastructure as code worth comparing before you decide:
OpenTofu
Open Source · The community fork of Terraform, under the Linux Foundation
Spacelift
Poland · Managed CI/CD for OpenTofu, Terraform, Pulumi and Ansible
NixOS
Netherlands · Declarative, reproducible system configuration
Buddy Works
Poland · Pipeline automation with an unusually approachable UI
See all European devops & infrastructure as code or compare them directly against Terraform Cloud on our alternatives page.
Frequently Asked Questions
Because a hosted platform needs your cloud credentials to execute changes, which creates a second privileged system to secure and audit. Running in your existing CI reuses access controls you have already hardened.
Similar concept — pull-request-driven Terraform automation — but Digger runs on your CI runners rather than as a separate server you host, and adds OPA policies and drift detection.
Yes, alongside Terraform, so it works whether or not you have migrated away from the BSL-licensed Terraform.
The open-source version under Apache 2.0 is free and covers the core workflow. Pro and Enterprise tiers add commercial features and support.