Stategraph Orchestration

Stategraph Orchestration runs your infrastructure changes through pull requests on GitHub and GitLab. The Open Source edition is free to self-host. Enterprise adds governance, and Stategraph Cloud runs Orchestration for you. See Editions and pricing.

What it does

  • Plans each pull request, for each changed directory and workspace. The plan uses your branch merged with the destination branch, so it shows the result of the merge. Comment stategraph plan to plan again. See Pull request workflow.
  • Applies on a stategraph apply comment, or after the merge with when_modified.autoapply. See Apply after merge.
  • Locks the directories and workspaces that an apply changes, so no other pull request applies over them. The merge after a successful apply releases the lock. See Locks and concurrency.
  • Runs your checks on each plan: OPA and Conftest policies, Checkov scans, and Infracost estimates. A failed check fails the plan, or adds a gate that someone must approve. See OPA, Security scanning, and Infracost.
  • Enforces apply requirements: approvals, passing checks, and no merge conflicts. Enterprise adds RBAC, CODEOWNERS enforcement, approval gates, and centralized configuration. See Governance.
  • Detects drift with scheduled plans, and can open an issue when your infrastructure and your code differ. See Drift detection.
  • Runs Terraform, OpenTofu, the stategraph CLI, Terragrunt, Pulumi, CDKTF, or a custom command. See IaC tools and Use with Orchestration.

How it works

Pull requestGitHub or GitLab
Stategraph OrchestrationCloud or self-hosted
CI runnerGitHub Actions or GitLab CI
1. Event
2. Start a CI run
3. Results
4. Comments and checks
An event on a pull request reaches Orchestration.
Orchestration starts a workflow on your CI runner.
Orchestration posts the results back as comments and checks.

Plans and applies run on your GitHub Actions or GitLab CI runners, so your cloud credentials stay there. Orchestration starts the runs and records the results. For the full event sequence, see How it works.

Get started

  1. Choose where Orchestration runs: Stategraph Cloud, self-hosted Open Source, or self-hosted Enterprise.
  2. Connect GitHub or GitLab, and add the workflow file to your repository. The quickstarts show both steps.
  3. Open a pull request that changes a .tf file, and read the plan comment.

Without a configuration file, Orchestration uses defaults. To change workflows, policies, or other settings, add .stategraph/config.yml. See Configuration.

In this section

Group What it covers
Pull requests The pull request flow, apply after merge, rollbacks, and performance
Configuration The .stategraph/config.yml file, modules, secrets and variables, and CODEOWNERS
Advanced patterns Environments, stacks, layered runs, tags, locks, engines, and custom steps
Governance Access control, approval gates, drift detection, and centralized configuration
Security Cloud credentials, OIDC, private runners, plan storage, and the audit trail
Cloud providers AWS, GCP, Azure, and other providers
IaC tools Terraform, OpenTofu, Terragrunt, Pulumi, and CDKTF
External tools OPA, Infracost, webhooks, AI integrations, and packages on the runner