0Pricing
DevOps Bootcamp · Lesson

GitOps and Pull Request Automation

Adopt a GitOps workflow where Terraform plans post automatically to pull requests and applies trigger on merge, giving reviewers full visibility.

GitOps and Pull Request Automation is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is GitOps?

GitOps makes Git the single source of truth for infrastructure. Every change is a pull request; the merge to the main branch is what drives an apply. Nothing is changed by hand in the console.

Plan on Pull Request

The core idea: when a PR opens, CI runs terraform plan and posts the result as a comment. Reviewers see exactly what will change before approving.

Apply on Merge

Once the PR merges to main, a separate workflow runs terraform apply with the saved plan. The Git history becomes an audit log of every infrastructure change.

A GitHub Actions Plan Job

This workflow triggers on pull requests and produces a plan artifact.

on:
  pull_request:
    branches: [main]

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init
      - run: terraform plan -out=tfplan

Posting the Plan to the PR

Capture the human-readable plan and post it as a comment so reviewers do not have to open CI logs.

terraform show -no-color tfplan > plan.txt

Saving the Plan Artifact

To guarantee the merge applies exactly what was reviewed, upload the binary plan as an artifact and apply that, not a fresh plan.

- uses: actions/upload-artifact@v4
  with:
    name: tfplan
    path: tfplan

The Apply Workflow

A push to main downloads the approved plan and applies it without prompting.

on:
  push:
    branches: [main]

jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - run: terraform apply -auto-approve tfplan

Drift Detection on a Schedule

Run a nightly plan to detect drift, manual changes that differ from code. If the scheduled plan shows changes, alert the team.

on:
  schedule:
    - cron: "0 2 * * *"

Environment Promotion

GitOps promotes the same code through environments using branches or directories. A change merges to dev, is validated, then promoted to prod via another PR.

envs/
  dev/main.tf
  staging/main.tf
  prod/main.tf

Required Reviews and Branch Protection

Protect main so applies cannot happen without an approved review and passing plan. Branch protection rules enforce this at the platform level.

Atlantis and Managed GitOps

Tools like Atlantis and Terraform Cloud's VCS integration automate this entire flow, including comment-driven atlantis apply commands directly in the PR.

Quick Check

Test your GitOps understanding.

Recap: Git as Source of Truth

You established a GitOps pipeline:

  • Plan posts to the PR for review.
  • Merge applies the saved, approved plan.
  • Scheduled plans detect drift.
  • Branch protection and tools like Atlantis enforce the flow.

Frequently asked questions

Is the “GitOps and Pull Request Automation” lesson free?

Yes — the full text of “GitOps and Pull Request Automation” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “GitOps and Pull Request Automation”?

Adopt a GitOps workflow where Terraform plans post automatically to pull requests and applies trigger on merge, giving reviewers full visibility. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “GitOps and Pull Request Automation” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Terraform in CI/CD Pipelines
  2. Automating `plan` and `apply`
  3. Secure Credential Management
  4. GitOps and Pull Request Automation
← Back to DevOps Bootcamp