Reuse an existing plan

If your pipeline already runs terraform plan, there is no need to plan twice. Give the Action the binary plan file with plan-path. It skips terraform plan, and the diagram job needs no cloud credentials.

Same job

When the plan is created earlier in the same job:

- run: terraform -chdir=infrastructure plan -out=${{ runner.temp }}/tfplan
- uses: Tekchbila-Studios/infragram-action@v1
  with:
    working-directory: infrastructure
    plan-path: ${{ runner.temp }}/tfplan

From another workflow

When a separate workflow produces the plan, upload it as an artifact there, then build the diagram from a workflow_run trigger:

.github/workflows/infragram.yml

name: Infrastructure diagram

on:
  workflow_run:
    workflows: ["Terraform plan"]
    types: [completed]

permissions:
  contents: read
  id-token: write
  actions: read # to download another run's artifact

concurrency:
  group: infragram-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: true

jobs:
  diagram:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_wrapper: false
      - uses: actions/setup-go@v7
        with:
          go-version: stable
      - uses: actions/download-artifact@v8
        with:
          name: tfplan
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: Tekchbila-Studios/infragram-action@v1
        with:
          working-directory: infrastructure
          plan-path: tfplan

Notes:

• ref: head_sha. workflow_run checks out the default branch unless told otherwise. Without this line you would diagram the branch’s plan against main’s configuration.
• if: conclusion == 'success'. A failed plan workflow leaves no artifact, or a stale one. Diagramming a stale plan is worse than diagramming nothing.
• Concurrency on the branch. workflow_run carries no pull request number for the concurrency group, so the head branch plays that role.
• No pull request comment yet. Builds triggered by workflow_run render normally and appear in the dashboard under Diagrams, but they aren’t linked to a pull request, so no comment is posted. To get the comment, build the plan in the same pull_request workflow and pass it with plan-path as shown above.

Why terraform init still runs

terraform show -json needs each provider’s schema to decode a saved plan, so the provider plugins have to be on disk. With plan-path, the Action runs:

terraform init -input=false -backend=false

-backend=false installs providers without touching your backend. No state is read and no cloud identity is needed.

Plan files contain secrets

A binary plan stores every value, sensitive ones included, in plain text. If you pass one between workflows as an artifact, keep the retention short (retention-days: 1) and treat the artifact like a credential. The Infragr.am Action itself never uploads the plan. It reads the plan locally and sends only the sanitized bundle.

var-files, vars and terraform-args have no effect with plan-path, because the plan is already built.