​
Pre-requisites

  • Infracost binary installed into your CI pipeline (see Infracost docs)
  • Infracost API key

​
Set up Infracost

Use the official setup-infracost action in your workflow file (README)

- name: Setup Infracost
        uses: infracost/actions/setup@v2
        # See https://github.com/infracost/actions/tree/master/setup for other inputs
        # If you can't use this action, see Docker images in https://infracost.io/cicd
        with:
          api-key: ${{ secrets.INFRACOST_API_KEY }}

​
Breakdown

Use digger.yml like below to see infracost breakdown output:

projects:
- name: production
  dir: prod
  workflow: with-infracost

workflows:
  with-infracost:
    plan:
      steps:
        - init
        - plan
        - run: infracost breakdown --path=. | tee -a $DIGGER_OUT

After the pipeline run finishes, you should see Infracost breakdown output appended to digger run report comment as additional output:

​
Diff

For infracost diff we’d need to run Infracost twice: first to generate the breakdown on the main branch, then to generate diff on the PR branch. To help with that, Digger provides additional environment varialbes like $PROJECT_NAME and $PR_BRANCH (see custom commands). You can then configure your workflow in digger.yml to switch branch to main, generate base breakdown, switch back to PR branch, generate diff and finally show it via $DIGGER_OUT, like below:

steps:
        - init
        - plan
        - run: infracost breakdown --path=. | tee -a $DIGGER_OUT
        - run: git checkout $DEFAULT_BRANCH && infracost breakdown --path . --format=json --out-file=$RUNNER_TEMP/infracost-base-${PROJECT_NAME}.json && git fetch origin $PR_BRANCH && git checkout $PR_BRANCH
        - run: infracost diff --path=. --compare-to=$RUNNER_TEMP/infracost-base-${PROJECT_NAME}.json | tee -a $DIGGER_OUT

Then you’ll be able to see diff appended as comment like below:

Using CheckovUsing OPA (Conftest)