DevOps Track · Day 7 Capstone Pipeline · 20 min
CI/CD Pipeline Automation
DevOps Terraform Sprint — Day 7
Automate terraform plan & apply in CI/CD pipelines with pull-request exit code validation gates and self-healing deployment checks
About Today's Capstone Lab
Congratulations on reaching Day 7! In this capstone lab, you will tie together everything you learned over the past 6 days into a continuous integration pipeline. You will construct a complete GitHub Actions Workflow (or local CI pipeline script) that automatically runs terraform fmt, terraform validate, tflint, checkov, and terraform plan on every Pull Request.
🎬
Day 7 Video WalkthroughComing Soon
An interactive 20-minute video walkthrough for Day 7 is currently in production. Follow the step-by-step interactive playbook below!
📦Sample Codebase & Working Solution (Day 7)Available Now
View on GitHubThe verified Day 7 sample code is live in the public GitHub repository. Clone it to get the complete working solution immediately.
Git Clone — Available Now
git clone https://github.com/letstrnsfrm-ai/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-7-cicd-pipeline1
Constructing the CI Quality Gate Workflow
GOAL
Create the declarative GitHub Actions workflow definition file in
.github/workflows/terraform-ci.yml.WORKFLOW YML
Create `.github/workflows/terraform-ci.yml`:
YAML — .github/workflows/terraform-ci.yml
name: "Terraform Infrastructure Quality Gate"
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
jobs:
terraform-ci:
name: "Lint, Scan & Plan"
runs-on: ubuntu-latest
steps:
- name: Checkout Source Code
uses: actions/checkout@v4
- name: Setup Terraform CLI
uses: hashicorp/setup-terraform@v3
with:
terraform_version: 1.7.5
- name: 1. Enforce Code Formatting Check
run: terraform fmt -check
- name: 2. Validate HCL Syntax
run: |
terraform init -backend=false
terraform validate
- name: 3. Static Security Scan
uses: bridgecrewio/checkov-action@master
with:
framework: terraform
output_format: cli
- name: 4. Generate Execution Plan
run: terraform plan -no-color -out=tfplan🏭Production Context & Enterprise Real-World Implementation
💡 Why We Are Doing This: Automating infrastructure validation in CI/CD pipelines eliminates manual approval delays and ensures every pull request is checked against security and syntax standards.
🏢 Real-World Production Usecase: Companies like GitHub, Netflix, and Shopify require all infrastructure modifications to pass automated CI pipelines before peer approval.
⚙️ How Implemented in Production: GitOps automation platforms (like Atlantis, Spacelift, or Terraform Cloud) execute `terraform plan` on Pull Requests and post formatted plan diff comments automatically.
2
Local Pipeline Runner Simulation Script
GOAL
Test the exact CI pipeline quality gate locally using a shell verification runner script.
RUNNER SCRIPT
Create a local runner script named
ci-gate-check.sh:Bash — ci-gate-check.sh
#!/usr/bin/env bash
set -e
echo "=== 1. Checking Code Formatting ==="
terraform fmt -check || { echo "❌ Code formatting error! Run 'terraform fmt'"; exit 1; }
echo "=== 2. Validating HCL Syntax ==="
terraform init -backend=false
terraform validate || { echo "❌ HCL syntax validation failed!"; exit 1; }
echo "=== 3. Generating Execution Plan ==="
terraform plan -no-color -out=tfplan || { echo "❌ Terraform plan failed!"; exit 1; }
echo "✅ ALL QUALITY GATES PASSED! Ready for deployment."🏭Production Context & Enterprise Real-World Implementation
💡 Why We Are Doing This: Local pipeline runner scripts allow platform engineers to test quality gate execution before opening external Pull Requests.
🏢 Real-World Production Usecase: DevOps teams use local verification scripts or Dockerized runners (like `act`) to simulate GitHub Actions workflows locally.
⚙️ How Implemented in Production: In production, developers run local pre-push scripts or `make ci-verify` targets to ensure 100% CI pass rates on remote PR branches.
3
Executing & Testing the Pipeline Gate
GOAL
Run the local CI gate runner and assert that all checks pass with exit code 0.
EXECUTE CI SCRIPT
Make script executable and run:
Terminal — Run CI Gate Script
chmod +x ci-gate-check.sh
./ci-gate-check.shEXPECTED OUTPUT
Pipeline Status
=== 1. Checking Code Formatting ====== 2. Validating HCL Syntax ===Success! The configuration is valid.✅ ALL QUALITY GATES PASSED! Ready for deployment.🏭Production Context & Enterprise Real-World Implementation
💡 Why We Are Doing This: Strict exit code enforcement (`set -e`) guarantees that if formatting, syntax, or plan generation fails, the pipeline aborts instantly.
🏢 Real-World Production Usecase: Production deployment gates automatically block invalid PRs from merging into main if any quality check fails.
⚙️ How Implemented in Production: GitHub branch protection rules require `status_checks` from Terraform CI to pass green before enabling the PR Merge button.
4
Course Completion & Certification
GOAL
Verify local infrastructure teardown and claim your DevOps Terraform Course Completion badge!
FINAL TEARDOWN
Clean up local plan files and containers:
Terminal — Final Teardown
# Delete plan files and workspace
rm -f tfplan ci-gate-check.sh
terraform destroy -auto-approveGRADUATION
🏆 Course Completed!
Congratulations! You have completed all 7 Days of the DevOps & Infrastructure as Code (Terraform) Sprint. You now possess practical, hands-on experience with HCL syntax, provider configuration, local state auditing, modular design, security scanning, and automated CI/CD deployment gates.
🏭Production Context & Enterprise Real-World Implementation
💡 Why We Are Doing This: Continuous learning and automated pipeline discipline transition teams from manual, vulnerable operations to production-grade GitOps.
🏢 Real-World Production Usecase: Enterprise Quality Engineering organizations train QEs and DevOps engineers in IaC pipelines to manage cloud infrastructure at scale.
⚙️ How Implemented in Production: Engineers leverage this 7-day pattern to build automated cloud platform pipelines, manage Kubernetes clusters, and enforce enterprise Policy as Code.
🚀 Coming Soon: Part 2 — Kubernetes & GitOps Extension (Days 8–14)
Take your DevOps & IaC skills to the next level with Part 2: Remote State & DynamoDB Locking, Kind/EKS Cluster Provisioning, Terraform Kubernetes & Helm Providers, Multi-Environment Architecture, and Automated GitOps with ArgoCD.