Check OpenTofu Modules on Every Pull Request

Module quality checks usually mean maintaining a CI runner with the right binary versions, and small teams often skip them entirely. This blueprint replaces that runner with a webhook-triggered Kestra flow. A pull request event hits the webhook URL, io.kestra.plugin.opentofu.cli.OpenTofuCLI loads the module tree from namespace files, tofu fmt -check -recursive rejects unformatted code, tofu validate rejects broken references and type errors, and Discord receives a pass or fail verdict with a link back to real logs.

How it works

1. on_module_change (io.kestra.plugin.core.trigger.Webhook) exposes a URL your Git provider calls on pull request events. The key is part of the URL, so replace the placeholder with a strong random value.
2. check_module loads everything under modules/ from namespace files into the working directory, keeping the module source in Kestra's namespace file editor or synced there from Git.
3. tofu fmt -check -recursive modules exits non-zero when any file needs reformatting, which fails the task and routes to the errors block.
4. tofu init -backend=false installs the providers the module references without touching any state backend, then tofu validate checks the code structurally.
5. report_success and report_failure post the two verdicts to Discord, each carrying the execution ID for the full log trail.

What you get

• PR checks for OpenTofu modules with no CI runner to provision, patch, or version-match.
• Formatting enforced mechanically, so reviews discuss design instead of whitespace.
• Validation that catches broken references before anyone plans against real state.
• A webhook endpoint any Git provider can call, with the raw request available to the flow.

Who it's for

• Platform teams publishing internal OpenTofu modules who want a quality bar on every change.
• Small teams without CI infrastructure dedicated to Terraform-style tooling.
• Anyone consolidating scattered CI jobs into the orchestrator that already runs their applies.

Why orchestrate this with Kestra

A CI runner for two read-only commands is a lot of standing infrastructure. Kestra already has the execution engine, the container isolation, the webhook endpoint, and the notification plugins, so the check becomes twelve lines of flow YAML. The same namespace files that feed this check can feed the plan and apply flows, which means the code being checked is exactly the code being deployed.

Prerequisites

• Module code available as namespace files under modules/, added through the namespace file editor or synced from Git.
• A Discord incoming webhook for the verdicts.
• No cloud credentials are needed, since -backend=false init and validate never touch real infrastructure.

Secrets

• DISCORD_WEBHOOK_URL: Discord incoming webhook URL.

Quick start

1. Add the DISCORD_WEBHOOK_URL secret to your Kestra namespace.
2. Create modules/main.tf in the namespace file editor with any valid OpenTofu code.
3. Execute the flow manually and confirm Discord reports passing checks.
4. Replace the webhook key with a strong random value and point your Git provider's pull request webhook at the trigger URL.

How to extend

• Sync the module repository into namespace files with Kestra's Git plugin so the webhook and the code stay in lockstep.
• Add tofu test as a further command once your modules ship test files.
• Parse the webhook body to include the branch and commit in the Discord verdict.
• Report the verdict back to the Git provider as a commit status through an HTTP request task instead of, or in addition to, Discord.

Links

• OpenTofu plugin documentation
• OpenTofu documentation