Terraform in CI/CD

Running terraform apply from someone's laptop works until it doesn't — nobody else can see what was applied, credentials sit on individual machines, and there's no consistent record of what changed and why. The standard fix is running Terraform from CI: a pull request triggers a terraform plan whose output gets posted as a PR comment for review, and merging to main triggers the terraform apply, ideally gated by an explicit approval step for anything touching production.

You'll build this in GitHub Actions specifically, since it's free for public repos and common enough to be broadly transferable — the same shape (plan on PR, apply on merge, gate on approval) applies almost unchanged to GitLab CI, CircleCI, or HCP Terraform's own VCS-driven workflow if that's what your team actually uses.