# Plan Terraform

> Run and review an Azure-backed Terraform plan for an infrastructure pull request without changing the user's worktree or remote state.

- Skill: `learntocloud/plan-terraform` (Agent Skill)
- Install (CLI): `npx skillmds@latest add learntocloud/plan-terraform`
- Raw SKILL.md: https://api.skillmd.com/api/skills/learntocloud/plan-terraform/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: learntocloud (https://skillmd.com/u/learntocloud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/learntocloud/plan-terraform

---


# Plan Terraform Pull Request

Use the supplied PR. If omitted, select it only when exactly one open PR changes
`infra/**`; otherwise ask the user.

1. Confirm the PR is open, targets `main`, and changes `infra/**`.
2. Update it with `main`, then record the exact head SHA.
3. Verify Azure CLI authentication, Terraform availability, and that the active
   subscription matches repository variable `AZURE_SUBSCRIPTION_ID`.
4. Create a detached worktree for that SHA under the current session's `files/`
   directory. Never plan in the primary worktree.
5. Inspect `.github/workflows/infra-deploy.yml` and mirror its current backend
   key and `TF_VAR_*` inputs. Retrieve required repository variables and Azure
   values without printing secrets.
6. In the worktree's `infra/`, run:

   ```bash
   terraform init -backend-config="key=learn-to-cloud-${AZURE_ENV_NAME}.tfstate"
   terraform plan -input=false -lock-timeout=120s -no-color
   ```

7. Remove the temporary worktree on success or failure.

Never save a plan file, apply, unlock, import, modify state, merge the PR, or
expose secrets.

Report every resource action and compare it with the diff. `No changes` is the
expected result for provider-only updates. Block on destroy/replacement,
identity or authentication changes, state-access failures, authorization
errors, or actions not explained by the PR.