> ## Documentation Index
> Fetch the complete documentation index at: https://docs.draftt.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Draftt CI

Draftt CI scans the Terraform or OpenTofu plan of each pull request against your Draftt policies and shows every violation on the pull request, before the change is applied. Reviewers see which resources break which policy, and what to change, next to the code.

## How it works

1. A pull request is opened or updated, and your workflow runs `terraform plan` as usual.
2. The Draftt step scrubs the plan JSON on the runner, removing every value Terraform marks sensitive, and uploads the scrubbed copy to Draftt.
3. Draftt evaluates the changed resources against your policies.
4. The Draftt CI GitHub App publishes the result as a check and a comment on the pull request.

```mermaid theme={null}
%%{init: {"theme": "base", "themeVariables": {"fontSize": "12px", "primaryColor": "#eeedfe", "primaryBorderColor": "#8b7cf6", "primaryTextColor": "#1f2328", "lineColor": "#6e7681", "clusterBkg": "#f6f8fa", "clusterBorder": "#d0d7de"}}}%%
flowchart TB
  PR["Pull request\nopened or updated"]
  subgraph runner["Your GitHub Actions workflow"]
    PLAN["terraform plan"] --> STEP["Draftt step scrubs\nand uploads the plan"]
  end
  subgraph draftt["Draftt"]
    EVAL["Evaluates the changed resources\nagainst your policies"] --> APP["Draftt CI GitHub App"]
  end
  PR --> PLAN
  STEP --> EVAL
  APP -. "check and comment" .-> PR
```

The step needs no GitHub token, and a policy violation never fails your workflow: the check reports, it does not block.

## Set up Draftt CI

Two pieces, set up once each:

1. [Install the Draftt CI GitHub App](https://docs.draftt.io/draftt-ci-github-app.md) on the repositories that hold your Terraform code. This binds your GitHub organization to your Draftt organization and lets Draftt publish on your pull requests.
2. [Add the Draftt CI GitHub Action](https://docs.draftt.io/draftt-ci-action.md) to the workflow that produces your plan, with a Draftt access key.

## What the pull request shows

A **Draftt Terraform Policy Scan** check and a comment, updated on every push. For each changed resource that violates a policy, you see the resource, the policy, and the change needed, with a link to the line in your code.

![Draftt CI check on a pull request: two changed resources, each non-compliant with a policy, linked to the line in the Terraform file.](https://mintcdn.com/draftt/OKGfcpSUL8IIQRCZ/images/draftt-ci-check-policies.png?fit=max\&auto=format\&n=OKGfcpSUL8IIQRCZ\&q=85\&s=5abf9eb0af0ff3aba471f4f89b930ba0)

The check concludes `success` when no changed resource violates a policy and `neutral` when one does. It never concludes `failure`. This is on purpose: Draftt CI should never block a team on the day it is adopted, so the check reports and lets your reviewers decide. Don't make it a required status check.

When you are ready to enforce, you have two levers:

* **Fail on scan errors.** Set `fail-on-scan-error: "true"` on the Draftt step, and the step fails when the plan could not be scanned, for example because the key is missing.
* **Fail on violations.** Read the `violation-count` output in a later step and fail the job when it is not `0`, and make that job a required status check. See [Outputs](https://docs.draftt.io/draftt-ci-action.md#outputs).

## Next

* [Draftt CI GitHub App](https://docs.draftt.io/draftt-ci-github-app.md): installation, how it works, results on the pull request, settings.
* [Draftt CI GitHub Action](https://docs.draftt.io/draftt-ci-action.md): the workflow step, inputs, outputs, several root modules, what is sent to Draftt, limits and troubleshooting.
* Questions: [support@draftt.io](mailto:support@draftt.io).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.