Pro ยท Lesson 10 of 12
A pipeline should run the same commands a careful person runs: format, validate, test, plan, and a reviewed apply. HCP Terraform is one place those remote runs can live. It is a HashiCorp product.
Sign in to save your place.
CI is a clerk who refuses to file a plan they did not print. HCP Terraform is HashiCorp's office for that clerk. You can hire a different clerk. Do not assume the other clerk has the same keys.
Pin the Terraform version in the runner image or the version manager the runner actually uses. Run terraform fmt -check, terraform init -input=false, terraform validate, and terraform test on pull requests. Run terraform plan with saved output when the change should be reviewed. Apply from a protected branch or a reviewed run, not from a laptop that happens to have production credentials.
Store the plan and the state where the team can see them. A plan file is stale if someone else applies first. That is what the lock is for.
HCP Terraform, the product formerly called Terraform Cloud, runs remote plans and applies, stores remote state, and can require a human to confirm a run. Workspaces there are the remote environments from the workspaces lesson. Policy sets can use Sentinel, which is HashiCorp's policy product. Open Policy Agent shows up in some HashiCorp policy stories as well. Read the current policy page before you name a policy engine in a design.
HCP Terraform does not apply an OpenTofu configuration by you selecting OpenTofu in your heart. The runner is theirs. If you need tofu, use a CI job that installs OpenTofu and calls it, or a product that documents OpenTofu support. Do not write "HCP Terraform or any OpenTofu equivalent" as if a specific equivalent shipped with the same features.
| Step | Pull request | Protected apply |
|---|---|---|
| fmt -check | Yes | Yes |
| validate and test | Yes | Yes |
| plan | Yes, as a comment or artifact | Yes, and a human reads it |
| apply | No | Yes, after the plan is approved |
Step 1 of 3The pull request runs fmt, validate, and tests.
Step 2 of 3The plan is an artifact. It is not an apply.
Step 3 of 3Apply waits for review and a lock.
Do not point this at a production backend. The commands are the contract.
terraform version
terraform fmt -check -recursive
terraform init -input=false
terraform validate
terraform test
terraform plan -input=false -out=tfplan
# apply only on the protected path:
# terraform apply -input=false tfplan
Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.