Terraform PR Security Gate: GitHub, GPT-4.1 & Slack

Automatically secure your Terraform pull requests—with GitHub, OpenAI, and Slack sign-off

This n8n workflow reviews Terraform PRs on GitHub using an OpenAI tool-calling agent that can run plan, security, cost, and standards checks, then records results in Postgres, comments on the PR, and either auto-approves clean changes or routes flagged issues to Slack for human review.

What this workflow does

• Triggers on GitHub pull request events for your selected repository.
• Extracts PR metadata (repo, branch, author, title, PR number) and fetches full PR details from GitHub for review context.
• Runs an OpenAI agent with session memory to produce a structured JSON review. When required, it can call HTTP tools to:
  • Run a Terraform plan
  • Execute a Terraform security scan
  • Estimate cost impact
  • Query a vector store of internal IaC standards
• Parses the agent’s JSON output into findings, overall risk, verdict, blocking issues, and a cost impact summary.
• Logs the review into a Postgres table named terraform_pr_reviews and posts a formatted comment back to the GitHub PR.
• If the verdict is pass, the workflow submits a GitHub PR approval. Otherwise, it sends findings to Slack, waits for a human security decision, and then either approves or requests changes in GitHub.

Use cases

• Enforce Terraform security and standards on every GitHub PR before merge.
• Give security engineers a Slack hand-off for risky changes requiring approval.
• Maintain an audit trail of Terraform PR reviews via Postgres for reporting and compliance.
• Prevent unexpected spend by surfacing cost impact directly in PR comments.

Technical details

• n8n nodes: if, set, wait, Slack, GitHub, Postgres
• Integrations: GitHub (read PRs, post comments, approve/request changes), Slack (human decision routing), Postgres (store review records), OpenAI (tool-calling review agent)