feat: Add Terraform integration

[smithjilks]

Implements #2348

What changed

Adds a Terraform (HCP Terraform / Terraform Enterprise) integration with the following components:

Triggers:

• On Run Event — listens to run state transitions (created, planning, applying, completed, errored, drift detected, etc.)

Actions:

• Run Plan — queues a new run for a workspace

Why

Enables SuperPlane workflows to orchestrate Terraform Cloud infrastructure changes — for example, requiring manual approval before applying production changes, tracking run progress, or sending Slack notifications when runs fail or drift is detected.

How

Triggers — On Run Event

• Fire when Terraform Cloud sends a notification to the configured webhook
• Optional event type filter to scope the trigger to specific run states
• Emits a terraform.runEvent or terraform.needsAttention event with run details (runId, status, workspace, URL, etc.)

Action — Run Plan

• Creates a seculative plan on Terraform.

Integration setup

• Authenticates via a Terraform Cloud Team API token configured by the user
• Automatically creates a signed webhook in Terraform Cloud on canvas save — no manual setup required
• Verifies incoming webhook requests using HMAC-SHA512 signatures (X-TFE-Notification-Signature header)
• Automatically deletes the webhook from Terraform Cloud when the trigger is removed

Demo

Screencast.From.2026-03-03.13-59-54.mp4

[lucaspin]

Each component needs to be in its own file

[lucaspin]

We shouldn't import the SDK

[lucaspin]

Why put this in a separate file and function?

[lucaspin]

We already have an approval core component, which allow you to select users / roles / groups to approve. I don't think a separate one just for controlling terraform runs is required.

[cursor]

Accidentally committed development note in component mapper

Low Severity

The comment // removed terraformDataBuilder is a leftover development note. There is no terraformDataBuilder anywhere else in the codebase — this was a personal reminder during development that wasn't cleaned up before submitting the PR.

 

[cursor]

Unused exported client methods add dead code

Low Severity

The exported methods ApplyRun, DiscardRun, OverridePolicy, ListPolicyChecks, and the PolicyChecksPayload type are defined but never called anywhere in the codebase. The PR reviewer explicitly asked to "just do a simple 'Run plan' component first," and only CreateRun, ReadRun, and CancelRun are actually used.

Additional Locations (1)

• pkg/integrations/terraform/client_runs.go#L34-L44

 

[cursor]

Retry error message reports wrong attempt count

Low Severity

The error message at the end of the retry loop always reports maxRetries (3) as the number of attempts, but the loop can exit early — for example, on a 4xx client error (not 429) it breaks after just one attempt, or if newRequest fails it also breaks immediately. The resulting error message "failed to create terraform webhook after 3 attempts" would be inaccurate, potentially confusing during debugging.

Additional Locations (1)

• pkg/integrations/terraform/webhook.go#L165-L211

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Terminal state "planned" causes premature poll termination

Medium Severity

Including "planned" in isTerminalStatePlanTarget causes polling to stop at an intermediate state. For plan-only runs on workspaces with cost estimation or Sentinel policies, the run progresses planned → cost_estimating → … → policy_checking → policy_checked/policy_soft_failed → planned_and_finished. By treating "planned" as terminal, the poll exits before those phases run, emitting on the "passed" channel. If a Sentinel policy later soft-fails, the workflow never sees the policy_soft_failed state — even though isFailedState was written to catch it. This makes the downstream cost_estimated, policy_checked, and policy_soft_failed cases in isTerminalStatePlanTarget effectively unreachable for most runs.

Additional Locations (1)

• pkg/integrations/terraform/plan.go#L261-L268