tofu-garnish

Turn OpenTofu/Terraform outputs into a simple, readable static page on your repo's GitHub Pages, so engineers can find that ARN without running tofu output or spelunking through state.

👉 See it in action: live demo site

• 🔒 dependency-free (two stdlib-only Python scripts, no third-party actions)
• 🍽️ structure-aware HTML: tables, not JSON walls
• 🏢 discrete multi-workspace publishing without clobbering
• 🙈 sensitive outputs masked automatically
• 🔌 plug-and-play with dflook/terraform-github-actions

---

Docs follow the Diátaxis framework. Each section below is a quick scan; follow the link for the full page.

Tutorial

Add a workflow step after you pull your outputs:

steps:
  - uses: lowlydba/tofu-garnish@v1
    with:
      outputs-file: ${{ steps.tf-outputs.outputs.json_output_path }}
      title: My Stack Outputs

Push to main, then set Settings → Pages → Deploy from a branch → gh-pages. Every later push regenerates and republishes the page.

Full tutorial →

How-to guides

• Publish multiple workspaces, accounts, or tenants with the workspaces input, one page per workspace plus a landing page.
• Use it without dflook actions: pipe tofu output -json to a file and point the action at it.
• Consume outputs from scripts and other pipelines via the machine-readable outputs.json next to every page.
• Run the generator locally with python3 src/garnish.py, no Action required.

Full how-to guides →

Writing outputs

outputs.tf has no concept of tofu-garnish's page layout, so naming, descriptions, and shape all affect how well it renders. See Writing outputs.tf for a good garnish page — link it from your repo's AGENTS.md/CLAUDE.md if an AI agent authors your Tofu.

Reference

Input	Required	Default	Description
outputs-file	no*	none	Path to a JSON outputs file.
outputs	no*	none	Inline JSON string of outputs.
workspaces	no*	none	Multiline name=path pairs for multi-workspace sites.
title	no	Tofu Outputs	Title shown on the generated page(s).
deploy	no	"true"	Set "false" to only generate HTML.

* Exactly one of workspaces, outputs-file, or outputs must be provided.

Full reference → (all inputs/outputs, accepted input formats, site structure, CLI flags)

Explanation

Complex, dynamic Tofu configurations are great for platform teams and terrible as a lookup surface. tofu-garnish gives outputs a stable, human-readable URL, flattening the raw value/type/sensitive JSON into structure-aware HTML instead of a wall of braces.

Full explanation → (design rationale, sensitive value handling, security posture)

Development

$ pip install pytest pytest-cov ruff
$ python -m pytest --cov      # tests + coverage gate
$ ruff check . && ruff format --check .
$ zizmor --persona pedantic . # security audit