Automate updates to Terraform-managed infrastructure

[forabi]

Relevant services:

• Terraform Enterprise (paid)
• Atalntis (open source, self-hosted)

Things to consider:

• Terraform allows arbitrary code execution. PRs from untrusted contributors should not be checked with terraform plan.
• No two plans can be pending at the same time. If one PR is open and a plan is generated for the changes in that PR, the other PR should not produce a plan until the other PR is either rejected or the plan is executed and the changes are applied to the infrastructure. Atlantis handles this out of the box.
• Once a PR is merged, the other pending PRs should be updated to be planned against the new changes in state. Atlantis can also handle this.