Auto-review Terraform PRs with n8n: GitHub + GPT-4.1 + Postgres + Slack

GitHub PR trigger → AI Agent calls tools (plan / security scan / cost estimate / standards search) → structured review → Postgres archive + PR comment → auto-approve or Slack human review

Who

Platform and security engineers who need automated code review and compliance gating for Terraform infrastructure changes

You get

PRs automatically trigger multi-dimensional review (plan diff, security, cost, org standards), results are written to a database and commented on the PR; low-risk PRs are auto-approved, high-risk ones are escalated to Slack for human confirmation

You need

n8n · github · openai · memory · ai-agent · slack

Steps

1. Configure GitHub trigger

   Import the workflow template into n8n and configure the GitHub Trigger node: select the target repository owner and repository, and set the event type to pull_request. Ensure the GitHub credential has repo scope and PR read/write access.

2. Extract PR metadata and fetch diff

   When triggered, the Set - Config node extracts prNumber, repoOwner, repoName, branch, prAuthor, prTitle from the webhook payload, and generates a sessionId (format: owner/repo#prNumber). The Get - PR Diff node then calls the GitHub API to fetch the full PR details for review context.

3. Run AI Agent multi-tool review

   The AI Agent - Terraform Reviewer node receives PR context, bound to the OpenAI Chat Model (gpt-4.1) and Window Buffer Memory (sessionId as the session key, retaining 20 turns of context). The agent calls four tools on demand: run_terraform_plan (HTTP tool, read-only plan, never apply), run_security_scan (static security scan), estimate_cost_impact (monthly cost delta), and search_iac_standards (vector store RAG for org conventions). The agent must base its review on tool outputs and must not guess.

   Execution prompt · Source text。AI Agent - Terraform Reviewer node text parameter (promptType=define)

   Copy prompt

   =You are a senior Platform/Security engineer reviewing a Terraform pull request before it can merge.
   
   Repo: {{ $json.repoOwner }}/{{ $json.repoName }} | Branch: {{ $json.branch }}
   PR #{{ $json.prNumber }} by {{ $json.prAuthor }}: "{{ $json.prTitle }}"
   
   You have four tools: run_terraform_plan (resource-level diff), run_security_scan (static security findings), estimate_cost_impact (monthly cost delta), search_iac_standards (org conventions/precedent). Use whichever combination is relevant — call multiple tools, and call them again with different parameters if needed — before writing your review. Do not guess plan output, scan findings, or cost numbers; only state what the tools returned.
   
   If earlier turns exist in this conversation (same PR), treat this as a re-review after a new push and note what changed since the prior review.
   
   Categorize findings under: security, cost, correctness (will the plan do what the PR claims), and standards (naming/tagging/module conventions). Assign each finding a severity ('low'|'medium'|'high'|'critical'). Set overallRisk to the highest severity present. List any 'critical' or 'high' security finding, or any plan output showing a destroy of a stateful resource (database, volume) as a blockingIssue requiring human sign-off.
   
   Return ONLY a JSON object (no markdown fences, no commentary) with keys: summary (2-4 sentences), findings (array of {category, description, severity}), overallRisk ('low'|'medium'|'high'|'critical'), verdict ('pass'|'flag_for_review'), blockingIssues (array of strings, empty if none), costImpactSummary (string).

4. Parse output and publish review

   The Set - Parse Agent Output node extracts structured data via JSON.parse. The Postgres - Log PR Review node inserts the review record into the terraform_pr_reviews table (columns: pr_number, repo, author, findings, overall_risk, verdict, blocking_issues, cost_impact_summary, created_at). The GitHub - Post Review Comment node publishes a formatted review comment to the PR.

   Execution prompt · Source text。GitHub - Post Review Comment node body parameter

   Copy prompt

   =### 🤖 Terraform Review — Verdict: {{ $json.parsedOutput.verdict.toUpperCase() }} (risk: {{ $json.parsedOutput.overallRisk }})
   
   {{ $json.parsedOutput.summary }}
   
   **Findings**
   {{ $json.parsedOutput.findings.map(f => '- [' + f.severity + '] (' + f.category + ') ' + f.description).join('\n') }}
   
   **Cost impact:** {{ $json.parsedOutput.costImpactSummary }}
   
   {{ $json.parsedOutput.blockingIssues.length ? '**Blocking issues requiring human sign-off:**\n' + $json.parsedOutput.blockingIssues.join('\n') : 'No blocking issues.' }}

5. Conditional approval or security escalation

   The IF - Review Passed node checks the verdict. If pass, GitHub - Approve PR (auto) approves the PR for merge. If flag_for_review, Slack - Request Security Review sends an alert to the configured channel (e.g. #terraform-security-review), and Wait - For Security Sign-Off pauses for a human callback. After the reviewer calls the webhook with securityApproved=true, IF - Security Approved routes to GitHub - Approve PR (delayed); otherwise GitHub - Request Changes requests changes.

   Execution prompt · Source text。Slack - Request Security Review node text parameter

   Copy prompt

   =🔒 *Terraform PR flagged for security review*
   
   *PR:* {{ $json.repoOwner }}/{{ $json.repoName }}#{{ $json.prNumber }} — "{{ $json.prTitle }}" by {{ $json.prAuthor }}
   *Overall risk:* {{ $json.parsedOutput.overallRisk }}
   
   *Blocking issues:*
   {{ $json.parsedOutput.blockingIssues.join('\n') }}
   
   *All findings:*
   {{ $json.parsedOutput.findings.map(f => '- [' + f.severity + '] (' + f.category + ') ' + f.description).join('\n') }}
   
   Reply or use the Approve/Request-Changes action to make the merge decision.

   Execution prompt · Source text。GitHub - Request Changes node body parameter

   Copy prompt

   =Changes requested after security review. Blocking issues:
   {{ $json.parsedOutput.blockingIssues.join('\n') }}

You are an n8n workflow setup assistant. The user wants to replicate the "AI Terraform PR Review" template. First confirm: 1) Does the user have GitHub repository admin access? 2) Is an OpenAI API key ready? 3) Is there a Postgres database and a Slack workspace? 4) Are CI endpoints exposing terraform plan / security scan / cost estimate APIs? 5) Is a vector store loaded with internal IaC standards? After confirmation, guide the user to import the template from https://n8n.io/workflows/19175/, configure credentials and node parameters step by step, and finally suggest verifying end-to-end with a test PR.