Run FinOps policy evaluations in CI/CD
Cloud mode (live AWS scan) or Terraform mode (pre-deploy plan scan).

Quick Start · Inputs · How It Works · Ecosystem

---

Catch cost violations before they reach production. Two modes:

• Cloud mode: Scan live AWS resources for idle resources, tagging violations, and savings
• Terraform mode: Scan tfplan.json pre-deploy to catch policy violations before terraform apply

- uses: breakingthecloud/sofe-action@v2with:
api-key: ${{ secrets.SOFE_API_KEY }}fail-on: high

Quick Start — Cloud Mode

- uses: breakingthecloud/sofe-action@v2with:
api-key: ${{ secrets.SOFE_API_KEY }}mode: cloudfail-on: high

Quick Start — Terraform Mode

- run: terraform plan -out=tfplan && terraform show -json tfplan > tfplan.json
- uses: breakingthecloud/sofe-action@v2with:
api-key: ${{ secrets.SOFE_API_KEY }}mode: terraformplan-file: tfplan.jsonfail-on: high

Full Example — Terraform FinOps Gate

name: FinOps Pre-Deploy Gateon: pull_requestjobs:
terraform-scan:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v3
- name: Terraform Planrun: | cd infra/ terraform init && terraform plan -out=tfplan terraform show -json tfplan > tfplan.json - name: SOFE Pre-Deploy Scanuses: breakingthecloud/sofe-action@v2id: sofewith:
api-key: ${{ secrets.SOFE_API_KEY }}mode: terraformplan-file: infra/tfplan.jsonfail-on: high
- name: Comment findings on PRif: always() && github.event_name == 'pull_request'uses: actions/github-script@v7with:
script: | const findings = '${{ steps.sofe.outputs.findings-count }}'; const resources = '${{ steps.sofe.outputs.resources-scanned }}'; const failed = '${{ steps.sofe.outputs.failed }}'; const icon = failed === 'true' ? '❌' : '✅'; github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body: `## ${icon} SOFE Terraform Scan\n| Metric | Value |\n|--------|-------|\n| Resources scanned | ${resources} |\n| Findings | ${findings} |\n| Status | ${failed === 'true' ? 'FAILED (high+ severity)' : 'PASSED'} |` })

Full Example — Cloud Mode

name: FinOps Gateon: [push, pull_request]jobs:
sofe-evaluate:
runs-on: ubuntu-lateststeps:
- uses: breakingthecloud/sofe-action@v2id: sofewith:
api-key: ${{ secrets.SOFE_API_KEY }}mode: cloudfail-on: high
- name: Comment findings on PRif: github.event_name == 'pull_request'uses: actions/github-script@v7with:
script: | github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body: `## SOFE FinOps Report\n- Findings: ${{ steps.sofe.outputs.findings-count }}\n- Resources scanned: ${{ steps.sofe.outputs.resources-scanned }}` })

Inputs

Input	Description	Required	Default	Modes
api-key	SOFE API key (sk_sofe_xxx)	✅	—	both
mode	cloud or terraform	❌	cloud	—
plan-file	Path to tfplan.json	✅ (tf)	—	terraform
fail-on	Fail if findings ≥ severity	❌	(none)	both
resource-types	Filter resource types	❌	all	cloud
format	Output: table, json, markdown	❌	table	both
version	CLI version to install	❌	latest	cloud

Outputs

Output	Description
findings-count	Number of findings detected
resources-scanned	Number of resources scanned
failed	true if fail-on threshold was exceeded

How It Works

Cloud Mode

1. Installs the SOFE CLI binary
2. Runs sofe evaluate --cloud with your API key
3. SOFE evaluates your connected AWS account
4. Returns findings + optional pipeline failure

Terraform Mode

1. Reads your tfplan.json file (no CLI install needed)
2. POSTs it to api.sofe.dev/terraform/scan
3. Evaluates 6 pre-deploy policies (tags, sizing, encryption, etc.)
4. Returns findings + optional pipeline failure

Key advantage: Same policies work pre AND post deploy. Write once, enforce everywhere.

Terraform Policy Examples

Policy	What it catches
require-cost-tags	Resource without owner/env/costcenter tag
no-oversized-staging	Large instance in non-prod environment
s3-encryption-required	Bucket without SSE configured
no-public-s3	Bucket with public access
rds-multi-az-prod	Production RDS without Multi-AZ
naming-convention	Resource not following naming standard

Migration from v1

-- uses: breakingthecloud/sofe-action@v1+- uses: breakingthecloud/sofe-action@v2
with:
api-key: ${{ secrets.SOFE_API_KEY }}
+ mode: cloud
fail-on: high

Prerequisites

• SOFE account at platform.sofe.dev
• API key (add as SOFE_API_KEY secret in your repo)
• Cloud mode: AWS account connected in the SOFE platform
• Terraform mode: terraform show -json output as .json file

Ecosystem

Project	Description
sofe	Python engine (collectors + policies)
sofe-server	REST API server
sofe-cli	Go CLI (19 commands, TUI)
platform.sofe.dev	SaaS dashboard (free tier)
sofe.dev/docs	Documentation

License

Apache 2.0 — see LICENSE.

---

sofe.dev · Engine · finoptix.dev

_{Catch cost violations before they reach production.}