Conftest vs terraform-plugin-testing

Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.

terraform-plugin-testing is a free Go helper module for testing Terraform providers on Linux and macOS. It supports unit tests that exercise plugin code in isolation without network connections, and acceptance tests that run real Terraform plan, apply, refresh, and destroy operations. Acceptance testing includes Lifecycle, Import, Refresh, and Query modes. The plancheck package can inspect empty or non-empty plans, resource and data source values, and actions. The statecheck package checks known values, sensitive values, and comparisons between resource or data source attributes. The framework uses a local Terraform binary with standard Go testing tools, including go test and the testing package, so tests can run in continuous integration environments such as GitHub Actions. Acceptance runs may create and destroy infrastructure, which can consume quotas and incur expenses. Prerequisites include a recent stable Go release, Terraform CLI 0.12.26 or later, provider and resource access, and TF_ACC set to a value. The project uses Mozilla Public License v2.0.