Conftest vs Tirith

Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.

Tirith is a free, open-source Linux command-line tool that evaluates infrastructure documents against declarative JSON policies. It reports passed and failed rules together with the affected resource and value. Its pipeline gate checks Terraform plan output and can return a nonzero exit code when a policy violation appears, before infrastructure changes are applied. Documented inputs include Terraform plans and state, Kubernetes manifests, Infracost breakdowns, and other JSON documents. Policies can use providers and evaluators such as ContainedIn, Equals, and RegexMatch, while the provider architecture can be extended for other formats. Local evaluation runs on the user’s runner, and the project says policies and documents are not sent elsewhere. Optional organization mode checks plans against StackGuardian policies and uploads a masked document. Tirith documents GitHub Actions, GitLab CLI use, Bitbucket Pipelines, other CI, and local execution. OpenTofu plans work like Terraform plans for the documented gate.