install

Additional install commands

macOS

Homebrewverified · 100%

brew install tfmigrate

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install tfmigrate

MacPorts ports tree · sysutils/tfmigrate/Portfile · source: api.github.com

Linux

Nixverified · 92%

nix profile install nixpkgs#tfmigrate

nixpkgs package indexes · pkgs/by-name/tf/tfmigrate/package.nix · source: api.github.com

overview

Package summary

Terraform/OpenTofu state migration tool for GitOps

Project links

Commands and aliases

tfmigrate

history

Project history and usage

tfmigrate is a Terraform and OpenTofu state migration tool for GitOps. Its README frames Terraform state operations as code: write state moves, removals, imports, and related operations in HCL, review them in git, then plan and apply them in sequence.

Project history

The project was created to address a common production Terraform problem: state manipulations are unavoidable during refactoring, but raw `terraform state` commands are error-prone and do not fit well into pull-request and CI/CD workflows. tfmigrate's README explicitly argues that state operations should be committed to git.

The tool wraps Terraform or OpenTofu under the hood rather than reimplementing their state mechanics. It supports dry-run planning with temporary local state, migration history, local/S3/GCS storage for applied migration records, monorepo-style state splits and merges, and migration files written as HCL.

Recent release notes show continuing maintenance for the changing Terraform ecosystem, including support for OpenTofu versions, Terraform 1.11 through 1.15, Terragrunt CLI redesign handling, configurable environment injection into `.tfmigrate.hcl`, and GitHub Actions and Go toolchain updates.

Adoption history

The repository shows more than a thousand GitHub stars and is packaged by Homebrew, MacPorts, and Nix in the input metadata. That adoption profile fits a tool used by infrastructure teams with long-lived Terraform states and CI-based review.

tfmigrate's appeal is strongest for teams that already use GitOps: it lets state migrations travel with the configuration change they support, instead of being performed manually before or after a merge.

How it is used

The documented workflow is to write a migration file such as `state_mv.hcl`, run `tfmigrate plan` to verify the state operation against Terraform plan output without updating remote state, and then run `tfmigrate apply` to push the migrated state when the plan is clean.

tfmigrate can invoke `terraform`, `tofu`, or Terragrunt via `TFMIGRATE_EXEC_PATH`, and the README recommends trying the included sandbox before using the tool on production state.

Why package nerds care

tfmigrate is important in package metadata because it solves a lifecycle problem that plain Terraform intentionally leaves low-level. It turns one-off state surgery into reviewable, repeatable migration files.

As a package-manager tool, it is most useful when installed in CI images and developer machines beside Terraform/OpenTofu, making the same state migration command available during local rehearsal and automated review.

Timeline

2025: v0.4.2 release notes add OpenTofu 1.9, Terraform 1.11, Terragrunt CLI redesign handling, and environment injection into `.tfmigrate.hcl`.
2025: v0.4.3 release notes add OpenTofu 1.10 and Terraform 1.12 support.
2025: v0.4.4 release notes add OpenTofu 1.11 and Terraform 1.14 support.
2026: v0.4.5 is listed as the latest release and includes Terraform 1.15 support.

Related projects

Terraform and OpenTofu are the execution engines tfmigrate invokes.
Terragrunt is supported through `TFMIGRATE_EXEC_PATH` with version-specific guidance.
Digger is mentioned in recent release notes as an integration example.

Sources

https://github.com/minamijoyo/tfmigrate
https://github.com/minamijoyo/tfmigrate/releases
source_facts.package-manager

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

narrow executable package without higher-risk signals

Signals

metadata:no-higher-risk-signals

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: .tfmigrate.hcl

executables

Installed executables

Command	Kind	Exposure	Note
`tfmigrate`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version0.4.5

manager updated2026-05-15

local dataok

upstreamcurrent

latest detectedv0.4.5

https://github.com/minamijoyo/tfmigrate

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:tfmigrate
Version	0.4.5
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/tfmigrate
Homepage	https://github.com/minamijoyo/tfmigrate
Repository	https://github.com/minamijoyo/tfmigrate
Upstream docs	https://github.com/minamijoyo/tfmigrate
License	MIT
Source archive	https://github.com/minamijoyo/tfmigrate/archive/refs/tags/v0.4.5.tar.gz
Last updated	2026-05-15T01:31:36+09:00
Pulse	updated
Build dependencies	go
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	tfmigrate
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

tfmigrate

nix profile install nixpkgs#tfmigrate

normalized package name match
Matched by: Tfmigrate

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/tf/tfmigrate/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

MacPorts95%

tfmigrate

sudo port install tfmigrate

normalized package name match
Matched by: Tfmigrate

MacPorts ports tree · api.github.com · MacPorts ports tree: sysutils/tfmigrate/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/tfmigrate.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install tfmigrate with Homebrew, MacPorts, Nix