I've seen it work best with an embedded plan. So engineers open a PR with terraform changes, the CI runs `terraform plan`, and comments on the PR with that dif

I've seen it work best with an embedded plan. So engineers open a PR with terraform changes, the CI runs `terraform plan`, and comments on the PR with that diff. So you can see if your terraform is valid, if you're going to be destroying things you shouldn't, etc. Larger, more complex testing is generally done by locally invoking your terraform on a testing environment. How this is setup kind of depends, but I've seen this work well for testing out complex changes before going to the PR & Plan stage.