Cost Guardrails CLI

Shift-left cost governance for CI/CD pipelines. One command validates your Terraform or CloudFormation plan against cost policies, budget limits, and guardrails — before infrastructure is deployed.

Note: A SKYXOPS subscription is required to use this CLI. This module can run as a standalone tool or be integrated into CI/CD pipelines.

Install

pip install cost-guardrails

Quick Start

# Set your API key
export COST_GUARDRAILS_API_KEY="your-api-key"

# Validate costs
cost-guardrails --plan plan.json --budget-code CS-FY2026-BU105-M03 --post-comment

Configuration

API URL is built-in. Set COST_GUARDRAILS_API_URL only for custom deployments.

CI/CD Integration

Azure DevOps (Extension)

Install the Cost Guardrails extension from the VS Marketplace, then use the native task:

- task: Cost Guardrails@1
  inputs:
    planPath: plan.json
    budgetCode: $(COST_GUARDRAILS_BUDGET_CODE)
  env:
    COST_GUARDRAILS_API_KEY: $(COST_GUARDRAILS_API_KEY)
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

Full Azure DevOps Guide

GitHub Actions

- uses: skyxops-io/costguard-action@v1
  with:
    plan-path: plan.json
    api-key: ${{ secrets.COST_GUARDRAILS_API_KEY }}
    budget-code: ${{ secrets.COST_GUARDRAILS_BUDGET_CODE }}

Full GitHub Actions Guide

GitLab CI

include:
  - remote: 'https://gitlab.com/skyxops-io/cost-guardrails-templates/-/raw/v1/gitlab/cost-guardrails.yml'

cost-guardrails:
  extends: .cost-guardrails-review
  needs: [terraform-plan]

Full GitLab CI Guide

Any CI/CD Platform

- script: |
    pip install -q cost-guardrails
    cost-guardrails --plan plan.json --post-comment
  env:
    COST_GUARDRAILS_API_KEY: $(COST_GUARDRAILS_API_KEY)

Generic CI/CD Guide

Output Formats

Exit Codes

Multi-Environment Tags

Use --tag to post separate comments for each Terraform root or environment in a single MR/PR:

cost-guardrails --plan prod/plan.json --tag production --post-comment
cost-guardrails --plan staging/plan.json --tag staging --post-comment

Each tag gets its own isolated comment. Without --tag, a single comment is posted. Set via env var: COST_GUARDRAILS_TAG.

Comment Behavior

--post-comment is idempotent: creates one comment on first run, updates it on re-push. No duplicates. Works on GitLab MRs, GitHub PRs, and Azure DevOps PRs.

How It Works

1. Reads plan file (Terraform plan.json or CloudFormation changeset)
2. Sends to Cost Guardrails API for pricing, budget validation, and guardrail checks
3. Displays cost breakdown, AI recommendations, and decision
4. Posts result as MR/PR comment (if --post-comment)
5. Exits with decision code so the pipeline can ALLOW, WARN, or BLOCK

No cloud credentials required — the CLI only reads the plan file.

Documentation

Integration Guides