Is the Infra plugin safe to use against production infrastructure?

[fredcallagan]

Honest answer: be careful. Infra has several safety layers, but it's the youngest of the three plugins.

What it does to protect you:

• Environment promotion enforcement — you can't skip stages. If your pipeline is dev → staging → production, it refuses to deploy to production until staging is deployed and verified.
• CI/CD detection — if it finds existing pipeline configs, it recommends using CI/CD for staging/production instead of local apply.
• Pre-deployment checklist — IaC validation, security scan, cost estimation against your configured threshold, rollback plan verification, and a full diff of pending changes.
• Saved plan files — for OpenTofu/Terraform, it generates -out=deploy.tfplan so the exact reviewed plan is what gets applied.

That said: this is v2.2.0 of a tool that's still maturing. For production infrastructure, treat Arness Infra as an assistant that enforces good practice, not as a replacement for your own review. Always inspect the plan output before confirming. We've marked it as experimental in the docs for a reason.