From 6c129199d6ca4a34157c7e5a32d47469a4ad727a Mon Sep 17 00:00:00 2001 From: Ricard Bejarano Date: Sun, 13 Apr 2025 00:39:21 +0200 Subject: [PATCH] fix: only allow team slug support in `--gh-team-allowlist` by dropping support for ambiguous team names (#5510) Signed-off-by: Ricard Bejarano Co-authored-by: PePe Amengual <2208324+jamengual@users.noreply.github.com> Co-authored-by: Rui Chen Co-authored-by: RB <7775707+nitrocode@users.noreply.github.com> --- runatlantis.io/docs/server-configuration.md | 13 +++++-------- server/events/vcs/github_client.go | 2 +- server/events/vcs/github_client_test.go | 2 +- 3 files changed, 7 insertions(+), 10 deletions(-) diff --git a/runatlantis.io/docs/server-configuration.md b/runatlantis.io/docs/server-configuration.md index 1e658a244..88fc25fa8 100644 --- a/runatlantis.io/docs/server-configuration.md +++ b/runatlantis.io/docs/server-configuration.md @@ -686,12 +686,14 @@ based on the organization or user that triggered the webhook. ### `--gh-team-allowlist` ```bash - atlantis server --gh-team-allowlist="myteam:plan, secteam:apply, DevOps Team:apply, DevOps Team:import" + atlantis server --gh-team-allowlist="myteam:plan, secteam:apply, devops-team:apply, devops-team:import" # or - ATLANTIS_GH_TEAM_ALLOWLIST="myteam:plan, secteam:apply, DevOps Team:apply, DevOps Team:import" + ATLANTIS_GH_TEAM_ALLOWLIST="myteam:plan, secteam:apply, devops-team:apply, devops-team:import" ``` - In versions v0.21.0 and later, the GitHub team name can be a name or a slug. + In versions v0.35.0 and later, the GitHub team name can only be a slug because it is immutable. + + In versions between v0.21.0 and v0.34.0, the GitHub team name can be a name or a slug. In versions v0.20.1 and below, the Github team name required the case sensitive team name. @@ -699,11 +701,6 @@ based on the organization or user that triggered the webhook. By default, any team can plan and apply. - ::: warning NOTE - You should use the Team name as the variable, not the slug, even if it has spaces or special characters. - i.e., "Engineering Team:plan, Infrastructure Team:apply" - ::: - ### `--gh-token` ```bash diff --git a/server/events/vcs/github_client.go b/server/events/vcs/github_client.go index f36e6af43..1bcb461b6 100644 --- a/server/events/vcs/github_client.go +++ b/server/events/vcs/github_client.go @@ -1052,7 +1052,7 @@ func (g *GithubClient) GetTeamNamesForUser(logger logging.SimpleLogging, repo mo return nil, err } for _, edge := range q.Organization.Teams.Edges { - teamNames = append(teamNames, edge.Node.Name, edge.Node.Slug) + teamNames = append(teamNames, edge.Node.Slug) } if !q.Organization.Teams.PageInfo.HasNextPage { break diff --git a/server/events/vcs/github_client_test.go b/server/events/vcs/github_client_test.go index f71a629f3..2483642f4 100644 --- a/server/events/vcs/github_client_test.go +++ b/server/events/vcs/github_client_test.go @@ -1406,7 +1406,7 @@ func TestGithubClient_GetTeamNamesForUser(t *testing.T) { Username: "testuser", }) Ok(t, err) - Equals(t, []string{"Frontend Developers", "frontend-developers", "Employees", "employees"}, teams) + Equals(t, []string{"frontend-developers", "employees"}, teams) } func TestGithubClient_DiscardReviews(t *testing.T) {