* Adding policy_check support into yaml config
* Added policy check model and runtime structs
* Adding BuildPolicyCheckCommand to ProjectCommandBuilder
* Return incorrectly deleted code
* Remove BuildAutoPolicyPlanCommand from ProjectCommandBuilder
* Split runAutoCommand into two functions
runAutoPlanCommand - does what originally RunAutoplancommand was doing
except now it returns CommandResult and []models.ProjectCommandContext
runAutoPolicyCheckCommand - accepts CommandContext, CommandResult, and
[]models.ProjectCommandContext as arguments and runs PolicyCheckStep runner
* Refactor RunCommentCommand
* Remove BuildPolicyCheckCommand and rename StepCmdExec back to TerraformExec
* Add policy step runner logic and conftest interfaces.
* Add show step runner to policy check stage.
* Adding models.PolicyCheckCommand to buildCtx
This also means buildPlanAllCommands call buildCtx twice once with
models.PlanCommand and once with models.PolicyCheckCommand
* Adding new project_command_builder that supports policy_check
* Refactoring PolicyCheck specific logic into a PolicyCheckProjectCommandBuilder
* Moving events.CommandContext to models.CommandContext this will allow me
to remove buildCtx method and move ProjectCommandContext creation into
models package
* Policy Owners might be different types, for that reason we are
refactoring Owners into its own struct with specific keys defining
different owner types
Co-authored-by: Nish Krishnan <nishk@lyft.com>
Co-authored-by: Nish Krishnan <nishkrishnan@users.noreply.github.com>
Remove extra quoting and instead add a backslach to each character in
the extra args before appending it to the command.
ex. atlantis plan -- -var key=val will result in:
sh -c "atlantis plan \-\v\a\r \k\e\y\=\v\a\l"
Fixes#697.
Since we're including the command output inside the error, we don't need
to also return the output. This was resulting in the error output being
printed twice.
Previously, if you were using project names and you had two projects
with the same directory and workspace but different workflows, running
"atlantis apply" would fail. This was because we weren't figuring out
what the project name was for each pending plan.
This change fixes this by extracting the project name from the planfile.
We also handle /'s in the project name by substituting them with '::'.
This allows us to convert them back to /'s when we're figuring out the
project names from the filenames. It's safe to do this because : isn't
an allowed character for project names.
We also remove a final substitution of invalid filename characters
because we rely on the validation of the project names instead which
happens when validating the atlantis.yaml file.
This version changes how we parse custom run steps.
Previously we used the go-shlex library to parse the steps but this
caused users issues because they'd have to use weird escaping.
Now we simply pass the step directy to sh -c without any parsing. The
parsing was unnecessary.
Features:
- remote plans and applies will set a commit status with a link to the
Terraform Enterpise UI where the streaming output can be viewed.
- because remote plans don't support the -out flag, we diff the plan
output between plan and apply phases to ensure users are applying the
plan they expected
How:
We add a new capability to execute a terraform command while
concurrently reading its real-time output and performing actions
accordingly.
If so, don't run plan with -out because this isn't currently supported.
Instead, write a planfile afterwards with the text contents of the plan.
During apply, detect that the planfile was generated using a remote plan
and run apply with -auto-approve and without the planfile arg which
isn't supported.
Get the Mergeable status of the PR before updating the
Status. This allows for the Status to be a required
Status for merging the PR. This allows us to use the
atlantis status as a Required status, which is the
configuration often used, since most deployments
want to ensure tf plans have all been successfully
applied before merging
Issue: https://github.com/runatlantis/atlantis/issues/453
In Terraform 0.12 and above, you aren't allowed to set -var foo=bar
flags unless the foo variable is actually defined in code. Previously,
we were setting the following variables:
- atlantis_user
- atlantis_repo
- atlantis_repo_owner
- atlantis_repo_name
- atlantis_pull_num
Users could then use these variables if they wanted to, in their code.
The main use case was to name the assume role session in AWS:
provider "aws" {
assume_role {
role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
session_name = "${var.atlantis_user}-${var.atlantis_repo_owner}-${var.atlantis_repo_name}-${var.atlantis_pull_num}"
}
}
This is longer possible in 0.12.
-target doesn't work with terraform apply when the apply is being run on
a planfile (which is how Atlantis runs plan). We should give the user an
error if they attempt this.
Fixes#399
Introduce new `mergeable` requirement, in similar vein to the `approved`
requirement. Ran `make go-generate` to update mocks accordingly.
This addresses issue #43.
Prior to this change, we were formatting the output from terraform plan
inside the markdown_renderer. Part of this formatting is to remove all
output relating to refreshing state. The way we were doing this was to
simply delete all lines before the refreshing completes.
The problem with this approach was that any output from custom steps
that ran before plan would also be deleted. This change moves the
formatting of the plan output inside the plan step. Then the
markdown_renderer deals with the pre-formatted output and doesn't need
to delete anything before it combines all the step outputs into one.
We should only allow project names (which are specified in an
atlantis.yaml file) that don't need to be url escaped. The one
exceptional character is '/' which we allow because users like to name
their projects to match the directory they're in. We use the same rule
that Terraform uses for workspace names.
I've also changed the characters that are replaced when writing out the
plan filename to only remove invalid filename characters instead of just
allowing alphanumeric. This is the smallest amount of change required to
ensure the filename is valid.
