Previously I wrote a bunch of code to deal with terraform panicking.
This code used a pipe as the stdout/err buffer and there was a bug
because I wasn't reading off the pipe and it would get full.
While testing a fix, I realized when Terraform panics, the previous code
using CombinedOutput() just worked. As a result, I'm switching back to
that code.
Get the Mergeable status of the PR before updating the
Status. This allows for the Status to be a required
Status for merging the PR. This allows us to use the
atlantis status as a Required status, which is the
configuration often used, since most deployments
want to ensure tf plans have all been successfully
applied before merging
Issue: https://github.com/runatlantis/atlantis/issues/453
For repos with certain merge methods disabled (such as 'merge'), simply
hitting the GitHub `/merge` endpoint is not sufficient. Instead, we need
to check which methods are actually available, then use the appropriate
method.
With this change it will:
1. Default to 'merge' if enabled
2. Use 'rebase' if 'merge' is disabled and rebase is enabled
3. Use 'squash' if 'merge' is disabled
Automerging merges pull requests automatically if all plans have been
successfully applied.
* Save status of PR's to BoltDB so after each apply, we can check if
there are pending plans.
* Add new feature where we delete successful plans *unless* all plans
have succeeded *if* automerge is enabled. This was requested by users
because when automerge is enabled, they want to enforce that a pull
request's changes have been fully applied. They asked that plans not be
allowed to be applied "piecemeal" and instead, all plans must be
generated successfully prior to allowing any plans to be applied.
This flag can be set to either branch (default) or merge. If set to
branch, we will check out the head branch of the pull request (the
source). If set to merge, we will check out the base branch of the pull
request (the destination) and then attempt to perform a git merge of the
pull request branch. This simulates what will happen if the pull request
is merged.
This allows us to perform terraform commands on what the state of the
repo will be *after* the pull request is merged. This is useful if users
are often opening up pull requests from branches that aren't up to date
with master. With the branch strategy, the terraform plan might be
deleting resources that have been created in the master branch but with
the merge strategy, we merge the branch's changes into the master branch
and so don't have this problem.
Because of some weirdness with how terraform executes (it forks itself
and assigns the parent's stderr and stdout file descriptors to the
child) when terraform panics, Go's exec.CombinedOutput() blocks
indefinitely even though the terraform process has exited.
To handle this, we switch to using os.Pipe for the cmd's stderr/out
which for some reason allows Go to know when the process has exited.
Unfortunately, this brings up a new problem when reading the output from
that pipe. For some reason, after a terraform crash, we never get an EOF
on the pipe and so as we again get in a situation where we're blocking
indefinitely. To handle this, I've added an edge case where we look at
the log lines and if its the end of a terraform panic, we break out of
the loop.
Thanks Terraform 0.12-alpha for discovering this bug!
In Terraform 0.12 and above, you aren't allowed to set -var foo=bar
flags unless the foo variable is actually defined in code. Previously,
we were setting the following variables:
- atlantis_user
- atlantis_repo
- atlantis_repo_owner
- atlantis_repo_name
- atlantis_pull_num
Users could then use these variables if they wanted to, in their code.
The main use case was to name the assume role session in AWS:
provider "aws" {
assume_role {
role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
session_name = "${var.atlantis_user}-${var.atlantis_repo_owner}-${var.atlantis_repo_name}-${var.atlantis_pull_num}"
}
}
This is longer possible in 0.12.
The new flag takes in a Terraform Enterprise API token and attempts to
write a config file for that token to ~/.terraformrc on startup.
If the file already exists and its contents would change as a result of
us writing it, we error out.
This flag is useful if you're using the TFE backend for any of your
projects as that requires a .terraformrc file with a token for
authentication.
