Preventing merging without running `atlantis apply` on Gitlab

tiagomeireles commented 4 months ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.

Overview of the Issue

Currently, I am able to merge a merge request in Gitlab before atlantis apply is ran. I want the ability to prevent merge requests from being able to be merged without atlantis apply completing successfully.

There has been previous attempts for example https://github.com/runatlantis/atlantis/pull/2053 introduced this behavior but was rolled back because of workflows that are dependent on all CI jobs being completed.

https://github.com/runatlantis/atlantis/pull/3378 (unintentionally?) introduced this behavior again, then was reverted in https://github.com/runatlantis/atlantis/pull/3747.

https://github.com/runatlantis/atlantis/pull/2436#issuecomment-1211252243 describes the behavior I expect using Github.

Using 0.27.2, when I open a merge request that creates new resources. (I’m using resource "terraform_data" "example" {}) Atlantis autoplans, creating an external stage with the following jobs.

I expect there to be a pending atlantis/apply job to prevent the merge request from being merged as my repo require CI to be passing. If I revert https://github.com/runatlantis/atlantis/pull/3747/files#diff-6583ec7260b28e573c74e18e783ee24ba8dce7d0a2e6929c105cc7e74d3d9c6fL318-R319 from https://github.com/runatlantis/atlantis/pull/3747, I get the behavior I expect.

Then after a successful atlantis apply, the atlantis/apply job and atlantis/apply: <project> succeed and I can merge the merge request.

Are there other Gitlab users who have similar requirements? Am I missing something(e.g a flag?) that makes this possible?

I'm open to other methods of preventing merging without successful atlantis apply's. Happy to contribute any patches that support this workflow.

Reproduction Steps

Logs

Environment details

Atlantis version: 0.27.2
Deployment method: helm

Atlantis flags:

- --automerge
- --default-tf-version=v1.5.7 
- --enable-policy-checks

Atlantis server-side config file:

  ---
  repos:
  - id: /.*/
    plan_requirements: [undiverged]
    apply_requirements: [approved, mergeable, undiverged]
    import_requirements: [approved, mergeable, undiverged]
    workflow: terragrunt
  policies:
    owners:
      users:
        - tiago.meireles
    policy_sets:
      - name: standard
        path: /home/atlantis/policies/
        source: local
  workflows:
    terragrunt:
      plan:
        steps:
        - env:
            name: TERRAGRUNT_TFPATH
            command: 'echo "terraform${ATLANTIS_TERRAFORM_VERSION}"'
        - env:
            # Reduce Terraform suggestion output
            name: TF_IN_AUTOMATION
            value: 'true'
        - run:
            # Allow for targetted plans/applies as not supported for Terraform wrappers by default
            command: terragrunt plan -input=false $(printf '%s' $COMMENT_ARGS | sed 's/,/ /g' | tr -d '\\') -no-color -out $PLANFILE
            output: hide
        - run: terragrunt show $PLANFILE
        - run: terragrunt show -no-color -json $PLANFILE > $SHOWFILE
      apply:
        steps:
        - env:
            name: TERRAGRUNT_TFPATH
            command: 'echo "terraform${ATLANTIS_TERRAFORM_VERSION}"'
        - env:
            # Reduce Terraform suggestion output
            name: TF_IN_AUTOMATION
            value: 'true'
        - run: terragrunt apply -input=false $PLANFILE
      import:
        steps:
        - env:
            name: TERRAGRUNT_TFPATH
            command: 'echo "terraform${DEFAULT_TERRAFORM_VERSION}"'
        - env:
            name: TF_VAR_author
            command: 'git show -s --format="%ae" $HEAD_COMMIT'
        # Allow for imports as not supported for Terraform wrappers by default
        - run: terragrunt import -input=false $(printf '%s' $COMMENT_ARGS | sed 's/,/ /' | tr -d '\\')
      state_rm:
        steps:
        - env:
            name: TERRAGRUNT_TFPATH
            command: 'echo "terraform${DEFAULT_TERRAFORM_VERSION}"'
        # Allow for state removals as not supported for Terraform wrappers by default
        - run: terragrunt state rm $(printf '%s' $COMMENT_ARGS | sed 's/,/ /' | tr -d '\\')
      policy_check:
        steps:
        - env:
            name: TERRAGRUNT_TFPATH
            command: 'echo "terraform${ATLANTIS_TERRAFORM_VERSION}"'
        - env:
            # Reduce Terraform suggestion output
            name: TF_IN_AUTOMATION
            value: 'true'
        - run: terragrunt show -no-color -json $PLANFILE > $SHOWFILE
        - policy_check:
            extra_args: ["-p", "/home/atlantis/policies/", "--all-namespaces", "--parser=json", "--no-color"]

Repo atlantis.yaml file: N/A

Additional Context

shurkus commented 4 months ago

This is an ancient, foolish decision to adopt this MR, resulting in us living on v0.19.2.

stasostrovskyi commented 3 months ago

@shurkus What exactly makes you live on v0.19.2? PR that you referenced added an optional, disabled by default, feature for GitHub only.

shurkus commented 3 months ago

wrong here is this one #2053, corrected

chriskuchin commented 3 months ago

So this is completely broken for us on latest. The atlantis/apply top level job only ever shows up after we have applied one of the projects in a repo. But it doesn't prevent merging before anything has been applied.

To be clear I am not sure it has ever worked on gitlab or if it did I didn't notice when it broke and it's been burning us the last while

ebeltramo96 commented 3 months ago

Any updates? Our developers sometimes merge MRs before applying the terraform content because the pipeline succeeds even if there are changes ti be applied. We would love to have back the way to block this behavior!

tweiss-mdm commented 2 months ago

Maybe remove the right to merge to all developers ? (only Atlantisbot and Maintainer allowed to merge)

ebeltramo96 commented 2 months ago

we have it already limited, nevertheless this is something that should be blocked by a pending status pipeline in case some changes are detected

shurkus commented 1 month ago

Any news?

shurkus commented 1 month ago

Can be fixed by adding to plan_command_runner.go#L117

    // At this point we are sure Atlantis has work to do, so set commit status to pending
    if err := p.commitStatusUpdater.UpdateCombined(ctx.Log, ctx.Pull.BaseRepo, ctx.Pull, models.PendingCommitStatus, command.Plan); err != nil {
        ctx.Log.Warn("unable to update plan commit status: %s", err)
    }
    if err := p.commitStatusUpdater.UpdateCombinedCount(ctx.Log, ctx.Pull.BaseRepo, ctx.Pull, models.PendingCommitStatus, command.Apply, 0, len(projectCmds)); err != nil {
        ctx.Log.Warn("unable to update apply commit status: %s", err)
    }

but looks like it can break Github :crying_cat_face:

ebeltramo96 commented 3 weeks ago

I think this thread can be considered closed after the last version: v0.28.3

shurkus commented 3 weeks ago

Yep, tested and work fine

runatlantis / atlantis