fix: filter apply plans through autodiscover.ignore_paths#6332
Closed
jholm117 wants to merge 4 commits into
Closed
fix: filter apply plans through autodiscover.ignore_paths#6332jholm117 wants to merge 4 commits into
jholm117 wants to merge 4 commits into
Conversation
jholm117
force-pushed
the
fix/ignore-paths-apply
branch
2 times, most recently
from
e636edb to
9a5a32d
Compare
dosubot
Bot
added
bug
jholm117
force-pushed
the
fix/ignore-paths-apply
branch
from
9a5a32d to
a9dbddf
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a behavioral inconsistency where atlantis apply (without -p) could discover and attempt to apply .tfplan files from paths that should be excluded by autodiscover.ignore_paths, even though atlantis plan already respects those ignore rules.
Changes:
- Add
autodiscover.ignore_pathsfiltering to the multi-apply path (buildAllProjectCommandsByPlan) after pending plans are discovered. - Adjust
isAutoDiscoverPathIgnoredto avoid default/global autodiscover config unintentionally suppressing repo-levelignore_paths. - Add tests to ensure ignored paths are not applied for both global-config and repo-config ignore_paths scenarios.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
server/events/project_command_builder.go |
Filters pending plans during multi-apply via ignore_paths; updates global-vs-repo ignore_paths precedence logic. |
server/events/project_command_builder_test.go |
Adds multi-apply tests asserting plans under ignored paths (e.g., .terraform/**) do not generate apply contexts. |
jholm117
force-pushed
the
fix/ignore-paths-apply
branch
from
bd12e1c to
788c07e
Compare
jholm117
force-pushed
the
fix/ignore-paths-apply
branch
from
788c07e to
e2481df
Compare
lukemassa
reviewed
Apr 11, 2026
buildAllProjectCommandsByPlan() used PendingPlanFinder.Find() which only filtered .terragrunt-cache/ directories. This meant atlantis apply (without -p) would discover and attempt to apply .tfplan files in paths that should be ignored per autodiscover.ignore_paths (e.g. .terraform/modules/). Fix: after PendingPlanFinder.Find() returns, load the repo config and filter plans through isAutoDiscoverPathIgnored() before building commands. This mirrors the filtering already done in the plan path (getMergedProjectCfgs). Also fix isAutoDiscoverPathIgnored() to fall through to repo-level config when the global config has AutoDiscover set but no IgnorePaths. Previously, the default global config (which always sets AutoDiscover with mode=auto) would shadow repo-level ignore_paths from atlantis.yaml. Fixes: runatlantis#6325 Signed-off-by: Jeff Holm <jholm117@gmail.com>
- Use IgnorePaths != nil instead of len() > 0 so an explicitly empty global ignore_paths can override repo-level config - Skip explicitly configured project dirs when filtering apply plans, matching the plan-path behavior in getMergedProjectCfgs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jeffrey Holm <jeff.holm@scale.com>
jholm117
force-pushed
the
fix/ignore-paths-apply
branch
from
e2481df to
d5ba14c
Compare
jholm117
added a commit
to jholm117/atlantis
that referenced
this pull request
Apr 16, 2026
Both buildAllCommandsByCfg and buildAllProjectCommandsByPlan were doing the same HasRepoCfg then ParseRepoCfg sequence. Extract it into a single helper so the logic lives in one place. Addresses review feedback on runatlantis#6332.
Signed-off-by: Rui Chen <rui@chenrui.dev>
Signed-off-by: Rui Chen <rui@chenrui.dev>
Member
|
Superseded by #6397 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
autodiscover.ignore_pathsis correctly respected duringatlantis plan(viagetMergedProjectCfgs→isAutoDiscoverPathIgnored), butatlantis apply(without-p) usesPendingPlanFinder.Find()which only filters.terragrunt-cache/directories. This means apply discovers and attempts to apply.tfplanfiles in paths that should be ignored (e.g..terraform/modules/).Changes
server/events/project_command_builder.go—buildAllProjectCommandsByPlan(): AfterPendingPlanFinder.Find()returns plans, load the repo config from the default workspace dir and filter plans throughisAutoDiscoverPathIgnored()before building command contexts.server/events/project_command_builder.go—isAutoDiscoverPathIgnored(): Fix global config shadowing repo-levelignore_paths. The default global config always setsAutoDiscover(withmode=auto, noIgnorePaths), which caused the function to short-circuit before checking the repo'satlantis.yaml. Changed to only prefer global config when it explicitly setsIgnorePaths.server/events/project_command_builder_test.go: Add two tests:TestDefaultProjectCommandBuilder_BuildMultiApply_IgnorePaths—ignore_pathsvia global configTestDefaultProjectCommandBuilder_BuildMultiApply_IgnorePathsRepoCfg—ignore_pathsvia repo-levelatlantis.yaml(no global config)Both set up a directory structure with plans in
project1/,project2/, and.terraform/modules/some_module/test-deployment/, and verify only the 2 non-ignored projects get apply commands.Fixes #6325