feat: add WORKSPACE, PROJECT_NAME, and CHECK_TYPE env vars to external team_authz commands - #6710
Open
david-lawrence-tc wants to merge 2 commits into
Open
feat: add WORKSPACE, PROJECT_NAME, and CHECK_TYPE env vars to external team_authz commands#6710david-lawrence-tc wants to merge 2 commits into
david-lawrence-tc wants to merge 2 commits into
Conversation
dosubot
Bot
added
feature
2 tasks
…l team_authz commands External team_authz commands previously had no way to make workspace- or project-aware authorization decisions during the pre-flight check, and no way to distinguish the pre-flight check from the per-project check. - Export WORKSPACE to the external command (always set for project checks; set during pre-flight checks when the user passed -w explicitly) - Export PROJECT_NAME during pre-flight checks when the user passed -p explicitly (previously only available for project checks) - Export CHECK_TYPE (pre_flight | project) so scripts can apply different logic when workspace/project context is unavailable Fixes runatlantis#6342 Signed-off-by: David Lawrence <161499966+david-lawrence-tc@users.noreply.github.com> Assisted-by: Claude <noreply@anthropic.com>
david-lawrence-tc
force-pushed
the
feat/team-authz-env-vars
branch
from
July 28, 2026 22:48
d0e1a96 to
d9f8847
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
WORKSPACEas an environment variable to externalteam_authzcommands. It is always set during per-project checks, and set during pre-flight checks when the user explicitly passed-w.PROJECT_NAMEduring pre-flight checks when the user explicitly passed-p(previously it was only available during per-project checks).CHECK_TYPE(pre_flightorproject) so external commands can tell which authorization phase is running and handle missing workspace/project context accordingly.repo-and-project-permissions.mdand add tests for the external allowlist runner.why
team_authzcommands currently cannot make workspace-aware authorization decisions (e.g. "only the prod team mayapplyin theproductionworkspace"). The workspace is already carried onTeamAllowlistCheckerContextbut was never exported to the external command's environment.CHECK_TYPEmakes the phase explicit so scripts don't have to infer it from the incidental emptiness ofREPO_ROOT/PULL_NUM.APIandVERBOSEenv vars have been dropped, per the maintainer suggestion to add only what solves the immediate problem.tests
server/core/runtime/external_team_allowlist_runner_test.gocovering all exported env vars,CHECK_TYPEvalues for both phases, empty-workspace behavior (variable set but empty), env inheritance/override, and error handling.TestCheckUserPermissionsinternal tests for the newcheckUserPermissionssignature.go build ./...andgo test ./server/events/... ./server/core/runtime/...pass locally.references