Branch matcher does not work in atlantis v0.17.0

[ericsonrumuy7]

I saw that in v0.17.0 atlantis has added branch matcher feature #1383, but when I tried it, its seem does not work.

1. update repo.yaml

repos:
  - id: /.*/
    branch: /(main|master)/

2. restart atlantis
3. create PR from branch test1 to branch test2

but atlantis still can be execute from that PR

[dghubble]

I think even if you specify a single repo object, atlantis actually has your repo (which is limited to master/main) and another global one that will match regardless. So yeah, it doesn't seem to be functional. I'm unfortunately no longer using this.

https://github.com/runatlantis/atlantis/blob/master/server/events/yaml/valid/global_cfg.go#L173

[ericsonrumuy7]

I think even if you specify a single repo object, atlantis actually has your repo (which is limited to master/main) and another global one that will match regardless. So yeah, it doesn't seem to be functional. I'm unfortunately no longer using this.

https://github.com/runatlantis/atlantis/blob/master/server/events/yaml/valid/global_cfg.go#L173

is there any workaround for this ? i'm currently using bitbucket server (stash) and need this feature so atlantis cannot be abused using other branch

[minamijoyo]

Hi, @ericsonrumuy7 and all.
I also hit this problem and wrote a custom shell script in pre_workflow_hooks as a workaround. It checks a base branch of pull request and generates an invalid atlantis.yaml to suppress plan if the base branch doesn't match intended.

The following example restricts the base branch to default branch:

# Tested in atlantis v0.17.0

repos:
- id: /.*/
  apply_requirements: [approved, mergeable]
  pre_workflow_hooks:
    - run: pre_workflow_hooks.sh

#!/bin/bash

set -euo pipefail

# pre_workflow_hooks.sh

# Get the default branch
DEFAULT_BRANCH=$(git remote show origin | grep 'HEAD branch' | sed 's/.*: //')
echo "BASE_BRANCH_NAME: $BASE_BRANCH_NAME"
echo "DEFAULT_BRANCH: $DEFAULT_BRANCH"

if [ "$BASE_BRANCH_NAME" != "$DEFAULT_BRANCH" ] ; then
  echo "generate an invalid atlantis.yaml to restrict executions of plan / apply on the pull request that are merged into the non-default branch for security reasons."
  cat << EOF > atlantis.yaml
version: invalid
EOF
  # Note that exit with non-zero actually doesn't stop the following plan phase. It only writes stdout to log with ERROR level.
  # Generating the invalid atlantis.yaml will cause an error in plan.
  exit 1
fi

It works for me, but it's not the best solution by all means.

[jasonrberk]

@minamijoyo - so does the plan still run and put a comment on the PR?

I've got three atlantis instances running in three different AWS accounts, all tied to a single terragrunt repo. So the repo has three hooks, one for each atlantis instance behind an ALB.

I was toying with the idea of generating an atlantis config that was "valid", but sets the branch or id to a non-existent branch / repo name. The idea being my prod atlantis instance shouldn't comment on a PR in the non-prod folder in my terragrunt repo.

[minamijoyo]

@jasonrberk (Aside from the original issue that the branch keyword in repo.yaml doesn't work,) yes, with pre_workflow_hooks, I think it's possible to generate a valid atlantis.yml based on the branch.

[MartinsPaulo]

Has this been resolved? I am facing the same issue in 2024.

• id: /.*/
  branch: /^main$/
  workflow: main_workflow