team_authz: PROJECT_NAME empty when running project with a dynamically generated atlantis.yaml

[am-zest]

Hi all,

I'm using atlantis on a repo in which I dynamically generate the atlantis.yaml. I'm trying to configure team_authz to control which users/teams can deploy to prod. But since the PROJECT_NAME env variable is empty when the team_authz 'command' script is called, I'm not able to figure out which project is being acted on. The environment level (dev, qa, stage, prod, etc) is embedded in the project name (eg, abc-ENV-def-xyz).

How is team_authz supposed to work with repos that use a dynamically generated atlantis.yaml?

[dosubot[bot]]

Hey @am-zest! I'm here to help you with any bugs, questions, or contributions. Let's tackle this together!

The PROJECT_NAME environment variable is typically set based on the context provided to the Run method of the DefaultExternalTeamAllowlistRunner in Atlantis. If PROJECT_NAME is empty when using a dynamically generated atlantis.yaml, it might be due to the way the context is being set or passed during the execution of the team_authz script.

To address this issue, ensure that the dynamically generated atlantis.yaml correctly specifies the project name in a way that Atlantis can interpret and set the PROJECT_NAME variable. This might involve verifying how the project name is being defined and passed in your setup.

If the project name is embedded in a specific format (e.g., abc-ENV-def-xyz), you may need to adjust the script or configuration to extract and set the PROJECT_NAME appropriately before the team_authz script is executed. This could involve parsing the project name from the relevant context or configuration file used during the generation of atlantis.yaml.

If the issue persists, reviewing the logic that generates the atlantis.yaml and ensuring it aligns with how Atlantis expects to receive project information might be necessary.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[dosubot[bot]]

The issue you're encountering is due to the execution order of scripts in Atlantis. The team_authz command is running before the pre-hook script that generates the atlantis.yaml file, which is why the PROJECT_NAME environment variable is not set.

Unfortunately, there isn't a direct configuration option in Atlantis to control the execution order of pre-hooks and the team_authz command ^[1]. One potential workaround is to ensure that the atlantis.yaml file is generated and available before any Atlantis commands are triggered. This might involve restructuring your workflow to generate the atlantis.yaml file as part of a separate process or step that occurs before Atlantis starts processing the pull request.

If restructuring the workflow is not feasible, consider modifying the team_authz script to handle cases where the PROJECT_NAME is not set, possibly by inferring the project name from other available context or by using a default value.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[am-zest]

@dosu why can't the PROJECT_NAME env variable be set based on the arguments given to the atlantis comment? like atlantis plan -p myproject.

Even if myproject doesn't exist, that's the value to the atlantis plan command. Why not just pass it to the team_authz command?

[dosubot[bot]]

The PROJECT_NAME environment variable can indeed be set based on the arguments given to the Atlantis comment, such as atlantis plan -p myproject. The CommentParser in Atlantis is responsible for parsing these arguments, and the CommentCommand struct includes a ProjectName field specifically for handling the -p argument ^[1].

To pass this value to the team_authz command, you would need to ensure that the ProjectName parsed from the comment is included in the environment variables set by the DefaultExternalTeamAllowlistRunner. This runner sets environment variables before executing the team_authz script, and it can be customized to include the ProjectName as an environment variable like PROJECT_NAME ^[2].

If this isn't happening in your setup, it might require a modification in the way the environment variables are being set or passed to ensure that ProjectName is included. This would involve checking the implementation of the DefaultExternalTeamAllowlistRunner to ensure it captures and sets the ProjectName from the parsed command arguments.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[am-zest]

@dosu who is the original contributor for the team_authz code?

[dosubot[bot]]

To find the original contributor for the team_authz code, you can check the commit history of the relevant files in the repository. Look for the files related to team_authz and view their commit history to identify the author of the initial commit or significant contributions. This information is typically available in the version control system's logs or the repository's commit history.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}