(pre/post)workflow command runner can re-clone directory on policy_check, approve_policy, apply steps

[pseudomorph]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

pre and post workflow hooks can wipe out a planfile, via re-clone, for a working dir for commands which do not run clone. i.e. policy_check, approve_policies, and apply.

https://github.com/runatlantis/atlantis/blob/main/server/events/pre_workflow_hooks_command_runner.go#L67-L70
https://github.com/runatlantis/atlantis/blob/main/server/events/post_workflow_hooks_command_runner.go#L69-L72

This can be problematic, especially when coupled with #3487.

It seems that clone is specifically avoided for policy_check step:

• https://github.com/runatlantis/atlantis/blob/main/server/events/project_command_runner.go#L440-L441

likewise, it's not done for approve policies or apply, for similar reasons.

Shouldn't the pre and post workflow runner also take in to account the command operation which is running and not clone when they are run alongside the above operations?

Reproduction Steps

Logs

Environment details

Additional Context

[pseudomorph]

Seems there is a separate issue where, if pre/postworfklow hooks are configured, that the pull_closed_executor can trigger a re-clone during cleanup and prevent the directory from actually getting cleaned up.

[pseudomorph]

@nitrocode @finnag - Would it make sense to make these block conditional on only if the comment command is plan?

https://github.com/runatlantis/atlantis/blob/main/server/events/post_workflow_hooks_command_runner.go#L69
https://github.com/runatlantis/atlantis/blob/main/server/events/pre_workflow_hooks_command_runner.go#L67

Or, at least, exclude certain commands from running it?