feat: Allow for negations in repo allowlist

[lukemassa]

what

Update the flag an optional flag --repo-allowlist to allow for rules that begin with ! to omit repos.

Existing allow lists (as long as they don't have rules that start with !) would be unaffected

why

In general, useful to be able to exclude repos included by a glob. As a specific example, in our setup, we have repos foo/* that we want to be tracked by atlantis, but sometimes we want to omit a repo to do some testing, so this will allow us to do --repos-allowlist='foo/*,!foo/bar'.

tests

I searched the whole repo for "allow.?list" and updated each place it occurred.

I added several unit tests to the previous code that matched the allow list.

references

Closes #1180

[jamengual]

Thanks for the contribution @lukemassa LGTM @GenPage @nitrocode any thoughts?

[lukemassa]

@GenPage @nitrocode any thoughts here?

[nitrocode]

The naming of this flag is unclear to me without reading the description.

It's not so much a --deny-list but an --exclude-from-allow-list.

Allow us to discuss this internally.

[jamengual]

The naming of this flag is unclear to me without reading the description.

It's not so much a --deny-list but an --exclude-from-allow-list.

Allow us to discuss this internally.

I agree with @nitrocode the name could be confusing with some people.

[lukemassa]

The naming of this flag is unclear to me without reading the description.

It's not so much a --deny-list but an --exclude-from-allow-list.

Allow us to discuss this internally.

Yeah that makes sense. Either works for me, happy to change if that's the preference.

[jamengual]

The naming of this flag is unclear to me without reading the description.
It's not so much a --deny-list but an --exclude-from-allow-list.
Allow us to discuss this internally.

Yeah that makes sense. Either works for me, happy to change if that's the preference.

let's change it to --exclude-from-allow-list then and thanks.

[lukemassa]

For consistency it should be probably be --exclude-from-repo-allowlist (since there are other allow lists like --var-file-allowlist), right?

Although another option might be, instead of having --exclude-from-repo-allowlist and --repo-allowlist, given that as you say it's not really a "denylist", to use !s like

--repo-allowlist='github.com/foo/*,!github.com/foo/bar`

[GenPage]

@lukemassa if we can avoid adding another flag and contain the new feature with the existing allowlist, that is more ideal.

[lukemassa]

@lukemassa if we can avoid adding another flag and contain the new feature with the existing allowlist, that is more ideal.

Cool I'll give this a shot!

[lukemassa]

@GenPage @nitrocode @jamengual I've updated the code, comment, and PR summary to contain the changes in the existing flag

[jamengual]

Thanks @lukemassa LGTM

[kevin-fitlg]

Hey @lukemassa
I cannot make this work in my environment. It would be good if you can advise.
My current auto-plan-file-list is like this: deployments/**/*.tf,deployments/**/*.yaml,deployments/**/*.yml,deployments/**/*.json,deployments/**/*.config,**/*.tf

I have atlantis deployment files somewhere under deployments folder. Lets assume its like deployments/azure/prd/useast2/atlantis and I want to exclude this path from being handled by atlantis engine.

So, I have tried different combinations like !*atlantis* , !**/atlantis , !**/*atlnatis* and even the full path, i.e. !deployments/azure/prd/useast2/atlantis but it does not work. Atlantis still plans changes in this path.

I basically add the negation part at the beginning of my existing allow-list, like this: !**/atlantis,deployments/**/*.tf,deployments/**/*.yaml,deployments/**/*.yml,deployments/**/*.json,deployments/**/*.config,**/*.tf

However, it does not work.

I read your code changes and it should work but your tests does not seems to be including any wildcard negations. Although, when I add the full path, it does not work either!

I am using atlantis 0.26.0 which includes your features.

It would be great if you could help with this.

Thanks :)

[lukemassa]

@kevin-fitlg note that my change didn't affect the --auto-plan-file-list flag/setting, only the --repo-allowlist flag/setting. --repo-allowlist always starts with a hostname (https://www.runatlantis.io/docs/server-configuration.html#repo-allowlist), so that doesn't look like the format you're discussing here.

According to the documentation for https://www.runatlantis.io/docs/server-configuration.html#autoplan-file-list it uses the docker ignorefile syntax (https://docs.docker.com/build/building/context/#matching). I hope this helps!