feat: draftplan

[finnag]

what

Implement a new atlantis command "draftplan" for making draft plans.

Draft plans can run at pretty much any time in any PR as long as a terraform isn't already running for that PR, and the only result is a comment in the PR about what the plan would look like.

The draft plans do the following:

• Run terraform with -refresh=false -lock=false
• Do not store the plans for apply
• Do not delete previous plans or locks
• Do not update commit status
• Run almost without locks (workspace still locked for some ops)
• Do not affect automerging

This revision of the implementation is a bit more reasonable than the previous draft version.

why

It's often useful to see what plan a PR would result in, even if you do not want to apply the plan yet. Also, many times there are locks preventing a normal plan from running.

This mode could also maybe be a pretty useful mode for draft PRs, you can see what the plan would look like without affecting other PRs.

tests

• I have tested my changes by running all the tests, and playing around in some test repos.

references

• Affects Allow for Draft PRs to not lock state #1125, Prevent atlantis lock using atlantis plan -lock=false and disable lock on draft PRs #2237

[jamengual]

@finnag This is pretty interesting, I will be happy to review when is ready

[nitrocode]

This is interesting.

I'd prefer that all plans have dynamodb lock and atlantis lock disabled since we only really need to lock on apply. If the plan generated is stale, atlantis will run terraform which will announce that the plan is stale which would force a replan anyway.

[finnag]

We run atlantis in merge mode now, and we rely on the plans for reviews. The reviewer looks at the plan output in addition to the PR change itself to decide whether to approve or not. It's hard to see how the plans can stay true (as in not stale) unless the lock is grabbed before the plan is created, and held until after the PR is merged? If applying triggers a new plan, the review must be done again and you're entering some sort of loop...

[jimsmith]

I'm looking forward to seeing this being implemented and released out, a much needed function.

[jamengual]

We run atlantis in merge mode now, and we rely on the plans for reviews. The reviewer looks at the plan output in addition to the PR change itself to decide whether to approve or not. It's hard to see how the plans can stay true (as in not stale) unless the lock is grabbed before the plan is created, and held until after the PR is merged? If applying triggers a new plan, the review must be done again and you're entering some sort of loop...

I believe the approvals are only required again if there are any file changes, if not the approval persists.

[finnag]

@jamengual Finally had some time to clean this up a bit, if you could review and give some feedback that would be nice. We've been running with variants of this patch for a while now, it's quite useful.

[jamengual]

@finnag does this delete the previous draftplan comment if another one is run and when an actual plan is run?

[finnag]

@finnag does this delete the previous draftplan comment if another one is run and when an actual plan is run?

It behaves like this, at least on GitHub:

• Previous draftplan outpus are hidden by new plans and new draftplans
• Previous plan outputs are hidden by new plans, but not by new draftplans.

The latter is sort of a fortunate accident because "plan" is a substring of "draftplan", and GithubClient. HidePrevCommandComments is looking for occurrences of the command name in the first line of the comment.

[peikk0]

Would it be possible to add a setting to make autoplan always run a draftplan instead of plan?

[GenPage]

Is there a way to do this without introducing such a big change? We essentially creating a pseudo-command in the Terraform binary around plan. I much rather us just call the Plan command with a flag that ignores writing the plan to the filesystem.

[mattjamesaus]

Big fan of this (as the locking/unlocking is a pain when you have larger terraform workspaces with backlogged PRs), i think the comments around the plan being not a perfect representation are valid and i wonder if putting/allowing some sort of prefix to the plan output could be possible (that provides a clear disclaimer that the output isn't perfectly representative). Even better would be somehow allowing atlantis administrators to set this to be specific to their orgs terminology, so something like this could be achievable on a draft plan.

Warning

This is a draft plan and may not truly be representative of the run due to atlantis sequential locking behaviour - it's strictly to aid in code review blah blah.

Ran Draft Plan for dir: terraform/environment/aws/prod workspace: default
....

[github-actions]

This issue is stale because it has been open for 1 month with no activity. Remove stale label or comment or this will be closed in 1 month.

[peikk0]

Not stale

[finnag]

rebased to v0.30.0, added fix suggested by @peikk0 .. We've run with this in production for a year + now, so it "works for us".