apiVersion: atmos/v1
kind: Policy
metadata:
  name: github-reject-fork-plan
  description: "Reject saved Terraform plans when the supplied GitHub event identifies a fork pull request."
spec:
  policies:
    reject-fork-plan:
      on: terraform.plan
      engine: starlark
      action: deny
      reason: This privileged plan job does not accept fork pull requests
      required_ci:
        - provider: github-actions
          schema: github-actions/v1
          dataset: event
      rule: |
        event = ctx.ci["event"]["data"]
        return "pull_request" in event and event["pull_request"]["head"]["repo"]["full_name"] != event["pull_request"]["base"]["repo"]["full_name"]