Reject fork PR plans
Reject saved Terraform plans when the supplied GitHub event identifies a fork pull request.
This privileged plan job does not accept fork pull requests
apiVersion: atmos/v1
kind: Policy
metadata:
name: github-reject-fork-plan
description: "Reject saved Terraform plans when the supplied GitHub event identifies a fork pull request."
spec:
policies:
reject-fork-plan:
on: terraform.plan
action: deny
reason: This privileged plan job does not accept fork pull requests
required_ci:
- provider: github-actions
schema: github-actions/v1
dataset: event
rule: has(ci.event.data.pull_request) &&
ci.event.data.pull_request.head.repo.full_name !=
ci.event.data.pull_request.base.repo.full_name
1 Configure
None.
Runs after planning and before saved-plan apply; it is not a sandbox. Never execute untrusted PR code with privileged credentials in reliance on this rule. Non-PR events do not match.
2 Save
Save the CEL policy as policy.d/github-reject-fork-plan.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
Replace <component> and <stack> with your target.
atmos terraform plan <component> -s <stack>
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
