Skip fork autofix and refresh setup-go pins by osterman · Pull Request #2659 · cloudposse/atmos

Erik Osterman (Cloud Posse) (osterman) · 2026-06-24T05:18:55Z

what

Skip the atmos.ci autofix job when a pull request comes from a fork.
Keep the existing atmos-pro[bot] loop guard and same-repo PR autofix behavior.
Refresh eight actions/setup-go v6 SHA pins to match the current upstream v6 tag.

why

Fork PRs do not receive OIDC, repo variables, or writable credentials, so atmos pro commit cannot authenticate or push fixes.
Skipping the job avoids guaranteed red checks for external contributors while preserving formatting automation for internal PRs.
The verify workflow checks that SHA-pinned actions match their tag comments; the previous setup-go pins pointed at v6.4.0 while labeled as v6.

references

Validated with workflow YAML parsing, upstream tag checks for actions/setup-go, and commit hook check yaml.

atmos-pro · 2026-06-24T05:18:58Z

Tip

Atmos Pro

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

github-actions · 2026-06-24T05:19:13Z

Note

SHA Pin Verification Passed ✅

All 101 SHA-pinned action(s) verified against upstream tags.

github-actions · 2026-06-24T05:19:39Z

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

.github/workflows/test.yml

mergify · 2026-06-24T05:20:00Z

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

codecov · 2026-06-24T05:59:14Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.41%. Comparing base (a622ff6) to head (cbf49f2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2659   +/-   ##
=======================================
  Coverage   80.40%   80.41%           
=======================================
  Files        1400     1400           
  Lines      132569   132569           
=======================================
+ Hits       106590   106599    +9     
+ Misses      20093    20081   -12     
- Partials     5886     5889    +3

Flag	Coverage Δ
unittests	`80.41% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coderabbitai · 2026-06-25T00:52:51Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: eb50bd74-b7ef-4f24-b527-768780bd03c1

📥 Commits

Reviewing files that changed from the base of the PR and between 0a34260 and cbf49f2.

📒 Files selected for processing (1)

.github/workflows/native-ci.yml

📝 Walkthrough

Walkthrough

Updated the Atmos Pro autofix condition to skip fork-originated pull requests, and refreshed pinned actions/setup-go revisions across the planfile artifact, planfile verify, native CI, and test workflows.

Changes

Atmos Pro autofix guard

Layer / File(s)	Summary
Autofix job condition `.github/workflows/atmos-pro.yaml`	`autofix` now skips `atmos-pro[bot]` runs and fork-originated pull requests via `github.event.pull_request.head.repo.full_name`, with inline comments about the fork/OIDC limitation.

setup-go pin refresh

Layer / File(s)	Summary
E2E workflow pins `.github/workflows/planfile-artifacts-e2e.yml`, `.github/workflows/planfile-verify-e2e.yml`	`actions/setup-go` pins were updated in the plan/apply and plan/deploy-verify/deploy-drift jobs; the rest of each workflow stays the same.
Native CI workflow pins `.github/workflows/native-ci.yml`	`actions/setup-go` pins were updated in the terraform-plan and terraform-apply jobs without changing the surrounding workflow logic.
Test workflow pins `.github/workflows/test.yml`	`actions/setup-go` pins were updated in the build, acceptance-tests, and `floci-go` jobs without changing the surrounding job logic.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

aknysh

Suggested labels

no-release

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the two main changes: skipping fork autofix and refreshing setup-go pins.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch osterman/disable-autofix-on-forks

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…fix-on-forks

github-actions · 2026-06-25T01:24:09Z

Resource Changes Found for `bucket` in `test`

Plan: 5 to add, 0 to change, 0 to destroy.

To reproduce this locally, run:

atmos terraform plan bucket -s test

Create

+ aws_s3_bucket.checkov_target
+ aws_s3_bucket.kics_target
+ aws_s3_bucket.this
+ aws_s3_bucket.trivy_target
+ aws_s3_bucket_public_access_block.trivy_target

Terraform Plan Summary

  # aws_s3_bucket.checkov_target will be created
  + resource "aws_s3_bucket" "checkov_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-checkov-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.kics_target will be created
  + resource "aws_s3_bucket" "kics_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-kics-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.this will be created
  + resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + tags_all                    = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.trivy_target will be created
  + resource "aws_s3_bucket" "trivy_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-trivy-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_public_access_block.trivy_target will be created
  + resource "aws_s3_bucket_public_access_block" "trivy_target" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

Plan: 5 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + bucket_name = "atmos-native-ci-e2e-test"


Workspace "test" doesn't exist.

You can create this workspace with the "new" subcommand 
or include the "-or-create" flag with the "select" subcommand.

atmos-pro · 2026-06-25T10:27:41Z

Tip

Atmos Pro

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

github-actions · 2026-06-26T01:50:53Z

These changes were released in v1.222.0-rc.10.

Skip Atmos Pro autofix on fork PRs

c0d0f97

Erik Osterman (Cloud Posse) (osterman) added the no-release Do not create a new release (wait for additional code changes) label Jun 24, 2026

github-actions Bot added the size/xs Extra small size PR label Jun 24, 2026

mergify Bot added the needs-cloudposse Needs Cloud Posse assistance label Jun 24, 2026

Refresh setup-go v6 SHA pins

2d6ab38

github-actions Bot added size/s Small size PR and removed size/xs Extra small size PR labels Jun 24, 2026

Erik Osterman (Cloud Posse) (osterman) changed the title ~~Skip Atmos Pro autofix on fork PRs~~ Skip fork autofix and refresh setup-go pins Jun 24, 2026

Erik Osterman (Cloud Posse) (osterman) marked this pull request as ready for review June 25, 2026 00:48

Erik Osterman (Cloud Posse) (osterman) requested a review from a team as a code owner June 25, 2026 00:48

coderabbitai Bot previously approved these changes Jun 25, 2026

View reviewed changes

Erik Osterman (Cloud Posse) (osterman) added 2 commits June 24, 2026 20:16

Merge remote-tracking branch 'origin/main' into osterman/disable-auto…

0a34260

…fix-on-forks

Refresh native CI setup-go pins

cbf49f2

Erik Osterman (Cloud Posse) (osterman) dismissed coderabbitai[bot]’s stale review via cbf49f2 June 25, 2026 01:22

coderabbitai Bot approved these changes Jun 25, 2026

View reviewed changes

Andriy Knysh (aknysh) approved these changes Jun 25, 2026

View reviewed changes

Andriy Knysh (aknysh) merged commit ac78e61 into main Jun 25, 2026
72 checks passed

Andriy Knysh (aknysh) deleted the osterman/disable-autofix-on-forks branch June 25, 2026 10:27

mergify Bot removed the needs-cloudposse Needs Cloud Posse assistance label Jun 25, 2026

Uh oh!

Uh oh!

Conversation

Erik Osterman (Cloud Posse) (osterman) commented Jun 24, 2026 • edited by aknysh Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

what

why

references

Uh oh!

atmos-pro Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Atmos Pro

Uh oh!

github-actions Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SHA Pin Verification Passed ✅

Uh oh!

github-actions Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

mergify Bot commented Jun 24, 2026

Cloud Posse Engineering Team Review Required

Uh oh!

codecov Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Suggested labels

Uh oh!

github-actions Bot commented Jun 25, 2026

Resource Changes Found for bucket in test

Create

Uh oh!

Uh oh!

atmos-pro Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Atmos Pro

Uh oh!

github-actions Bot commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Erik Osterman (Cloud Posse) (osterman) commented Jun 24, 2026 •

edited by aknysh

Loading

atmos-pro Bot commented Jun 24, 2026 •

edited

Loading

github-actions Bot commented Jun 24, 2026 •

edited

Loading

github-actions Bot commented Jun 24, 2026 •

edited

Loading

codecov Bot commented Jun 24, 2026 •

edited

Loading

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading

Resource Changes Found for `bucket` in `test`

atmos-pro Bot commented Jun 25, 2026 •

edited

Loading