feat: implement plan-all command

[secustor]

Closes #254

This PR implement a plan-all command which will trigger plans for all defined projects regardless if they have been modified or not.

E2E tested on this repo https://github.com/secustor/renovate_terraform_lock_in_subdirectory/pull/12

[jamengual]

We were talking about this earlier and this could potentially be pretty dangerous if a person is allowed to plan on all projects and some show secrets on the plan, and I think if you plan all projects you can then run one apply and will apply all by default, no?

[nitrocode]

@secustor thank you for your hardwork. At the very least, could you add a new flag to enable this and set that flag to false as this is a bit of a security risk. As pepe already mentioned, we're already dealing with an issue #1508 and we'd like to reduce that blast radius. I'd be more inclined to approving if there is a flag to gate this.

[nitrocode]

Nice test! Could you also create a separate test for the new function shouldUpdateRepo ?

[secustor]

The outer scope tests this already, but I will add additional tests to cover this.

[secustor]

We were talking about this earlier and this could potentially be pretty dangerous if a person is allowed to plan on all projects and some show secrets on the plan, and I think if you plan all projects you can then run one apply and will apply all by default, no?

I'm new to the code base and usage of Atlantis, but how would this expose more things than opening a PR with changes to the atlantis.yaml or adding changes to files of a project.
Yes, it will then apply all. This actual my use case, as I want to trigger a plan for all projects to test Terraform version and provider upgrades.

@secustor thank you for your hardwork. At the very least, could you add a new flag to enable this and set that flag to false as this is a bit of a security risk. As pepe already mentioned, we're already dealing with an issue #1508 and we'd like to reduce that blast radius. I'd be more inclined to approving if there is a flag to gate this.

I would prefer not to hide this behind a flag, but would this PR ( #2696 ) clear up your reservations if it is merged? That way users/admins can set apply_requirements and prevent unreviewed changes to be merged/applied.

[nitrocode]

Usually we gate new features behind a feature flag until it's been tested enough. Some users may like this but others may not and it would be good to be able to enable it with a default of disabled.

Eventually if most people enable it then we can discuss removing the need for a flag. I do not think PR #2696 would relieve my reservations but I'm open to changing my mind.

cc: @runatlantis/maintainers thoughts?

[jamengual]

I agree with @nitrocode, this can be enabled by default, and it should be enabled by default and enabled explicitly.
For many people like me, the fact that a user can plan any project is considered a security risk.

[nitrocode]

@jamengual mentioned that there is also this flag --enable-regexp-cmd (created by pr #1419)

E.g.

atlantis plan -p .*

The regexp command may be sufficient enough to not need a plan-all command. @secustor could you see if this meets your needs?

[nitrocode]

I think the feature we'd want is to expand on the previous pr #1419 which implemented the flag and wildcard for -p and allow it to work with -d as well so one doesn't have to define all the directories to run the plan.

Ref #259

[secustor]

From what I can deduct from the docs this should work. I will try to confirm this on our instance and close this if it solves my problem.

[nitrocode]

I converted this to a draft for now. Please let us know if the --enable-regexp-cmd flag works for you or if you want to repurpose this to allow -d to work with a regex

[secustor]

The --enable-regexp-cmd flag has solved my use case.