Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the documentation to cover the policy_check internal command and how it interacts with --gh-team-allowlist, aiming to prevent manual atlantis plan runs from skipping policy checks when team allowlists are enabled.
Changes:
- Documented
policy_checkas an available (internal) command and explained when it runs. - Added guidance/warnings in multiple docs pages about allowlisting
policy_checkwhen using--gh-team-allowlist. - Added example
--gh-team-allowliststrings demonstrating required permissions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| runatlantis.io/docs/server-configuration.md | Adds policy_check to the command list and a tip block for --gh-team-allowlist users. |
| runatlantis.io/docs/repo-and-project-permissions.md | Adds a warning about allowlisting policy_check to avoid skipping policy checks on manual plans. |
| runatlantis.io/docs/policy-checking.md | Adds an “Important” warning explaining why policy_check must be allowlisted with team allowlists. |
| If you are using [policy checking](policy-checking.md), you must also allowlist the `policy_check` command: | ||
|
|
||
| ```bash | ||
| --gh-team-allowlist="*:plan, *:policy_check, sre:apply" |
There was a problem hiding this comment.
This snippet differs from the other pages by omitting the atlantis server prefix, which can confuse readers into pasting it as a shell command rather than a flag on the atlantis server invocation. Consider making this example consistent by including atlantis server --gh-team-allowlist=... (or labeling it explicitly as “flag value only”).
Suggested change
| --gh-team-allowlist="*:plan, *:policy_check, sre:apply" | |
| atlantis server --gh-team-allowlist="*:plan, *:policy_check, sre:apply" |
5866fa9 to
6c48763
Compare
Signed-off-by: Alberto Rojas <albertorojasm95@gmail.com>
6c48763 to
4c78cce
Compare
jamengual
approved these changes
Feb 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents:
policy_checkis not a command, but must be allowlisted for it to work #5739