Merge branch 'include-git-untracked-files-fix' of https://github.com/…

…X-Guardian/atlantis into include-git-untracked-files-fix

.github/workflows/atlantis-image.yml

@@ -252,7 +252,6 @@ jobs:
     strategy:
       matrix:
         image_type: [alpine, debian]
-        platform: [linux/arm64/v8, linux/amd64, linux/arm/v7]
     runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner

.github/workflows/codeql.yml

@@ -87,7 +87,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ee117c905ab18f32fa0f66c2fe40ecc8013f3e04 # v3
+      uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -101,7 +101,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@ee117c905ab18f32fa0f66c2fe40ecc8013f3e04 # v3
+      uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -114,7 +114,7 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ee117c905ab18f32fa0f66c2fe40ecc8013f3e04 # v3
+      uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3
       with:
         category: "/language:${{matrix.language}}"
 

.github/workflows/renovate-config.yml

@@ -25,5 +25,5 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
       - run: npx --package renovate -c 'renovate-config-validator'

.github/workflows/test.yml

@@ -53,7 +53,7 @@ jobs:
     if: needs.changes.outputs.should-run-tests == 'true'
     name: Tests
     runs-on: ubuntu-24.04
-    container: ghcr.io/runatlantis/testing-env:latest@sha256:3d7b17d02ced2cb68ecc9d2ea3d2bef61fe8da52cf1631e4dff4de6503cb7237
+    container: ghcr.io/runatlantis/testing-env:latest@sha256:e6bfa93e7b649feb2f209cb67b24245bcd89a3bb27411ee1402206b14b4358c1
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4

.github/workflows/website.yml

@@ -65,7 +65,7 @@ jobs:
           globs: 'runatlantis.io/**/*.md'
 
       - name: setup npm
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
           node-version: '20'
           cache: 'npm'

Dockerfile

@@ -2,10 +2,10 @@
 # what distro is the image being built for
 ARG ALPINE_TAG=3.21.2@sha256:56fa17d2a7e7f168a043a2712e63aed1f8543aeafdcee47c58dcffe38ed51099
 ARG DEBIAN_TAG=12.8-slim@sha256:d365f4920711a9074c4bcd178e8f457ee59250426441ab2a5f8106ed8fe948eb
-ARG GOLANG_TAG=1.23.4-alpine@sha256:c23339199a08b0e12032856908589a6d41a0dab141b8b3b21f156fc571a3f1d3
+ARG GOLANG_TAG=1.23.5-alpine@sha256:47d337594bd9e667d35514b241569f95fb6d95727c24b19468813d596d5ae596
 
 # renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
-ARG DEFAULT_TERRAFORM_VERSION=1.10.4
+ARG DEFAULT_TERRAFORM_VERSION=1.10.5
 # renovate: datasource=github-releases depName=opentofu/opentofu versioning=hashicorp
 ARG DEFAULT_OPENTOFU_VERSION=1.8.8
 # renovate: datasource=github-releases depName=open-policy-agent/conftest

e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/runatlantis/atlantis/e2e
 
-go 1.23.4
+go 1.23.5
 
 require (
 	github.com/google/go-github/v68 v68.0.0

go.mod

@@ -1,11 +1,12 @@
 module github.com/runatlantis/atlantis
 
-go 1.23.4
+go 1.23.5
 
 require (
 	code.gitea.io/sdk/gitea v0.19.0
 	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/alicebob/miniredis/v2 v2.34.0
+	github.com/bmatcuk/doublestar/v4 v4.8.0
 	github.com/bradleyfalzon/ghinstallation/v2 v2.13.0
 	github.com/briandowns/spinner v1.23.1
 	github.com/cactus/go-statsd-client/v5 v5.1.0
@@ -76,7 +77,6 @@ require (
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
-	github.com/bmatcuk/doublestar/v4 v4.8.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cloudflare/circl v1.3.9 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

server/core/config/parser_validator.go

@@ -3,6 +3,7 @@ package config
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -11,7 +12,7 @@ import (
 
 	validation "github.com/go-ozzo/ozzo-validation"
 	shlex "github.com/google/shlex"
-	"github.com/pkg/errors"
+
 	"github.com/runatlantis/atlantis/server/core/config/raw"
 	"github.com/runatlantis/atlantis/server/core/config/valid"
 	yaml "gopkg.in/yaml.v3"
@@ -29,11 +30,11 @@ func (p *ParserValidator) HasRepoCfg(absRepoDir, repoConfigFile string) (bool, e
 	const invalidExtensionFilename = "atlantis.yml"
 	_, err := os.Stat(p.repoCfgPath(absRepoDir, invalidExtensionFilename))
 	if err == nil {
-		return false, errors.Errorf("found %q as config file; rename using the .yaml extension", invalidExtensionFilename)
+		return false, fmt.Errorf("found %q as config file; rename using the .yaml extension", invalidExtensionFilename)
 	}
 
 	_, err = os.Stat(p.repoCfgPath(absRepoDir, repoConfigFile))
-	if os.IsNotExist(err) {
+	if errors.Is(err, os.ErrNotExist) {
 		return false, nil
 	}
 	return err == nil, err
@@ -48,12 +49,7 @@ func (p *ParserValidator) ParseRepoCfg(absRepoDir string, globalCfg valid.Global
 	configData, err := os.ReadFile(configFile) // nolint: gosec
 
 	if err != nil {
-		if !os.IsNotExist(err) {
-			return valid.RepoCfg{}, errors.Wrapf(err, "unable to read %s file", repoConfigFile)
-		}
-		// Don't wrap os.IsNotExist errors because we want our callers to be
-		// able to detect if it's a NotExist err.
-		return valid.RepoCfg{}, err
+		return valid.RepoCfg{}, fmt.Errorf("unable to read %s file: %w", repoConfigFile, err)
 	}
 	return p.ParseRepoCfgData(configData, globalCfg, repoID, branch)
 }
@@ -115,7 +111,7 @@ func (p *ParserValidator) ParseRepoCfgData(repoCfgData []byte, globalCfg valid.G
 func (p *ParserValidator) ParseGlobalCfg(configFile string, defaultCfg valid.GlobalCfg) (valid.GlobalCfg, error) {
 	configData, err := os.ReadFile(configFile) // nolint: gosec
 	if err != nil {
-		return valid.GlobalCfg{}, errors.Wrapf(err, "unable to read %s file", configFile)
+		return valid.GlobalCfg{}, fmt.Errorf("unable to read %s file: %w", configFile, err)
 	}
 	if len(configData) == 0 {
 		return valid.GlobalCfg{}, fmt.Errorf("file %s was empty", configFile)
@@ -204,7 +200,7 @@ func (p *ParserValidator) applyLegacyShellParsing(cfg *valid.RepoCfg) error {
 		if s.StepName == "run" {
 			split, err := shlex.Split(s.RunCommand)
 			if err != nil {
-				return errors.Wrapf(err, "unable to parse %q", s.RunCommand)
+				return fmt.Errorf("unable to parse %q: %w", s.RunCommand, err)
 			}
 			s.RunCommand = strings.Join(split, " ")
 		}

server/core/config/parser_validator_test.go

@@ -1,7 +1,9 @@
 package config_test
 
 import (
+	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -50,14 +52,14 @@ func TestHasRepoCfg_InvalidFileExtension(t *testing.T) {
 func TestParseRepoCfg_DirDoesNotExist(t *testing.T) {
 	r := config.ParserValidator{}
 	_, err := r.ParseRepoCfg("/not/exist", globalCfg, "", "")
-	Assert(t, os.IsNotExist(err), "exp not exist err")
+	Assert(t, errors.Is(err, fs.ErrNotExist), "exp not exist err")
 }
 
 func TestParseRepoCfg_FileDoesNotExist(t *testing.T) {
 	tmpDir := t.TempDir()
 	r := config.ParserValidator{}
 	_, err := r.ParseRepoCfg(tmpDir, globalCfg, "", "")
-	Assert(t, os.IsNotExist(err), "exp not exist err")
+	Assert(t, errors.Is(err, fs.ErrNotExist), "exp not exist err")
 }
 
 func TestParseRepoCfg_BadPermissions(t *testing.T) {

server/core/config/raw/autodiscover.go

@@ -1,12 +1,12 @@
 package raw
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 
 	"github.com/bmatcuk/doublestar/v4"
 	validation "github.com/go-ozzo/ozzo-validation"
-	"github.com/pkg/errors"
 	"github.com/runatlantis/atlantis/server/core/config/valid"
 )
 

server/core/config/raw/global_cfg.go

@@ -1,12 +1,12 @@
 package raw
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"strings"
 
 	validation "github.com/go-ozzo/ozzo-validation"
-	"github.com/pkg/errors"
 	"github.com/runatlantis/atlantis/server/core/config/valid"
 	"github.com/runatlantis/atlantis/server/utils"
 )
@@ -184,7 +184,10 @@ func (r Repo) Validate() error {
 			return nil
 		}
 		_, err := regexp.Compile(id[1 : len(id)-1])
-		return errors.Wrapf(err, "parsing: %s", id)
+		if err != nil {
+			return fmt.Errorf("parsing: %s: %w", id, err)
+		}
+		return nil
 	}
 
 	branchValid := func(value interface{}) error {
@@ -197,7 +200,10 @@ func (r Repo) Validate() error {
 		}
 		withoutSlashes := branch[1 : len(branch)-1]
 		_, err := regexp.Compile(withoutSlashes)
-		return errors.Wrapf(err, "parsing: %s", branch)
+		if err != nil {
+			return fmt.Errorf("parsing: %s: %w", branch, err)
+		}
+		return nil
 	}
 
 	repoConfigFileValid := func(value interface{}) error {

server/core/config/raw/project.go

@@ -1,6 +1,7 @@
 package raw
 
 import (
+	"errors"
 	"fmt"
 	"net/url"
 	"path/filepath"
@@ -9,7 +10,6 @@ import (
 
 	validation "github.com/go-ozzo/ozzo-validation"
 	version "github.com/hashicorp/go-version"
-	"github.com/pkg/errors"
 	"github.com/runatlantis/atlantis/server/core/config/valid"
 )
 
@@ -75,7 +75,10 @@ func (p Project) Validate() error {
 		}
 		withoutSlashes := branch[1 : len(branch)-1]
 		_, err := regexp.Compile(withoutSlashes)
-		return errors.Wrapf(err, "parsing: %s", branch)
+		if err != nil {
+			return fmt.Errorf("parsing: %s: %w", branch, err)
+		}
+		return nil
 	}
 
 	DependsOn := func(value interface{}) error {

server/core/config/raw/raw.go

@@ -4,8 +4,9 @@
 package raw
 
 import (
+	"fmt"
+
 	version "github.com/hashicorp/go-version"
-	"github.com/pkg/errors"
 )
 
 // VersionValidator helper function to validate binary version.
@@ -16,5 +17,8 @@ func VersionValidator(value interface{}) error {
 		return nil
 	}
 	_, err := version.NewVersion(*strPtr)
-	return errors.Wrapf(err, "version %q could not be parsed", *strPtr)
+	if err != nil {
+		return fmt.Errorf("version %q could not be parsed: %w", *strPtr, err)
+	}
+	return nil
 }

server/core/config/raw/raw_test.go

@@ -4,7 +4,8 @@ import (
 	"io"
 	"strings"
 
-	"github.com/pkg/errors"
+	"errors"
+
 	"gopkg.in/yaml.v3"
 )
 

testdrive/utils.go

@@ -35,7 +35,7 @@ import (
 )
 
 const hashicorpReleasesURL = "https://releases.hashicorp.com"
-const terraformVersion = "1.10.4" // renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
+const terraformVersion = "1.10.5" // renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
 const ngrokDownloadURL = "https://bin.equinox.io/c/4VmDzA7iaHb"
 const ngrokAPIURL = "localhost:41414" // We hope this isn't used.
 const atlantisPort = 4141

testing/Dockerfile

@@ -1,12 +1,12 @@
-FROM golang:1.23.4@sha256:585103a29aa6d4c98bbb45d2446e1fdf41441698bbdf707d1801f5708e479f04
+FROM golang:1.23.5@sha256:8c10f21bec412f08f73aa7b97ca5ac5f28a39d8a88030ad8a339fd0a781d72b4
 
 RUN apt-get update && apt-get --no-install-recommends -y install unzip \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Terraform
 # renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
-ENV TERRAFORM_VERSION=1.10.4
+ENV TERRAFORM_VERSION=1.10.5
 RUN case $(uname -m) in x86_64|amd64) ARCH="amd64" ;; aarch64|arm64|armv7l) ARCH="arm64" ;; esac && \
     wget -nv -O terraform.zip https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${ARCH}.zip && \
     mkdir -p /usr/local/bin/tf/versions/${TERRAFORM_VERSION} && \