登录

atlantis

runatlantisApache-2.0活跃维护

在 Terraform 的 Pull Request 里自动执行 plan 和 apply，把基础设施变更流程搬进代码评审，省去手动跑命令和审批的麻烦。

Terraform Pull Request Automation

v0.49.0发布于 2026-10-25 01:47 UTC9,353star +3 / 7 天1,377fork同步于 2026-11-10 17:31 UTC
Terraform基础设施即代码PR 自动化代码评审DevOps
对比 GitHub 官网atlantisautomationdevopsgogolang

怎么上手

由 README 提炼，执行前请确认
原文 
README 未给出安装命令，请参考 www.runatlantis.io/guide
硬件要求按 README 说明

README 未说明

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

自托管 Go 应用，通过 webhook 监听 Terraform PR 事件并自动执行 plan/apply

在 Terraform 的 Pull Request 里自动执行 plan 和 apply，把基础设施变更流程搬进代码评审，省去手动跑命令和审批的麻烦。

核心能力

  • 通过 webhook 监听 Terraform 拉取请求事件
  • 远程运行 terraform plan、import、apply
  • 把执行输出以评论形式回写到 PR
  • 让非运维工程师也能参与 Terraform 协作
  • 统一团队 Terraform 工作流

容易踩的坑

需自行托管服务并配置代码仓库 webhook；需在运行环境中具备 Terraform 及目标云凭证；具体安装与配置以官方文档为准

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本v0.49.0
全部 release
  1. v0.49.0最新正式版2026-10-25 · 2026-10-25 01:47 UTC

    Atlantis v0.49.0

    v0.49.0 is a breaking release, for three reasons:

    1. The Docker images no longer include Terraform or OpenTofu. This was announced in v0.48.0.
    2. 12 security advisories are fixed here, and several of those fixes change behavior that existing setups may rely on.
    3. v0.47.1 shipped a breaking change without saying so: the shell-injection fix in #6792. It is listed below so anyone upgrading from v0.47.0 or earlier sees it.

    Every behavior change is also documented, in a Behavior change note, on the docs page where you would look for that setting. Read Breaking changes before you upgrade.

    Upgrade checklist

    • Docker images: set --default-tf-version (and --default-tf-distribution opentofu if you use OpenTofu) so Atlantis downloads the binary. If downloads are blocked, mount or copy a binary into the image instead. The image no longer ships one.
    • Upgrading from v0.47.0 or earlier: check workspace names and comment arguments against the v0.47.1 changes below.
    • GitHub / GHES: make sure --gh-hostname matches the host in your repositories' clone URLs. Webhooks whose clone URL is on a different host are now rejected.
    • Server-side repo config: if repos use allow_custom_workflows: true together with allowed_workflows, check that every project's workflow is in the allow-list. Repo configs that used to pass can now be rejected.
    • Project dirs: make sure no project dir is a symlink to somewhere outside the repository.
    • Comment commands: tell users that -out, -generate-config-out, -state, -state-out and -backup are now blocked after --, and that --blocked-extra-args can no longer unblock anything.
    • Comment -var-file: the allowlist now applies to apply, import and state rm as well as plan. Paths containing .. are refused, and so are repo symlinks that point outside the repository and the allowlist.
    • state rm: if state is in --allow-commands, state rm now has to meet the project's apply_requirements and import_requirements.
    • API: if --api-secret is set, send X-Atlantis-Token on GET /api/locks. Check that /api/plan and /api/apply callers send clean, repo-relative paths[].directory values with no leading / and no globs.
    • Approvals (GitHub, Gitea): apply_requirements: [approved] now uses each reviewer's latest review. On Gitea, dismissed and stale approvals no longer count, and any push that changes the diff makes approvals stale.
    • Apply: plans recorded by v0.49.0 are bound to a hash. A plan file that changes between plan and apply is rejected and has to be re-planned.

    Breaking changes

    Docker images

    The Docker images no longer include Terraform or OpenTofu

    • What changed: the latest, vX.Y.Z and vX.Y.Z-debian images no longer bundle Terraform or OpenTofu binaries, and they set no default Terraform version. This was announced in the v0.48.0 release notes. The -alpine-slim and -debian-slim images from v0.48.0 were the intermediate step toward this and are no longer published. If you pinned one, switch to the unsuffixed, -alpine or -debian tag, which now contain the same thing. If you build the image yourself, use --target alpine or --target debian; the -slim targets are gone.
    • Why: every advisory against any bundled Terraform or OpenTofu release showed up in scans of the Atlantis image, whether or not you used that version. Atlantis can't own the security lifecycle of those third-party binaries.
    • Who is affected: anyone using the published images who relied on the bundled terraform or tofu binary on PATH, or on the version the image used to set by default.
    • How to tell: the server refuses to start with terraform not found in $PATH. Set --default-tf-version ....
    • What to do:
      • Set --default-tf-version (`ATLANTIS_DEFAULT_TF_VERSION
  2. v0.48.22026-10-21 · 2026-10-21 00:39 UTC
    查看更新说明

    Highlights

    Emergency security release for the eMudhra intermediate CA key compromise. The private keys of eight eMudhra (emSign) intermediate certificates were compromised; some of those intermediates are cross-signed by a root that every trust store includes. We recommend all users upgrade.

    • Go 1.27.3: Atlantis is now built with go1.27.3, whose crypto/x509 rejects any certificate chain containing the eight compromised keys (CVE-2026-111943). Go does not check revocation, so Atlantis v0.48.1 and earlier, built with go1.27.1, would accept a certificate issued with those keys for any host, including the VCS APIs Atlantis sends credentials to. go1.27.3 also includes the standard library fixes from go1.27.2.
    • Trust store update in the images: ca-certificates is updated to Alpine 20261020-r0 and Debian 20250419+deb13u1. Both remove emSign ECC Root CA - G3, and Debian also removes the Comodo AAA Services root that cross-signed some of the affected intermediates. This covers the other TLS clients in the image (git, curl, Terraform/OpenTofu and conftest).
    • Runtime image refresh: Debian curl 8.14.1-2+deb13u7 and openssl 3.5.7-1~deb13u3 security pins, Alpine 3.24.2, Terraform 1.16.5, conftest 0.70.1.
    • Dependency security updates: golang.org/x/net v0.60.0 and vite v8.3.3.

    If you build Atlantis yourself, rebuild with go1.27.3 or go1.26.10 or later. The terraform, tofu and conftest binaries are built by their own projects; update them when their releases with the Go fix are available.

    What's Changed

    Security changes

    Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.48.1...v0.48.2

  3. v0.48.12026-10-07 · 2026-10-07 17:37 UTC
    查看更新说明

    What's Changed

    Security changes

    Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.48.0...v0.48.1

    Thanks to @arpitjain099 for reporting and reviewing this fix, and to @pseudomorph for reviewing.

  4. v0.48.02026-09-22 · 2026-09-22 02:55 UTC
    查看更新说明

    Atlantis v0.48.0

    ### Terraform and OpenTofu Binaries Removed from Debian and Alpine Images

    Starting with Atlantis v0.49.0, the Debian- and Alpine-based Docker images will no longer include bundled Terraform or OpenTofu binaries.

    Users can continue to use Atlantis' automatic binary download functionality to fetch and use the Terraform or OpenTofu versions required by their workflows.

    This change allows the Atlantis project to focus its security and maintenance efforts on the Atlantis application and its container images, rather than taking responsibility for the security lifecycle, vulnerability management, and distribution of third-party Terraform and OpenTofu binaries.

    Users who require pre-installed binaries can continue to build custom Atlantis images based on the official images.

    Highlights

    • Safer plan/apply lifecycle. Atlantis now hashes the loaded apply plan, persists plan results before reporting success, and applies the verified managed-plan snapshot.
    • New slim container images. Alpine and Debian slim images are available without bundled Terraform or OpenTofu, for deployments that provide their own tooling.
    • Terraform and runtime compatibility. End-of-life Terraform versions without security support were removed from the standard images. The bundled versions, Debian and Alpine bases, Go toolchain, OpenTofu, Conftest, and Git LFS were refreshed.
    • Operational and security hardening. GitLab webhook tokens are omitted from errors, and drainer and workflow-hook status handling is more reliable. The GHSA-rjh2-4xgw-p2hj shell-injection fix is retained from the mainline history; it was already shipped in v0.47.1 and is not presented as new here.
    • Documentation and localization. Spanish documentation and translation infrastructure were expanded.

    Runtime and compatibility changes

    • Standard images now use Terraform 1.16.3 and 1.15.9, with older unsupported Terraform versions removed.
    • Alpine and Debian base images were updated, along with the Go 1.27.1 runtime/toolchain, OpenTofu 1.12.6, Conftest 0.70.0, and Git LFS 3.8.0.
    • New alpine-slim and debian-slim image targets do not bundle Terraform or OpenTofu.

    What's Changed

    Exciting New Features 🎉

    Provider GitLab

    Bug fixes 🐛

    Security changes

    Documentation

  5. v0.47.12026-08-20 · 2026-08-20 18:34 UTC
    查看更新说明

    What's Changed

    Security changes

    Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.47.0...v0.47.1

    Thanks to @krewenki for the security review of this fix, and to @pseudomorph for reviewing.

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    Atlantis

    Latest Release SuperDopeBadge Go Report Card Go Reference Slack OpenSSF Scorecard OpenSSF Best Practices

    Get involved

    Help shape Atlantis! Share feedback, discuss ideas, report issues, or contribute code and documentation.

    Resources

    What is Atlantis?

    A self-hosted golang application that listens for Terraform pull request events via webhooks.

    What does it do?

    Runs terraform plan, import, apply remotely and comments back on the pull request with the output.

    Why should you use it?

    • Make Terraform changes visible to your whole team.
    • Enable non-operations engineers to collaborate on Terraform.
    • Standardize your Terraform workflows.

    Stargazers over time

    Stargazers over time

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    Agent-Reach
    Panniantong·Python

    一条命令行就能让 AI 智能体读取和搜索 Twitter、Reddit、YouTube、GitHub、B站、小红书等平台内容，不用付任何 API 费用。

    AI智能体+4自动化工具
    110864+10949.9kv1.6.12026-11-08 02:17 UTC
    puppeteer
    puppeteer·TypeScript

    用 JavaScript 控制 Chrome 和 Firefox 的浏览器自动化库，可做网页爬取、端到端测试和生成页面截图 PDF。

    浏览器自动化+4自动化工具
    95817+89.6kpuppeteer-v25.16.02026-11-10 17:10 UTC
    huginn
    huginn·Ruby

    搭建能替你盯着网页、RSS 和接口的自动化代理，条件满足时自动发通知或触发动作，相当于自建一套 IFTTT 式监控流水线。

    自动化代理+4自动化工具
    50477+1694.4kv2026.11.092026-11-09 01:28 UTC
    fastlane
    fastlane·Ruby

    用 Ruby 写的移动端发布自动化工具，把 iOS 和 Android 的打包、签名、截图、上架流程串成一条命令，省去手动操作。

    移动端发布+4自动化工具
    42377+96.1k2.241.22026-11-09 23:19 UTC