From b02d510599d83af0af933e5445a1e9f9c29a896a Mon Sep 17 00:00:00 2001 From: Ujala Singh Date: Sun, 20 Sep 2026 00:28:10 +0530 Subject: [PATCH] feat(out): add concourse_url source field to override ATC_EXTERNAL_URL Concourse's externalUrl Helm value may be locked to an STS WebIdentity OIDC issuer hostname that differs from the URL users actually reach builds through (e.g. via a Teleport proxy). When concourse_url is set in the resource source, it overrides ATC_EXTERNAL_URL at the start of Out() so that both safeExpandEnv and the auto-generated commit status target URL in UpdateCommitStatus point to the correct public hostname. --- models/models.go | 5 +++++ pr/out.go | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/models/models.go b/models/models.go index 5fe5391..038d995 100644 --- a/models/models.go +++ b/models/models.go @@ -32,6 +32,11 @@ type CommonConfig struct { BaseBranch string `json:"base_branch"` Labels []string `json:"labels"` States []string `json:"states"` + // ConcourseURL overrides ATC_EXTERNAL_URL when constructing PR status check target + // URLs. Use when Concourse's externalUrl Helm value cannot be changed (e.g. it is + // locked to an STS WebIdentity OIDC issuer) but builds are reached via a different + // public hostname (e.g. a Teleport proxy). + ConcourseURL string `json:"concourse_url"` } // GithubConfig contains GitHub-specific configuration diff --git a/pr/out.go b/pr/out.go index 2724c9d..3daf3bf 100644 --- a/pr/out.go +++ b/pr/out.go @@ -15,6 +15,14 @@ import ( func Out(request OutRequest, github *models.GithubClient, sourcesDir string) (OutResponse, error) { ctx := context.Background() + // Allow the pipeline to supply a Teleport / proxy hostname that differs from + // Concourse's locked externalUrl (which may be bound to an STS OIDC issuer). + // Overriding ATC_EXTERNAL_URL here affects both safeExpandEnv and the + // auto-generated build URL in UpdateCommitStatus. + if request.Source.ConcourseURL != "" { + os.Setenv("ATC_EXTERNAL_URL", request.Source.ConcourseURL) + } + // Read metadata from the source path resourcePath := filepath.Join(sourcesDir, request.Params.Path, ".git", "resource")