fix: POST /api/plan panics when ATLANTIS_ENABLE_POLICY_CHECKS=true (#6484)

* fix: handle API plan policy checks

When API plan command building expands one input project into plan and policy_check contexts, keep workflow hooks tied to plan contexts, route policy_check contexts to the policy-check runner, and return policy-check results to API callers.

Load existing pull status for PR-backed API requests before building plan commands so generated policy_check contexts preserve sticky policy approvals. Stop /api/apply before apply command building when the pre-apply plan phase reports a policy-check failure.

Fixes #6449

Assisted-by: OpenAI <noreply@openai.com>
Signed-off-by: Rui Chen <rui@chenrui.dev>

* fix: preserve API apply pull status semantics

Refresh seeded API apply PullStatus metadata to the current request pull while preserving existing per-project policy status, and let multi-project API apply continue into per-project validation after mixed policy-check results.

Assisted-by: OpenAI <noreply@openai.com>
Signed-off-by: Rui Chen <rui@chenrui.dev>

---------

Signed-off-by: Rui Chen <rui@chenrui.dev>
Co-authored-by: Rui Chen <rui@chenrui.dev>

Author: Abzaek

server/controllers/api_controller.go

@@ -67,6 +67,10 @@ type APIController struct {
 	// apply requirements like 'mergeable' and 'approved' evaluate against real
 	// VCS state instead of always failing.
 	PullReqStatusFetcher vcs.PullReqStatusFetcher
+	// PullStatusFetcher is optional. When set and the API request supplies a PR
+	// number, it is used to populate command.Context.PullStatus so generated
+	// policy_check contexts can preserve existing policy approvals.
+	PullStatusFetcher events.PullStatusFetcher
 	// LivePullHeadFetcher is optional for tests. In production it is used for
 	// PR-backed API requests to seed live PR identity data such as base branch.
 	LivePullHeadFetcher events.LivePullHeadFetcher
@@ -736,15 +740,13 @@ func (a *APIController) apiPlan(request *APIRequest, ctx *command.Context) (*com
 	var planCmds []command.ProjectContext
 	var planCC []*events.CommentCommand
 	var policyCmds []command.ProjectContext
-	var policyCC []*events.CommentCommand
 	for i, cmd := range cmds {
 		switch cmd.CommandName {
 		case command.Plan:
 			planCmds = append(planCmds, cmd)
 			planCC = append(planCC, cc[i])
 		case command.PolicyCheck:
 			policyCmds = append(policyCmds, cmd)
-			policyCC = append(policyCC, cc[i])
 		default:
 			return nil, fmt.Errorf("%s is not supported", cmd.CommandName)
 		}
@@ -772,15 +774,7 @@ func (a *APIController) apiPlan(request *APIRequest, ctx *command.Context) (*com
 		return result, nil
 	}
 
-	for i, cmd := range policyCmds {
-		if !ctx.PreWorkflowHooksAlreadyRun {
-			err = a.PreWorkflowHooksCommandRunner.RunPreHooks(ctx, policyCC[i])
-			if err != nil {
-				if a.FailOnPreWorkflowHookError {
-					return nil, err
-				}
-			}
-		}
+	for _, cmd := range policyCmds {
 		if a.ProjectPolicyCheckCommandRunner == nil {
 			return nil, fmt.Errorf("policy check runner is not configured")
 		}
@@ -922,6 +916,7 @@ func seedPullStatusFromPlanResult(ctx *command.Context, result *command.Result)
 	if ctx.PullStatus == nil {
 		ctx.PullStatus = &models.PullStatus{Pull: ctx.Pull}
 	}
+	ctx.PullStatus.Pull = ctx.Pull
 	for _, projectResult := range result.ProjectResults {
 		if projectResult.Command != command.Plan && projectResult.Command != command.PolicyCheck && projectResult.Command != command.ApprovePolicies {
 			continue
@@ -1084,6 +1079,7 @@ func (a *APIController) apiParseAndValidate(r *http.Request) (*APIRequest, *comm
 		ExactProjectNameMatching:  true,
 	}
 	a.populatePullRequestStatus(ctx)
+	a.populatePullStatus(ctx)
 	return &request, ctx, http.StatusOK, nil
 }
 
@@ -1102,6 +1098,20 @@ func (a *APIController) populatePullRequestStatus(ctx *command.Context) {
 	ctx.PullRequestStatus = status
 }
 
+func (a *APIController) populatePullStatus(ctx *command.Context) {
+	if ctx.Pull.Num <= 0 || a.PullStatusFetcher == nil {
+		return
+	}
+
+	status, err := a.PullStatusFetcher.GetPullStatus(ctx.Pull)
+	if err != nil {
+		ctx.PullStatus = nil
+		ctx.Log.Warn("unable to fetch pull status: %s", err)
+		return
+	}
+	ctx.PullStatus = status
+}
+
 // Remediate handles POST /api/drift/remediate requests.
 // It executes drift remediation (plan or apply) for the specified projects.
 // This is an authenticated endpoint that requires the API secret.