# CI Configuration

The `ci` section of `atmos.yaml` configures native CI/CD integration, including output variables,
job summaries, status checks, PR comments, and template overrides. Terraform supports the full
feature set; Kubernetes v1 CI support writes job summaries only.

> ⚠️ Experimental

## Quick Start

**File:** `atmos.yaml`

```yaml
ci:
  enabled: true
  output:
    enabled: true
    variables:
      - has_changes
      - has_additions
      - has_destructions
      - plan_summary
  summary:
    enabled: true
  checks:
    enabled: false
  comments:
    enabled: true
    behavior: upsert
```

## Configuration Reference

- **`ci.enabled`**

  Explicitly enable or disable CI mode. When not set, CI mode is auto-detected from
  environment variables (`CI=true` or `GITHUB_ACTIONS=true`).

  **Default:** Auto-detected
- **`ci.allow_unsafe_fork_execution`**

  Opt out of the fork-PR safety gate that makes [`atmos git clone`](/cli/commands/git/clone#fork-pr-safety-gate)
  refuse to clone untrusted fork content under the elevated `pull_request_target` and
  `workflow_run` events. **Unsafe** — leave disabled unless a fork-facing workflow has a
  documented reason to bypass it. Equivalent to the `--allow-unsafe-fork` flag and
  `ATMOS_ALLOW_UNSAFE_FORK_EXECUTION` environment variable.

  **Default:** `false`

## Sections

## Component Support

| Component type | Job summaries | Output variables | Status checks | PR comments | Artifacts |
| --- | --- | --- | --- | --- | --- |
| Terraform | Yes | Yes | Yes | Yes | Planfiles |
| Kubernetes | Yes | No | No | No | No |

Kubernetes summaries cover render, plan/diff, apply/deploy, delete, validate, and command failures.
They intentionally do not create a machine-readable output contract in v1.

## Full Example

**File:** `atmos.yaml`

```yaml
ci:
  # Auto-enabled when CI detected, or set explicitly
  enabled: true

  # Output variables for downstream jobs
  output:
    enabled: true
    variables:
      - has_changes
      - has_additions
      - has_destructions
      - artifact_key
      - plan_summary

  # Job summary with plan/apply results
  summary:
    enabled: true

  # Commit status checks
  checks:
    enabled: true
    context_prefix: "atmos"

  # PR/MR comments
  comments:
    enabled: true
    behavior: upsert

  # Template overrides
  templates:
    base_path: ".atmos/ci/templates"
    terraform:
      plan: "plan.md"
      apply: "apply.md"
    helm:
      template: "helm-template.md"
      diff: "helm-diff.md"
      apply: "helm-apply.md"
      delete: "helm-delete.md"
    helmfile:
      template: "helmfile-template.md"
      diff: "helmfile-diff.md"
      apply: "helmfile-apply.md"
      destroy: "helmfile-destroy.md"
```

## CI Detection

CI mode is auto-enabled when any of these environment variables are set:

- `CI=true` (set by most CI providers)
- `GITHUB_ACTIONS=true` (set by GitHub Actions)

Override with the `--ci` flag, `ATMOS_CI`, or `ci.enabled` configuration.

Terraform commands use native CI for summaries, outputs, checks, comments, and planfile storage.
Native Helm and Helmfile commands use native CI for job summaries only.

GitHub Actions workflow linting is available through [`atmos ci validate`](/cli/commands/ci/validate) or its [`atmos validate ci`](/cli/commands/validate/usage) alias. The command emits annotations only when `ci.enabled` is true and `ci.annotations.enabled` is not false.

## Environment Variables

| Variable | Description |
|----------|-------------|
| `ATMOS_CI` | Explicitly enable CI mode (`true`/`false`) |
| `ATMOS_CI_COMMENTS_ENABLED` | Override `ci.comments.enabled` (`true`/`false`) |
| `ATMOS_CI_GROUPS_MODE` | Override `ci.groups.mode` (`auto`/`invocation`/`off`) |
| `ATMOS_ALLOW_UNSAFE_FORK_EXECUTION` | Opt out of the [`atmos git clone` fork-PR safety gate](/cli/commands/git/clone#fork-pr-safety-gate) (`true`/`false`, **unsafe**) |
| `CI` | Standard CI environment variable (set by most CI providers) |
| `GITHUB_ACTIONS` | Set by GitHub Actions runner |
| `GITHUB_TOKEN` / `GH_TOKEN` | GitHub API token (required for status checks and PR comments) |
| `GITHUB_OUTPUT` | File path for CI output variables (set by GitHub Actions) |
| `GITHUB_STEP_SUMMARY` | File path for job summaries (set by GitHub Actions) |
| `GITHUB_REPOSITORY` | Repository name in `owner/repo` format |
| `GITHUB_SHA` | Current commit SHA |

## Related

- [Native CI Overview](/ci) - Feature overview and quick start
- [Native CI Overview](/ci) - Feature overview
- [Planfile Storage](/ci/planfile-storage) - Store and verify planfiles
- [`atmos terraform plan --ci`](/cli/commands/terraform/plan) - Plan with CI integration
- [`atmos terraform deploy --ci`](/cli/commands/terraform/deploy) - Deploy with plan verification