feat: Add environment variables to external team_authz commands

[david-lawrence-tc]

what

Adds additional environment variables to external authz commands:

• WORKSPACE - The Terraform workspace used for the project, ex. default
• API - "true" if invoked by API endpoints
• VERBOSE - "true" when the user would like verbose output

why

• It is common to map terraform workspaces to environments (for example dev, stage, prod)
• This allows an external authz script to allow/deny commands based on workspace name
• For example to allow broader access for lower environments, but keep prod workspaces more restricted
• This is not currently possible to do with external authz because the WORKSPACE env var is not passed to this command

tests

• Added unit tests
• Deployed this version to my environment and verified the new environments variables are passed to the script without errors

references

closes #6342

[Copilot]

Pull request overview

Adds additional context to external team allowlist/authz command executions by exporting more information via environment variables.

Changes:

• Pass WORKSPACE, API, and VERBOSE env vars to external team allowlist commands.
• Add unit tests covering the new env vars (plus some existing env behaviors).
• Document the newly supported env vars in the permissions docs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
server/core/runtime/external_team_allowlist_runner.go	Exports WORKSPACE, API, and VERBOSE in the runner’s environment.
server/core/runtime/external_team_allowlist_runner_test.go	Adds test coverage for env propagation and runner behavior.
runatlantis.io/docs/repo-and-project-permissions.md	Documents the additional env vars available to external commands.

[lukemassa]

WORKSPACE makes sense to me, but I'm not sure about API and VERBOSE.

VERBOSE in particular, it's hard for me to think of a reason why this would be useful in an authorization decision.

As for API, that's a very generic term, and I could imagine may confuse or even conflict with other environment variables.

My vote here would be to add just WORKSPACE, as it solves the immediate problem, then add additional env vars as needed.