fix: purge stale .tfplan files when updating working dir to new ref

[bakayolo]

What happened

When a new commit is pushed to a PR, updateToRef runs git reset --hard to move to the new ref. Since .tfplan files are untracked, git reset does not remove them. A subsequent bare atlantis apply discovers these stale plans via PendingPlanFinder and applies plans generated for a previous commit against the current infrastructure state.

This was introduced in #5895 ("Do not delete working dir if git falls behind"), which replaced the full reclone with git reset --hard + merge for performance. The full reclone naturally wiped all .tfplan files, but git reset --hard leaves untracked files intact.

Reproduction scenario

1. Push commit A → plan runs → writes default.tfplan
2. Push commit B → updateToRef does git reset --hard to commit B
3. default.tfplan from commit A survives (untracked files are not cleaned by git reset --hard)
4. User comments atlantis apply (bare) → PendingPlanFinder.Find() discovers the stale plan → applies it

Prior art

• fix: delete pending plans #5678 — identified the same stale plan problem but was closed as stale before tests were added
• feat: add configurable plan timeout to expire stale plans #6317 — proposes a --plan-timeout duration flag as a heavier, timeout-based mitigation

How I fixed it

Added a deletePlanFiles method to FileWorkspace that walks the clone directory and removes all .tfplan files (skipping .terragrunt-cache directories). This is called at the end of updateToRef for both the branch and merge checkout strategies, immediately after the ref is updated.

This is the narrowest fix — it catches the problem at the earliest possible point (when the commit changes), before any plan discovery runs.

Changes

• server/events/working_dir.go:
  • Added deletePlanFiles() helper that uses filepath.Walk to find and delete .tfplan files
  • Call it at the end of both branch and merge paths in updateToRef()
• server/events/working_dir_test.go:
  • Updated TestClone_ResetOnWrongCommit and TestClone_ResetOnWrongCommitWithMergeStrategy to assert that stale plan files are deleted (previously they asserted plan files survived — that was the buggy behavior)

Testing

All existing tests pass with the updated assertions. The fix was validated against both the branch strategy (TestClone_ResetOnWrongCommit) and merge strategy (TestClone_ResetOnWrongCommitWithMergeStrategy) code paths.

[Copilot]

Pull request overview

Fixes a safety issue where untracked .tfplan files can survive git reset --hard during updateToRef, allowing a subsequent bare atlantis apply to apply a stale plan created for a previous commit.

Changes:

• After updating the working directory ref (branch strategy and merge strategy), remove stale .tfplan files from the workspace.
• Add deletePlanFiles() helper to walk the workspace and delete .tfplan files (skipping .terragrunt-cache).
• Update clone/reset tests to assert that stale plan files are deleted after moving to a new commit.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
server/events/working_dir.go	Deletes stale .tfplan files after updateToRef to prevent applying plans from a previous commit.
server/events/working_dir_test.go	Updates reset-on-wrong-commit tests (branch + merge strategy) to assert .tfplan cleanup occurs.

[nandiheath]

didn't mean to approve the PR but doesn't seem like i can dismiss it :(