feat: commit statuses and merge comment

Adds two related improvements to the pull request lifecycle:

- Post a comment on the pull/merge request once Burrito applies the
  merged changes, reporting success or failure per affected layer
  (internal/controllers/terraformpullrequest/comment/apply.go). The
  TerraformPullRequest resource is kept alive after merge (annotated
  with the merge date instead of being deleted) so its controller can
  track layer applies and post that comment once they complete.

- Report plan and apply status via the GitHub Commit Statuses API and
  GitLab External Commit Statuses (internal/controllers/terraformpullrequest/status,
  APIProvider.SetStatus in the github/gitlab/mock providers). The
  status is set to pending when a phase starts and updated to
  success/failure based on the actual outcome:
  - plan: pending when temp layers are created, success/failure once
    the comment is posted, based on whether every layer produced a
    plan.
  - apply: pending while waiting for the merged layers to apply,
    success/failure once they all have, based on LastApplyDate vs a
    failed TerraformRun created after the merge.

Status updates are best-effort and never fail the reconciliation loop.

Author: DjinnS

.gitignore

@@ -51,3 +51,4 @@ credentials/
 
 test-repo/
 TIltfile
+.DS_Store

deploy/charts/burrito/values-dev.yaml

@@ -3,7 +3,7 @@ config:
     runner:
       image:
         repository: burrito
-        tag: "1783089222"
+        tag: "1783690876"
         pullPolicy: Never
     datastore:
       storage:
@@ -16,7 +16,7 @@ global:
   deployment:
     image:
       repository: burrito
-      tag: "1783089222"
+      tag: "1783690876"
       pullPolicy: Never
 tenants:
   - namespace:

internal/annotations/annotations.go

@@ -18,6 +18,8 @@ const (
 	LastPlanRun    string = "runner.terraform.padok.cloud/plan-run"
 	Lock           string = "runner.terraform.padok.cloud/lock"
 
+	MergedAt               string = "webhook.terraform.padok.cloud/merged-at"
+	MergeCommit            string = "webhook.terraform.padok.cloud/merge-commit"
 	LastBranchCommit       string = "webhook.terraform.padok.cloud/branch-commit"
 	LastBranchCommitDate   string = "webhook.terraform.padok.cloud/branch-commit-date"
 	LastRelevantCommit     string = "webhook.terraform.padok.cloud/relevant-commit"

internal/controllers/terraformpullrequest/comment/apply.go

@@ -0,0 +1,43 @@
+package comment
+
+import (
+	"bytes"
+	"text/template"
+
+	_ "embed"
+)
+
+var (
+	//go:embed templates/apply.md
+	applyTemplateRaw string
+	applyTemplate    = template.Must(template.New("apply-report").Parse(applyTemplateRaw))
+)
+
+type ApplyReportedLayer struct {
+	Path      string
+	Succeeded bool
+}
+
+type ApplyComment struct {
+	layers []ApplyReportedLayer
+}
+
+func NewApplyComment(layers []ApplyReportedLayer) *ApplyComment {
+	return &ApplyComment{layers: layers}
+}
+
+func (c *ApplyComment) Generate(commit string) (string, error) {
+	data := struct {
+		Commit string
+		Layers []ApplyReportedLayer
+	}{
+		Commit: commit,
+		Layers: c.layers,
+	}
+	buf := bytes.NewBufferString("")
+	err := applyTemplate.Execute(buf, data)
+	if err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}

internal/controllers/terraformpullrequest/comment/templates/apply.md

@@ -0,0 +1,10 @@
+## :burrito: Burrito Apply Report
+
+{{ len .Layers }} layer(s) affected by this pull request have been applied on commit `{{ .Commit }}`.
+
+{{ range .Layers }}
+### Layer {{ .Path }}
+
+{{ if .Succeeded }}:white_check_mark: Apply succeeded.{{ else }}:x: Apply failed. Check the Burrito UI or runner logs for details.{{ end }}
+
+{{ end }}

internal/controllers/terraformpullrequest/conditions.go

@@ -1,6 +1,7 @@
 package terraformpullrequest
 
 import (
+	"context"
 	"time"
 
 	configv1alpha1 "github.com/padok-team/burrito/api/v1alpha1"
@@ -107,6 +108,68 @@ func (r *Reconciler) AreLayersStillPlanning(pr *configv1alpha1.TerraformPullRequ
 	return condition, false
 }
 
+func (r *Reconciler) IsMerged(pr *configv1alpha1.TerraformPullRequest) (metav1.Condition, bool) {
+	condition := metav1.Condition{
+		Type:               "IsMerged",
+		ObservedGeneration: pr.GetObjectMeta().GetGeneration(),
+		Status:             metav1.ConditionUnknown,
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+	_, ok := pr.Annotations[annotations.MergedAt]
+	if ok {
+		condition.Reason = "PullRequestMerged"
+		condition.Message = "Pull request has been merged."
+		condition.Status = metav1.ConditionTrue
+		return condition, true
+	}
+	condition.Reason = "PullRequestNotMerged"
+	condition.Message = "Pull request has not been merged yet."
+	condition.Status = metav1.ConditionFalse
+	return condition, false
+}
+
+func (r *Reconciler) AreLayersApplied(ctx context.Context, pr *configv1alpha1.TerraformPullRequest, mainLayers []configv1alpha1.TerraformLayer) (metav1.Condition, bool, []LayerApplyResult) {
+	condition := metav1.Condition{
+		Type:               "AreLayersApplied",
+		ObservedGeneration: pr.GetObjectMeta().GetGeneration(),
+		Status:             metav1.ConditionUnknown,
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+
+	mergedAtStr := pr.Annotations[annotations.MergedAt]
+	mergedAt, err := time.Parse(time.RFC3339, mergedAtStr)
+	if err != nil {
+		condition.Reason = "InvalidMergedAt"
+		condition.Message = "Could not parse merged-at annotation, this is likely a bug."
+		condition.Status = metav1.ConditionFalse
+		return condition, false, nil
+	}
+
+	if len(mainLayers) == 0 {
+		condition.Reason = "NoAffectedLayers"
+		condition.Message = "No layers are affected by this pull request."
+		condition.Status = metav1.ConditionTrue
+		return condition, true, nil
+	}
+
+	results := make([]LayerApplyResult, 0, len(mainLayers))
+	for _, layer := range mainLayers {
+		res := r.getLayerApplyResult(ctx, layer, mergedAt)
+		results = append(results, res)
+		if !res.Applied {
+			condition.Reason = "LayerNotApplied"
+			condition.Message = "At least one layer has not applied since merge."
+			condition.Status = metav1.ConditionFalse
+			return condition, false, results
+		}
+	}
+
+	condition.Reason = "AllLayersApplied"
+	condition.Message = "All affected layers have applied since merge."
+	condition.Status = metav1.ConditionTrue
+	return condition, true, results
+}
+
 func (r *Reconciler) IsCommentUpToDate(pr *configv1alpha1.TerraformPullRequest) (metav1.Condition, bool) {
 	condition := metav1.Condition{
 		Type:               "IsCommentUpToDate",

internal/controllers/terraformpullrequest/layer.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"slices"
+	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -166,7 +167,6 @@ func (r *Reconciler) deleteTempLayersByLabel(ctx context.Context, pr *configv1al
 		ctx, &configv1alpha1.TerraformLayer{}, client.InNamespace(pr.Namespace), client.MatchingLabels{managedByLabel: labelValue},
 	)
 }
-
 func tempLayerGenerateName(layerName string, pr *configv1alpha1.TerraformPullRequest) string {
 	hash := shortHash(fmt.Sprintf("%s/%s/%s", pr.Namespace, pr.Name, pr.Spec.ID))
 	prefix := fmt.Sprintf("%s-pr-%s-", layerName, hash)
@@ -186,3 +186,84 @@ func shortHash(value string) string {
 	sum := sha256.Sum256([]byte(value))
 	return hex.EncodeToString(sum[:])[:16]
 }
+
+// getMainBranchLayers returns the main-branch layers that correspond to the
+// temp layers linked to this PR (same path + repository, on the base branch).
+func (r *Reconciler) getMainBranchLayers(ctx context.Context, pr *configv1alpha1.TerraformPullRequest) ([]configv1alpha1.TerraformLayer, error) {
+	tempLayers, err := GetLinkedLayers(r.Client, pr)
+	if err != nil {
+		return nil, err
+	}
+
+	allLayers := &configv1alpha1.TerraformLayerList{}
+	if err := r.Client.List(ctx, allLayers); err != nil {
+		return nil, err
+	}
+
+	result := []configv1alpha1.TerraformLayer{}
+	for _, layer := range allLayers.Items {
+		if layer.Spec.Branch != pr.Spec.Base {
+			continue
+		}
+		if layer.Spec.Repository.Name != pr.Spec.Repository.Name ||
+			layer.Spec.Repository.Namespace != pr.Spec.Repository.Namespace {
+			continue
+		}
+		for _, temp := range tempLayers {
+			if layer.Spec.Path == temp.Spec.Path {
+				result = append(result, layer)
+				break
+			}
+		}
+	}
+	return result, nil
+}
+
+type LayerApplyResult struct {
+	Layer     configv1alpha1.TerraformLayer
+	Applied   bool
+	Succeeded bool
+}
+
+// getLayerApplyResult determines whether a layer has applied after mergedAt.
+// It checks:
+//   - success: LastApplyDate annotation is set and after mergedAt
+//   - failure: a TerraformRun with action=apply exists, was created after mergedAt,
+//     and is in Failed state
+func (r *Reconciler) getLayerApplyResult(ctx context.Context, layer configv1alpha1.TerraformLayer, mergedAt time.Time) LayerApplyResult {
+	result := LayerApplyResult{Layer: layer}
+
+	// Check success via annotation (only updated when apply succeeds)
+	lastApplyDateStr := layer.Annotations[annotations.LastApplyDate]
+	if lastApplyDateStr != "" {
+		lastApplyDate, err := time.Parse(time.UnixDate, lastApplyDateStr)
+		if err == nil && lastApplyDate.After(mergedAt) {
+			result.Applied = true
+			result.Succeeded = true
+			return result
+		}
+	}
+
+	// Check failure by looking for a Failed TerraformRun with action=apply after mergedAt
+	runs := &configv1alpha1.TerraformRunList{}
+	requirement, err := labels.NewRequirement(managedByLabel, selection.Equals, []string{layer.Name})
+	if err != nil {
+		return result
+	}
+	selector := labels.NewSelector().Add(*requirement)
+	if err := r.Client.List(ctx, runs, client.MatchingLabelsSelector{Selector: selector}, client.InNamespace(layer.Namespace)); err != nil {
+		return result
+	}
+	for _, run := range runs.Items {
+		if run.Spec.Action != "apply" {
+			continue
+		}
+		if run.CreationTimestamp.After(mergedAt) && run.Status.State == "Failed" {
+			result.Applied = true
+			result.Succeeded = false
+			return result
+		}
+	}
+
+	return result
+}