Add exclude_projects to drift detection API

[therealdwright]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

• I'd be willing to implement this feature (contributing guide)

Describe the user story

I run scheduled drift detection through POST /api/drift/detect, and most of the time I want to check everything in the repo except a handful of projects. Usually that's stuff that's noisy, slow to plan, managed outside Atlantis, or just temporarily broken and not worth the noise.

Right now the only way to scope a run is the projects allow-list, so "everything except these two" means listing out every single project by hand. On a big monorepo that list gets long and annoying to maintain, and it quietly rots: the moment someone adds a new project, it silently stops being checked because it's not in my list. That's the opposite of what I want from drift detection.

Describe the solution you'd like

Add an optional exclude_projects field to the request:

{
  "repository": "OWNER/repo",
  "ref": "master",
  "type": "Github",
  "exclude_projects": ["foo", "bar"],
  "include_plan_output": true
}

How it would work:

• When exclude_projects is set (and projects/paths aren't), Atlantis does its normal full-repo discovery and then drops any discovered project whose name is in the list before planning it, so the skipped ones don't cost any compute.
• It's mutually exclusive with projects and paths, since excluding only makes sense when you're discovering everything.
• New projects still get picked up automatically. You only ever maintain the short list of things to skip.

So instead of an allow-list that grows forever and goes stale, you keep a small, stable "skip these" list.

Describe the drawbacks of your solution

• Matching is by project name, so it only works for projects named in atlantis.yaml. Unnamed auto-discovered projects can't be excluded this way, and covering those would need a separate path-based option later.
• It adds a third way to scope a request (projects vs paths vs exclude_projects), which is a bit more validation and docs to keep straight.
• A typo in an excluded name is just a no-op, it won't skip anything and won't complain. We could log names that were excluded but never matched to make that less surprising.

Describe alternatives you've considered

• Keep using the projects allow-list (what we do today). The problem is the list is long, hand-maintained, and quietly misses any newly-added project.
• Ask for everything and filter the response on the client side. This still runs a full Terraform plan for every project we don't care
  about, which is the expensive part.
• A flag in atlantis.yaml to opt a project out of drift detection. That's more central, but it needs a config change per project and can't be varied per run (say, skipping something for just one scheduled sweep), so it's less flexible than a per-request field.