cloudposse/atmos v1.218.1-rc.1 on GitHub

feat(list): add --skip flag; fix --stack/--filter/--query on list instances @osterman (#2413)

## what

--skip across every atmos list subcommand. instances, components, metadata, sources, and stacks now accept --skip <yaml-function> (repeatable, e.g. --skip terraform.state --skip terraform.output). Mirrors the surface already exposed by describe affected | component | stacks. Bound to ATMOS_SKIP; the existing ATMOS_AFFECTED_SKIP continues to work on list affected as a back-compat alias. Threads through ExecuteDescribeStacks — which already accepted skip but was being passed nil at every list callsite.
--stack, --filter, and --query on atmos list instances now work. Three documented flags were previously silent: --stack was ignored (every instance returned), --filter was a TODO stub, and --query was read into options and dropped. --stack now uses path.Match glob semantics, --filter evaluates a YQ predicate per row, and --query projects each row via YQ (scalars land in a value column, maps flatten to row keys). Closes a latent ENV-precedence gap so ATMOS_LIST_FORMAT and ATMOS_UPLOAD are honored via viper.
Tests. Parser, options, and propagation tests for --skip (with a regression test for the literal list instances --upload --skip terraform.state failure). Unit + integration tests for the stack/filter/query work. New pkg/list/filter/yq.go (YQPredicateFilter, YQProjector, isTruthy) with full coverage.
Docs + release artifacts. --skip documented on all five list pages; two release-blog entries; one roadmap milestone under the Discoverability initiative.

why

The concrete failure on --skip: atmos list instances --upload --skip terraform.state errored with unknown flag. --process-functions=false is not a substitute because it also disables !template, which Atmos Pro uploads need so settings.pro.enabled evaluates to a real boolean instead of a literal string.
The concrete failure on --stack/--filter/--query: the docs promised filtering on list instances and the implementation didn't honor it. Users hit silent wrong-result behavior, not an error.
Both features ship through the same set of list files; bundling avoids merge churn and keeps the test+docs surface coherent.

references

Pattern source for --skip rollout: #2363 (--process-templates / --process-functions rollout across list)
Origin of --skip (describe family): #1006

Summary by CodeRabbit

New Features
- Repeatable --skip flag (ATMOS_SKIP; legacy ATMOS_AFFECTED_SKIP preserved) added across list commands; list instances adds --stack glob filtering.
Enhancements
- YQ-based --filter (truthy predicates) and --query (projections); format-aware validation for tree/matrix; improved config precedence for list flags.
Bug Fixes
- --stack / --filter / --query now honor documented behavior.
Tests
- Expanded coverage for skip flag, YQ filters/projectors, and stack-glob filtering.
Documentation
- Updated CLI docs, blog posts, and roadmap.

🚀 Enhancements

fix(list): make `list components` output deterministic across runs @osterman (#2422)

## what

atmos list components (and especially --enabled=false / --locked=true) now returns deterministic, consistent results across invocations on the same workspace.
Aggregate per-stack enabled/locked state into the deduplicated component view: any-disabled-wins for enabled, any-locked-wins for locked. status / status_text are recomputed from the aggregate.
Sort stack names, component names, and the output slice so iteration order no longer depends on Go's randomized map iteration.
Documentation for --enabled / --locked now describes the cross-stack aggregation semantics and points at atmos list instances for per-stack-instance state.
Adds regression tests in pkg/list/extract/: a 200-iteration determinism test for --enabled=false, an aggregation-policy test for enabled/locked, and an output-order stability test.

why

Reported in #2359: running atmos list components --enabled=false repeatedly produced different output every time — sometimes empty, sometimes 1 component, sometimes 2 or 3 different components — with no changes to the workspace.
Root cause: extractUniqueComponentType in pkg/list/extract/components.go extracted metadata only from the first stack iterated for each component, and UniqueComponents iterated stacksMap (a Go map) in randomized order. When the same component had enabled: false in some stacks and enabled: true in others, the recorded value depended on iteration order — so BoolFilter.Apply would include or exclude the component non-deterministically.
Sorting alone would have made the output stable but not necessarily correct for users with mixed-state components; the aggregation policy ensures a component disabled anywhere shows up under --enabled=false, which matches the user's expected behavior in the issue.

references

closes #2359

Summary by CodeRabbit

Bug Fixes
- Resolved non-deterministic output in list components command; results now consistent across invocations.
- Adjusted --enabled and --locked flags to aggregate state across stack instances: a component is shown as disabled/locked if any instance has that state.
Documentation
- Clarified list components flag behavior for cross-stack aggregation reporting.
Tests
- Added regression test coverage for deterministic component aggregation.

fix(auth): normalize --identity=false to disable authentication @osterman (#2412)

## what

Normalize boolean-false values (false, 0, no, off, case-insensitive) passed via --identity=<value> and --identity <value> to the disabled sentinel (cfg.IdentityFlagDisabledValue), so the auth pre-hook and CreateAndAuthenticateManager* short-circuit instead of trying to authenticate with the literal name "false".
Patch is in internal/exec/cli_utils.go::parseIdentityFlag — the single arg-walker that feeds info.Identity / configAndStacksInfo.Identity for every ProcessCommandLineArgs consumer (terraform, helmfile, packer, list, describe, workflow, vendor, pro, validate, atlantis, docs, generate).
Add parser-level unit cases in TestParseIdentityFlag for =false / =False / =FALSE / =0 / =no / =off plus space-separated form, and end-to-end cases in TestProcessArgsAndFlags_IdentityFlag{,Helmfile,Packer} asserting info.Identity == cfg.IdentityFlagDisabledValue.

why

Regression: ATMOS_IDENTITY=false was fixed in #1935 by normalizing the env-var fallback at cli_utils.go:199, but the env fallback only runs when Identity == "". When --identity=false is passed on the CLI, parseIdentityFlag populated the literal "false", the env-fallback branch was skipped, and the literal flowed through to pkg/auth/hooks.go::isAuthenticationDisabled (which only matches __DISABLED__).
#2225 extracted parseIdentityFlag into a new helper without porting the normalization from the env path, silently breaking the documented --identity=false contract. Reported by users for atmos terraform * and atmos list instances.
Centralizing normalization at the parse site means every command sharing ProcessCommandLineArgs is fixed in one place, and matches the behavior already implemented for the StandardParser path (pkg/flags/global_registry.go) and the cmd/identity_helpers.go / cmd/list/utils.go / cmd/list/affected.go per-command identity reads.

references

Builds on #1900 / #1935 (env-var normalization) and corrects the regression introduced by the refactor in #2225.

Summary by CodeRabbit

Bug Fixes
- The --identity flag now recognizes common boolean-false values (false, 0, no, off, case-insensitive) to disable authentication.
New Features
- Passing --identity=false (or equivalent) disables per-component auth resolution and is honored across describe, list, and state-resolution flows.
- Describe and list commands now surface and propagate an "auth disabled" option so outputs respect disabled auth.
Tests
- Expanded tests for identity parsing and auth-disabled behavior across commands, env vars, and execution paths.