cloudposse/atmos v1.224.1-rc.1

on GitHub

• Write string values to secret: true AWS SSM stores without JSON quoting.
• Preserve JSON encoding for structured secrets and regular SSM stores, with regression coverage.
• Document absolute SSM parameter prefixes.

why

• AWS-native consumers need the raw SecureString value rather than a JSON-wrapped scalar.

references

• Closes #2795

Summary by CodeRabbit

• Bug Fixes

  • Improved AWS SSM secret handling to preserve raw string values (including number-like, boolean, and null text) without unwanted formatting or type changes.
  • Added/strengthened round-trip behavior for structured secret values (maps and lists), plus correct handling of empty secret strings.
  • Updated retrieval behavior to decode stored values consistently (including for GetKey).

• Documentation

  • Clarified AWS SSM prefix must start with /.
  • Documented secret: true read/write behavior and related decoding ambiguity.

• Tests

  • Expanded SSM secret set/get/get-key coverage for both raw and legacy formats.
  • Updated Terraform-compatible tooling test isolation to cover both terraform and tofu.

• apply Atmos's provider plugin-cache policy to internal !terraform.output and atmos.Component() Terraform runs
• serialize internal terraform init calls that share a provider cache
• preserve explicit cache overrides and add regression coverage

Root cause

The normal Terraform command pipeline synthesized TF_PLUGIN_CACHE_DIR, but the internal output executor created a separate subprocess environment without that automatic cache configuration. Each lookup therefore initialized providers in its component workdir unless CI injected the cache manually.

Validation

• go test ./...
• focused provider-cache and output-executor tests
• scripts/run-custom-golangci-lint.sh
• pre-commit hooks (go-fumpt, Go build, custom lint)

Summary by CodeRabbit

• New Features
  • Automatic Terraform provider plugin caching now derives and reuses a shared cache directory for Terraform subprocesses.
  • Internal Terraform output lookups reuse the same caching policy.
• Bug Fixes
  • Cache precedence is now component override → process environment → global config, with safer invalid-path fallback.
  • Shared provider initialization is serialized, and init failures now propagate during output lookups.
• Tests
  • Added coverage for cache resolution, environment wiring, init-lock serialization, and cross-platform behavior.
• Documentation
  • Added fix notes for provider-cache reuse, Windows plugin-cache test issues, and a repo-copy race.
• Chores
  • Updated dependency versions and website build overrides.

• Keep each bootstrap verifier's install, trust repair, and execution inside its version lock.
• Render structured error output with ANSI color in CI while preserving NO_COLOR behavior.

why

• Parallel tool installs could reinstall cosign while another worker was executing it, causing Linux ETXTBSY failures.
• The structured error formatter omitted the standard CI signal even though the rest of Atmos recognizes CI as ANSI-capable.

references

• https://github.com/cloudposse-examples/atmos-native-ci/actions/runs/30062334123/job/89386299463

Summary by CodeRabbit

• Bug Fixes
  • CI now correctly enables ANSI color rendering unless disabled via NO_COLOR.
  • Verifier bootstrap now preserves the per-version install lock through trust repair and verifier execution, reducing binary replacement race conditions.
  • Added a bounded timeout for verifier subprocesses when no deadline is provided to prevent indefinite lock holding.
• Documentation
  • Added a dated fixes note describing the verifier install-lock and CI color behavior.
• Tests
  • Hardened CI/ANSI-dependent assertions by stripping ANSI escape codes where needed.