cloudposse/atmos v1.225.0-rc.4

on GitHub

• Add TestMergeConfig_AtmosDCommandsMerging_TopLevelYamlFunction to pkg/config/config_import_test.go, reproducing the exact minimal repro from #2570: two .atmos.d/ files where the last-processed file has a top-level Atmos YAML function (!repo-root) directly on a command's own field.

why

• Confirms the reported "commands silently dropped" bug is already fixed incidentally by commit 0b1182c6bb (PR #2677, released in v1.223.0), which strips the commands key from file content before preprocessAtmosYamlFunc runs so it can no longer overwrite the already-merged commands array.
• Adds a permanent regression guard pinning this exact shape so it can't silently reappear.
• No production code changes — test-only.

references

• Closes #2570

• Fix isValidSemver() in pkg/toolchain/version_spec.go so it accepts semver pre-release and
  build-metadata suffixes (e.g. 1.225.0-rc.3, 1.2.3+build.5), by delegating to the
  already-vendored Masterminds/semver/v3 library instead of a hand-rolled digit-only check.
• Add regression tests for the fix in pkg/toolchain/version_spec_test.go (unit-level
  isValidSemver/ParseVersionSpec cases) and pkg/version/reexec_test.go (end-to-end at the
  --use-version entry point).
• Add a fix record at docs/fixes/2026-07-31-use-version-release-candidate-semver.md.

why

• atmos --use-version=1.225.0-rc.3 failed with invalid version output format, even though
  1.225.0-rc.3 is a spec-compliant semver string. The version parser split on . and required
  every part to be pure digits, which rejects any release-candidate/pre-release version.
• Tracing the install pipeline confirmed the parser was the only place the bug lived — the rest
  of the install path already handles arbitrary explicit versions (including prereleases)
  correctly, so no other changes were required.

references

• closes #2839

Summary by CodeRabbit

• New Features

  • --use-version now accepts release-candidate versions such as 1.225.0-rc.3, including versions with build metadata.
  • Version specifications support standard semantic version formats while retaining support for latest.

• Bug Fixes

  • Improved version validation to reject malformed or overly specific versions and correctly handle pre-release identifiers.

• Documentation

  • Added guidance covering supported semantic version formats and release-candidate usage.

• Fix a fatal error: concurrent map iteration and map write crash in DAG-scheduled bulk terraform commands (terraform <cmd> --all/--affected/--query) at higher --max-concurrency.
• ProcessComponentConfig now shallow-clones the component section before any downstream code mutates it, so concurrent workers never write into the map tree owned by the shared FindStacksMap cache.
• Apply the same shallow-clone-before-mutate fix to two adjacent cache-corruption sites in the describe-stacks processor (deleting imports, and terraform_workspace_pattern/terraform_workspace_template, from cache-owned maps in place).
• Add regression tests (internal/exec/process_stacks_shared_cache_test.go) that fail pre-fix both deterministically and under -race.
• Bump the brace-expansion pnpm.overrides (website) to 1.1.18/2.1.4, patching CVE-2026-14257 / GHSA-mh99-v99m-4gvg (high-severity DoS via unbounded expansion length), reported by Dependabot alert #261.

why

• FindStacksMap caches processed stack config and returns it by reference on cache hits, shared across all goroutines within a process. ProcessStacks and mergeGlobalAuthConfig write top-level keys into that shared component section, while findComponentInStacks has every DAG worker iterate every stack's component section (not just its own) looking for a match — so one worker's write races with another worker's read/iteration of the same cached map, crashing exactly as reported.
• The describe-stacks processor had the identical hazard in two more places (both mutate cache-owned maps in place), corrupting the cache for every subsequent ProcessStacks call in the same process even outside the crash path.
• The brace-expansion bump addresses an open, high-severity Dependabot alert; deferring it risks a DoS crash if attacker-influenced input reaches an affected glob/brace-pattern code path in the docs site tooling.

references

• Dependabot alert: https://github.com/cloudposse/atmos/security/dependabot/261

Summary by CodeRabbit

• Bug Fixes

  • Prevented concurrency-related crashes when processing multiple stacks or components in parallel.
  • Preserved cached configuration data during stack and component processing.
  • Improved template handling for computed Terraform and Atmos sections.
  • Ensured generated Spacelift and Atlantis names are available during template evaluation.
  • Corrected describe output to include referenced imports consistently.
  • Improved propagation of configuration and template-processing errors.

• Documentation

  • Clarified dependency advisory exceptions and their removal criteria.
  • Documented the concurrency crash fix and validation coverage.

• Add clone-local --ci and ATMOS_CI controls for no-argument CI checkout, including explicit opt-out behavior.
• Replace hand-rolled argv/flag parsing in cmd/root.go for CI git-clone bootstrap detection with Cobra-identity + the existing cmd/git flag-handler infrastructure (resolveCICloneMode), removing ~140 lines of bespoke parsing.
• Fix atmos git clone's no-arg CI checkout to resolve the branch from the CI provider's parsed short name instead of the raw ref, which previously failed real branch/PR checkouts.
• Fix a Windows CI acceptance-test flake: a telemetry test was deleting the shared Atmos cache root mid-suite, which since #2579 also holds the toolchain install tree.
• Add Docker CLI support to the official Atmos image and update CI, command, and modernization guidance.
• Cover selector precedence, bootstrap gating, and invalid environment input.

why

• Enables checkout bootstrap before repository configuration is available while preserving explicit control.
• Keeps CI bootstrap detection consistent with the repo's flag-handler architecture instead of a parallel hand-rolled path.
• The raw-ref checkout bug meant the documented CI checkout replacement for actions/checkout (docs/prd/git-ops.md) never actually worked for a real branch or PR.
• The shared-cache-root deletion was causing multi-week Windows CI flakiness unrelated to this PR's own diff, blocking merge.
• Removes the need for Docker installation steps in Atmos container jobs.

references

• N/A

Summary by CodeRabbit

• New Features

  • Added --ci support for atmos git clone, configurable with ATMOS_CI.
  • No-argument cloning can now automatically use the current CI checkout.
  • Explicit CLI settings take precedence over environment configuration.

• Bug Fixes

  • Fixed CI checkout failures caused by using full ref paths instead of branch names.
  • Improved handling of invalid CI configuration values.

• Documentation

  • Updated Git clone, GitHub Actions, and CI setup guidance.
  • Added notes covering Docker support and CI bootstrap behavior.