cloudposse/atmos v1.225.0-rc.6

on GitHub

• Add date-anchored edition: defaults, the --edition override, and atmos describe/list edition commands.
• Journal default changes and add config, CLI, docs, snapshot, and cast coverage for edition-aware behavior.
• Make describe component/dependents honor graceful YAML error handling without requiring implicit identity authentication.

why

• Let projects upgrade Atmos without silently adopting later default changes, while giving operators visibility into effective defaults.
• Avoid duplicate post-auth error output and let component inspection continue when recoverable YAML values cannot resolve.

references

• N/A

Summary by CodeRabbit

• New Features

  • Added experimental date-pinned configuration editions via --edition, ATMOS_EDITION, or atmos.yaml.
  • Added describe edition and list editions commands for inspecting default changes.
  • Added component mock support with --use-mocks.
  • Added configurable component filtering, provenance display, error handling, and help filtering.

• Bug Fixes

  • Improved table sizing, terminal wrapping, whitespace, tree output, authentication handling, and validation exclusions.
  • Preserved clearer error details and prevented unintended authentication attempts.

• Documentation

  • Added documentation and examples for editions and updated command and configuration references.

• Move the concrete store backend implementations (AWS SSM, Azure Key Vault, Google Secret Manager, Redis, Artifactory) out of pkg/store into a new pkg/store/providers subpackage, keeping pkg/store as a pure interface/type boundary (the Store interfaces, StoreConfig/StoresConfig/StoreRegistry types, auth-config types, error sentinels, and generated mocks).
• Introduce a self-registering registry: pkg/store owns StoreRegistry, NewStoreRegistry, and a Register(type, factory) API; each backend registers its factory from an init(), so the type switch is replaced by a map lookup. pkg/config blank-imports pkg/store/providers so the built-in backends register at startup (database/sql driver pattern).
• Update call sites and add a pkg/store/providers exclusion to the provider-agnostic-auth depguard rule so its cloud-SDK imports are permitted (matching pkg/auth/providers).

why

• Isolates the cloud-SDK-heavy backend code from the store contract, mirroring the established pkg/auth/providers / pkg/secrets/providers layout and making pkg/store a clean type/interface package.
• The registry pattern removes the awkward split where the factory lived under providers but was named after the StoreRegistry type it returned; pkg/store now owns both the registry type and its construction, and adding a backend is one self-contained file that registers itself.
• No user-visible change: identical store types resolve, unknown types still return ErrStoreTypeNotFound, identity warnings are preserved. Builds clean, all affected tests pass, and golangci-lint --new-from-rev=origin/main reports zero issues.

references

• N/A

Summary by CodeRabbit

• New Features
  • Storage backends now use a consistent registration model, improving support for configured providers and aliases.
• Bug Fixes
  • Improved handling of missing configuration, invalid values, authentication failures, access errors, and unavailable data.
• Tests
  • Expanded coverage for provider validation, key behavior, error scenarios, and concurrent registry operations.
• Documentation
  • Clarified storage registry configuration in the schema.
• Chores
  • Improved CI reproducibility and license-report generation.

• Adds a --format flag to atmos toolchain get with three modes: table (default, unchanged), plain (bare version string only), and json (structured output with tool/version/installed fields, or a full version list under --all).
• Routes the new plain/json output through the data channel (stdout, pipeable) instead of the styled UI channel (stderr), via new printVersionsPlain/printVersionsJSON helpers in pkg/toolchain/get.go.
• Rejects --format=plain combined with --all with a new ErrToolchainPlainFormatWithAllFlag sentinel, since there's no single version to print in that case.
• Adds a changelog post and links it into the toolchain roadmap milestone.

why

• Extracting a tool's version in scripts/CI previously required regex-scraping the human-styled table output (checkmark indicator, ANSI colors, 2>&1 since it's written to stderr), e.g. atmos toolchain get vale-cli/vale 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1.
• --format=plain collapses that to version=$(atmos toolchain get vale-cli/vale --format=plain), and --format=json gives scripts structured access to installed status without adding a new dependency.

references

Summary by CodeRabbit

• New Features
  • Added table, plain, and JSON output formats to atmos toolchain get.
  • Added --format/-f, environment-variable support, and shell completion.
  • Plain output provides version strings; JSON provides structured tool and installation details.
• Bug Fixes
  • Added validation for unsupported formats and incompatible --all and plain output options.
• Documentation
  • Updated command documentation, scripting examples, and roadmap information.

• Fixes atmos scaffold generate so a relative target directory (e.g. the CLI's own default ./my-project) works, instead of rejecting every file with path traversal not allowed.
• validateWriteTarget in pkg/generator/engine/templating.go now resolves the write directory (realDir) through the same ResolveAndCleanBasePath helper already used for the target base (realBase), instead of a bare filepath.EvalSymlinks that stays relative for relative inputs.
• Adds a regression test, TestProcessFile_RelativeTargetPath, covering a relative targetPath end-to-end (previous tests only exercised absolute t.TempDir() targets, so this case was never caught).

why

• realBase was always absolutized before comparison, but realDir was resolved with a bare filepath.EvalSymlinks, which returns a relative path unchanged when given a relative input. Comparing an absolute path against a relative one never matched the containment check, so it fired as a false-positive path traversal on every write whenever the target directory was relative — including the command's own default target.
• Absolute targets happened to work only because filepath.Dir(fullPath) was already absolute in that case, masking the bug.

references

• Closes #2851

Summary by CodeRabbit

• Bug Fixes

  • Fixed file generation for relative target paths, such as ./my-project.
  • Improved path resolution while preserving containment and symlink safety checks.

• Tests

  • Added coverage confirming generated files are written to the expected destination with the correct content.