cloudposse/atmos v1.225.0-rc.7

on GitHub

• Adds atmos store — a new CLI command group (set/get/delete/list) for raw CRUD access to any store backend configured under stores: in atmos.yaml (AWS SSM, AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, GCP Secret Manager, Redis, Artifactory, 1Password, Keychain, GitHub Actions). Unlike atmos secret, no declaration is required — any key can be read, written, or deleted directly by name, optionally scoped to a stack and component.
• Adds a type: store workflow step that writes a value from a workflow, custom command, or hook — usable automatically as a hook too via the existing generic kind: step bridge, with no extra wiring.
• Both close the write-side gap next to the existing read-only !store/!store.get YAML functions, so pipeline metadata (an image tag from a build step, a build number, a deployment marker) can be handed off to a completely different stack or component.
• Includes unit tests for the new pkg/store.Service facade, the cmd/store command family, and the store step handler, plus CLI/website docs, a changelog post, and a roadmap milestone.

why

• Store backends previously supported reads only (!store/!store.get); the only existing write path was a single Terraform-output-specific hook (kind: store), so anything else needing to be written into a store meant scripting around Atmos with a cloud CLI.
• This gives Atmos a native, declaration-free CRUD surface and a first-class workflow step for the common build → push → record-value → later-read pattern, without requiring the value to be formally declared as a secret.

references

• N/A

Summary by CodeRabbit

• New Features

  • Added experimental atmos store commands to set, get, list, and delete values across configured backends.
  • Added scoping, interactive or stdin input, deletion confirmation, raw output, multiple formats, key enumeration, and secret-value masking.
  • Added type: store workflow steps for writing templated values.
  • Added Terraform output and refresh lifecycle hooks for store integrations.

• Documentation

  • Added CLI, configuration, workflow, hooks, and usage documentation with examples and backend limitations.

• Tests

  • Added comprehensive coverage for store commands, workflow behavior, and Terraform hooks.

• Add atmos terraform migrate plan, apply, and list for running user-authored tfmigrate migrations in Terraform component context.
• Add kind: tfmigrate lifecycle hooks with dynamic/static modes, toolchain resolution, Terraform/OpenTofu exec path wiring, and same-identity auth handling.
• Export stack/component/workspace-scoped history variables and supported Terraform backend settings so users can configure durable tfmigrate history storage.
• Update schemas, PRD, command docs, hook docs, roadmap, and changelog for the new migrate command family and history persistence limitation.

why

• Terraform state migrations need to run after Atmos auth, source/workdir provisioning, generated files, init, and workspace selection so automation matches normal Terraform operations.
• Rerun-safe automation depends on durable tfmigrate history storage, so Atmos now documents and exposes the values users need without taking on history persistence in v1.

references

• https://github.com/minamijoyo/tfmigrate

Summary by CodeRabbit

• New Features
  • Added experimental atmos terraform migrate plan, apply, and list commands.
  • Added tfmigrate lifecycle hooks with dynamic and explicit execution modes.
  • Added migration history support for local, S3, and GCS backends.
  • Added affected-component workflows and configurable migration output.
• Bug Fixes
  • Improved hook validation, dry-run handling, terminal color precedence, and provider resolution.
  • Missing migration directories now safely produce no-op results.
• Documentation
  • Added CLI guidance, migration patterns, advanced examples, and help pages.
• Tests
  • Added comprehensive unit, integration, and end-to-end coverage.

validation

Manually tested end-to-end as a real user — following --help/docs, in isolated sandboxes, and against a real repository (cloudposse/infra-live):

• Opened two real pull requests exercising both the default and the full vendor.ci.pull_request config surface (title/body templates, labels, draft, reviewers, assignees) — #1701, #1702 (left as drafts, not merged).
• That testing surfaced and fixed 5 real bugs along the way:
  • --pull-request created a pull request but never printed its URL in the default table output.
  • atmos.yaml's vendor.update.*/vendor.ci.* config (groups, execution mode, PR title/labels/draft/reviewers) was silently ignored — read from the wrong viper instance instead of the parsed config.
  • --all double-counted every component when a repo vendors exclusively via component.yaml and leaves an unused component type (e.g. packer) unconfigured.
  • A pull request's link was discarded entirely when a post-creation step failed (hit for real: GitHub rejecting a review request from the PR's own author).
  • SBOM's oci-artifacts coverage entry always claimed "complete" regardless of whether any OCI artifact existed in the project.
• Also manually verified atmos vendor verify/clean/--refresh-lock/--lock-enforcement (all three modes) and atmos sbom generate (CycloneDX vs. SPDX, NTIA mode, experimental gating, upload-outside-CI) in isolated sandboxes.
• Added ATMOS_PRO_GITHUB_TOKEN (the token github/sts mints) to the Component Updater's GitHub token precedence, so atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request gets a token that triggers downstream Actions workflows on the PR it opens — unlike the default GITHUB_TOKEN, which GitHub excludes from re-triggering workflows.

references

• Component Updater PRD

Summary by CodeRabbit

• New Features
  • Added experimental atmos sbom generate with provenance/NTIA modes, SPDX/CycloneDX output, and optional CI artifact upload.
  • Added native atmos vendor update --pull-request workflows with component/group selection and deterministic PR publishing.
  • Added atmos vendor verify, atmos vendor clean, and vendor.lock.yaml drift protection.
  • Added lock refresh/enforcement options, semver-range resolution, and improved source provenance metadata.
• Bug Fixes
  • Improved cancellation handling and transient OCI decompression recovery.
• Documentation
  • Expanded SBOM, vendoring, lockfile, and component-updater guidance.

• Enable --tags and --labels on atmos workflow, forwarding them to nested type: atmos steps alongside optional --stack.
• Preserve selector forwarding for parallel and matrix workflow controls.
• Document the feature, publish its changelog post, and add its workflow-roadmap milestone.

why

• Target existing workflows by component metadata without duplicating workflows or reconstructing their commands manually.

references

• Closes #2852

validation

• go test ./internal/exec -run TestExecuteWorkflow_ForwardsCommandLineFilters -count=1
• go test ./pkg/workflow -run 'TestAppendAtmosStepFlags|TestControlCommandExecutorExecuteAtmos' -count=1
• go test ./cmd/workflow -run TestWorkflowSelectorFlags -count=1
• git diff --check

Summary by CodeRabbit

• New Features

  • Added --tags and --labels selectors to workflow commands.
  • Selectors are forwarded to nested Atmos steps, including parallel and matrix workflows.
  • Selectors can be combined with --stack while preserving workflow ordering and execution behavior.

• Documentation

  • Updated CLI references with selector options and usage examples.
  • Added workflow selector guidance to the blog and roadmap.

• Fixes pkg/config/load_config_args.go so that loading configuration via --config/--config-path also applies git-root discovery for an empty (or .) base_path, matching the plain auto-discovery flow in LoadConfig().
• Adds a regression test (TestLoadConfigFromCLIArgs_AppliesGitRootBasePath) that reproduces the bug and verifies base_path now resolves correctly.
• Bumps the fast-uri transitive dependency (website) from 3.1.4 to 3.1.5 to remediate a high-severity host-confusion vulnerability (GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446), flagged by Dependabot after this branch was pushed.

why

• loadConfigFromCLIArgs() never called applyGitRootBasePath(), unlike the main LoadConfig() auto-discovery path. As a result, a project with base_path: '' in atmos.yaml resolved correctly via plain auto-discovery but left base_path empty when the identical config was loaded via --config, breaking component/stack path resolution (e.g. atmos terraform test) with Error: failed to find import.
• The fast-uri bump addresses a live Dependabot alert (a patch-level version bump, not blocked by .github/dependabot.yml's major-version ignore policy) surfaced automatically after pushing this branch.

references

• closes #2863

Summary by CodeRabbit

• Bug Fixes

  • Configuration loaded through command-line options now resolves an empty or "." base path to the Git repository root.
  • Configuration loading continues when repository root discovery encounters an error.
  • Improved ZIP extraction safety by blocking path traversal and preventing writes outside the intended destination.
  • Improved error reporting for ZIP directory and file creation failures.

• Tests

  • Added coverage for configuration base-path resolution and ZIP extraction security and failure handling.

• Skip the Azure CLI cache write-back entirely when credentials originated from the azure/cli provider — az's own cache is authoritative, and writing back what came from az is what corrupted it.
• Record the originating auth method on AzureCredentials (cli / device_code / oidc) so the write-back can be gated per provider kind.
• Capture MSAL's real home account ID in the azure/device-code provider (silent and interactive flows) and use it in both Azure CLI cache writers (UpdateAzureCLIFiles and the provider-level updateAzureCLICache), falling back to the previous {oid}.{tenant} derivation when unavailable.
• Replace the azure/subscription identity's field-by-field credential copy with a struct copy plus explicit overrides, and add a reflection-based regression test that fails if any future AzureCredentials field is dropped by the wrap.
• Isolate TestNewMSALCache's default-path case from the real ~/.azure.

why

• After atmos auth login, the Azure CLI cache write-back created an MSAL Account entry with home_account_id derived as {oid}.{target-tenant} and hardcoded account_source: "device_code". For guest (B2B) users the home tenant differs from the target tenant, so az ended up with two Account entries for the same username and failed every subsequent command with Found multiple accounts with the same username (azure-cli#20168) — including az account get-access-token, which the azure/cli provider itself shells out to. In other words, one atmos auth login broke both az and the next atmos login for any guest user.
• Reproduced and verified end to end against a real tenant where the operator is a B2B guest: before the fix, az login → atmos auth login → az broken; after the fix, az stays healthy, the cache keeps exactly one Account entry, and the persisted credentials carry auth_method so the gate holds across credential caching.
• The subscription identity's field-by-field copy silently dropped the new fields before they reached the cache writer (found only by the end-to-end test), which is why the copy is now structural and guarded by a reflection test.

references

• Azure/azure-cli#20168 (the az failure mode this triggered)

Summary by CodeRabbit

New Features

• Azure credentials now retain authentication method and account identity details.
• Improved support for guest and cross-tenant Azure accounts during authentication and token caching.
• Subscription-based authentication preserves provider credential settings while applying subscription-specific values.

Bug Fixes

• Azure CLI authentication no longer unexpectedly modifies CLI credential cache files.
• Corrected account identification and tenant details for guest-user authentication.
• Improved cache path handling across different environments.