cloudposse/atmos v1.229.0-rc.4

on GitHub

• Add concurrent vendoring and update checks, ordered destination/receipt writes, shared toolchain progress with download and preparation milestones, cancellation-aware downloads and authentication, edition-aware flag/environment/configuration controls, lock-preserving cleanup, and per-package rollback on failed writes.
• Include the PRD, command/configuration/edition documentation, release note, roadmap entry, reproducible terminal demos, and isolated Git fixtures for reliable CI.

why

• Reduce download waits while preserving deterministic results and serial defaults for older edition pins.
• Validation: 93.5% changed-statement coverage, passing scoped race tests, lint, builds, and cast validation; the controlled eight-package fixture was 3.33× faster with four workers.

references

• Concurrent vendoring PRD
• Toolchain concurrency reference: #2758
• Merge preparation: align the edition journal date with the actual merge date

Summary by CodeRabbit

• New Features

  • Added concurrent vendor downloads, preparation, and update checks with ordered destination writes.
  • Added --max-concurrency, configuration, and environment-variable controls, defaulting to four workers.
  • Added progress reporting for active packages, download status, retries, and completion results.
  • Added cancellation support and safer rollback when installation or lock recording fails.
  • vendor clean now preserves lockfile entries for future reinstalls.

• Documentation

  • Added configuration guidance and examples for concurrent vendoring and progress behavior.

• Add seven from-* reference guides to the atmos-migration agent skill, mirroring its existing IaC migration references, for helping users migrate authentication tooling into atmos auth:
  • from-aws-config.md (~/.aws/config/credentials), from-gcp-config.md (gcloud), from-azure-config.md (az)
  • from-leapp.md, from-granted.md, from-aws2saml.md (saml2aws), from-okta-cli.md (okta-aws-cli)
• Wire all seven into SKILL.md's frontmatter, a new "Migrating Authentication" routing table, and "Additional Resources".
• Each guide includes a verified kind:/field mapping table, a CLI command-equivalence table, and an explanation of how atmos auth shell/exec/env interact with (or deliberately avoid touching) each cloud's default config file.
• from-aws-config.md also covers the aws/user browser-based OAuth2 PKCE login fallback (no static keys required), native ECR/EKS integrations, and aws/assume-root.
• from-okta-cli.md documents partial support only: aws/saml + driver: Okta is a full replacement when an org allows direct password+MFA API auth, but there's no equivalent yet for OIDC device-flow, m2m, or direct auth grants.
• Fix a distribution bug across the whole agent-skills/ tree: only that directory ships to installed skill consumers (not the rest of the Atmos monorepo), so any skill citing a pkg/..., cmd/..., docs/..., or local website/... file path was pointing at something an installed skill can never read. Swept and fixed every instance, in both the new auth-migration guides and 7 pre-existing skills (atmos-kubernetes, atmos-helm, atmos-settings, atmos-steps, atmos-git, atmos-introspection, atmos-ai, and atmos-schemas — the bulk of it, 23 hits). Fixes either drop the path and keep the claim as prose, or swap in the real public atmos.tools URL (verified via frontmatter slug fields and existing site cross-links, not guessed from filenames).

why

• The skill previously only covered migrating Terraform/IaC into Atmos, with no guidance for the equally common "I already have credentials configured elsewhere" on-ramp question.
• Every command and field name cited was independently verified against the current schema and, for third-party tools, against upstream READMEs and live aws/gcloud/az/gh output rather than relying on recall -- several early drafts had inaccuracies (a fabricated granted sso populate command, wrong flag names, an incorrect premise about Okta's AWS integration having two separate app types) that were caught and corrected during review.
• Explicit gaps (Azure client-secret service principals/Managed Identity, GCP static key files, credential_process, Okta OIDC device flow) are called out rather than papered over, so an agent following these guides doesn't promise users something Atmos can't do yet.
• The repo-internal path citations were a real, previously-unnoticed bug: docs/prd/atmos-agent-skills.md documents that only agent-skills/ is distributed to installed skill consumers, so any citation outside it was dead on arrival for every user except contributors working inside this monorepo.

references

• docs/prd/okta-auth-identity.md, docs/prd/aws-browser-auth.md, docs/prd/atmos-agent-skills.md

Summary by CodeRabbit

• Documentation

  • Added migration guides for AWS, GCP, Azure, Leapp, Granted, saml2aws, and okta-aws-cli authentication workflows.
  • Clarified authentication migration paths, command equivalents, supported scenarios, and limitations.
  • Updated AI, Git, Helm, Kubernetes, settings, introspection, and workflow guidance with clearer references and safer configuration recommendations.
  • Documented the Floci emulator health-check fix and related troubleshooting details.

• Bug Fixes

  • Improved readiness checks for GCP and Azure emulator services.

• Grant the CI timing coordinator pull-requests: write and update Stopwatch's token description and permission documentation.
• Validation: atmos lint --changed, actionlint, git diff --check, and commit hooks passed; confirm comment creation and subsequent updates after the change reaches main.

why

• The coordinator reaches PR comment creation but receives 403 Resource not accessible by integration with issues: write and pull-requests: read.
• Preserve timing behavior, trusted default-branch checkout, and the network policy; the separate StepSecurity alert still needs its event URL for investigation.

references

• Earliest failed run
• Recent failed run

Summary by CodeRabbit

• New Features

  • CI timing summaries can now create and update pull-request comments with timing information.

• Documentation

  • Added guidance on required pull-request permissions for timing summaries.
  • Documented troubleshooting steps for permission-related failures and how to verify that comments are created or updated successfully.

• Configuration

  • Updated the required token permissions to support writing pull-request comments.

• Serve github.com/cloudposse/atmos.git//examples/... git sources in the acceptance suite from a local git-over-HTTP mirror of this checkout's examples/, built once in TestMain (tests/testhelpers/gitmirror): a bare repo published via git init --bare + push, served by git http-backend behind an httptest server that validates a static token (atmos-test-mirror-token, plus any ambient CI token) with HTTP Basic auth, records every request, and rejects pushes.
• Redirect with repo-scoped insteadOf rules written to a temp gitconfig delivered via GIT_CONFIG_GLOBAL, one rule per token in the exact userinfo form atmos hands git after injecting the token (https://x-access-token:<token>@github.com/cloudposse/atmos.git → http://x-access-token:<token>@127.0.0.1:<port>/cloudposse/atmos.git) plus the anonymous https/ssh forms. Fixtures keep their real github.com URLs; file_exists assertions are unchanged.
• The harness sets the static GITHUB_TOKEN for a case only when neither the case nor the environment provides one, so atmos never falls back to gh auth token (an unknown token would miss the rules and silently go live).
• Add tests/testhelpers/gitconfigenv, an appending GIT_CONFIG_COUNT/KEY_n/VALUE_n builder for the harness's per-test credential.helper/extraheader entries.
• Drop the github_token precondition (a ghcr/OCI probe) from the git-only vendor and demo cases; add an additive atmos_vendor_pull_git case; make demo-vendoring's first case clean its workdir so repeated runs don't see stale output.
• Fold tests/jit_source_local_repo_test.go into gitmirror; tests/testhelpers.DefaultTools now reads pins from .tool-versions (all five had drifted).
• No golden snapshot changes — tests/snapshots/ is byte-identical to main.

why

• The vendor and demo cases cloned github.com on every shard, so a hosted-runner DNS/connect blip mid-clone failed the shard "several times a week" (docs/fixes/2026-09-02-vendor-pull-dns-resolution-flake.md, 2026-09-07-jit-source-network-flakes.md), and GitHub's recent unauthenticated-traffic protections add another source of 401/404-shaped failures.
• Atmos is unaware of the mirror and runs the production code path. It sees the same URLs, runs the same detector, injects the token exactly as against real GitHub, and hands git the same URL; git does the rewrite. Delivering the rules through GIT_CONFIG_GLOBAL (not GIT_CONFIG_* env) matters: pkg/downloader/custom_git_detector.go scans the env form for broker rewrites and would skip token injection — which is precisely the behavior change the golden snapshots would have caught, and now don't need to.
• Serving over HTTP (not file://) exercises git's real smart-HTTP transport and lets the mirror validate the credential; the 401-challenge path is proven end-to-end in gitmirror's own tests. The shared server allows anonymous fetches because cloudposse/atmos is public and the fixture's explicit git::https:// source bypasses atmos's detector (no injection), exactly as in production.
• Rules are repo-scoped on purpose: an owner-wide rule also captured terraform's own module fetch of terraform-null-label (pinned to an upstream commit no mirror can reproduce) and failed the ci_summary plan cases.
• Verified locally with the vendor/demo cases three ways — no ambient token, a dummy ambient token, and HTTPS_PROXY pointed at a closed port (no GitHub reachable): all pass in each.

First PR of a stack; the later PRs add GitHub Enterprise Server support (#3107), live-GitHub canaries with ATMOS_TEST_OFFLINE (#3109), and a local GitHub HTTP façade for toolchain/registry/raw fetches.

references

• docs/fixes/2026-09-07-jit-source-network-flakes.md (the local-repo precedent this generalizes)
• https://github.com/orgs/community/discussions/206581
• Why now: GitHub's new protections against unauthenticated traffic (https://github.com/orgs/community/discussions/206581#discussioncomment-18269356) turn every unauthenticated fetch of a public repo into a flake or a 401; the same pressure shows up downstream in hashicorp/terraform#39130 (hashicorp/terraform#39130), where users ask for SSH module fetching because unauthenticated HTTPS to GitHub is now rate limited. Tests that hit github.com anonymously are no longer viable as a default; live access is a canary concern, not a per-PR one.

Summary by CodeRabbit

• Tests
  • Added coverage for Git-based vendoring with --tags=git, including credential-free and token-authenticated scenarios.
  • Expanded validation for authenticated and anonymous Git access, cloning, blocked write operations, proxy handling, and cross-platform environments.
  • Test tooling now uses repository-pinned versions when available, with safe fallbacks.
  • Added coverage for Git configuration merging and fresh vendor pulls.
• Refactor
  • Consolidated Git URI, mirror, and configuration helpers for consistent test execution.
• Documentation
  • Documented the local Git mirror used by acceptance tests.

• Add per-feature warn-daily caching as an edition-aware default, preserve explicit overrides and error/disable enforcement, and suppress repeated startup notices in child Atmos invocations.
• Use explicit Markdown styles and color profiles, with regression tests, configuration docs, release notes, and a roadmap entry.

why

• Keep workflow and custom-command output readable while still warning when a different experimental feature is first used.

references

• Experimental settings
• Validation: Go build, command/config/edition/hook/startup/Markdown tests, changed-file lint, and website build

Summary by CodeRabbit

• New Features

  • Added warn-daily, showing each experimental warning at most once every 24 hours.
  • Suppressed repeated startup notices in child command invocations.
  • Preserved warn, error, and disable modes.

• Bug Fixes

  • Improved Markdown styling consistency in color-capable and plain-text output.

• Documentation

  • Updated configuration guides, schemas, roadmap content, and release documentation to reflect the new default and warning behavior.

• Give every cmd packer test that runs a real atmos packer command its own private copy of the packer fixture (new packerFixtureWorkDir helper), instead of sharing the tracked fixture directory.
• Lower the Windows subprocess-launch cap in internal/ci/acceptance from 4 to 2.
• Stop running TestExecuteProLock and TestExecuteProUnlock (and their subtests) in parallel.
• Add a fix-log: docs/fixes/2026-09-13-ci-flakes-packer-fixture-windows-cap-pro-race.md.

why

Three flakes kept forcing reruns on 2026-09-12 and 2026-09-13, none caused by the code under test:

• Packer fixture race. Under the race job's -shuffle=on -parallel=4, TestPackerInitCmd and TestPackerInspectCmd write and remove the same generated nonprod-aws-bastion.packer.vars.json in the shared fixture and one of them fails with "Failed to open file". TestPackerValidateCmd already used a private copy for exactly this reason; the other tests now do the same.
• Windows GC/allocator crash. internal/ci/acceptance crashed the Go runtime ("fatal error: found pointer to free object") four more times on Windows shard 3 on 2026-09-12 (runs 34699763477, 34703060789, and 34726124320 twice) despite the cap of 4 added in #3116. Halving the cap halves the concurrent allocation and syscall pressure that triggers the runtime race documented there.
• Pro lock/unlock data race. executeProLock and executeProUnlock write through the process-global UI writer; running both tests in parallel produced a DATA RACE on the race job (run 34726125072, shard 3/4). No per-test UI isolation seam exists in pkg/io/pkg/ui that is safe under t.Parallel(), so the two tests are serialized.

Test-only; no user-visible change.

references

• #3116 (the original Windows subprocess cap and its fix-log)
• Observed while landing the local-GitHub-mirror stack (#3105, #3107, #3109, #3122)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved CI reliability by isolating Packer test fixtures for concurrent test runs.
  • Reduced Windows acceptance-test subprocess concurrency to prevent intermittent crashes.
  • Ensured Pro lock and unlock tests run serially to avoid shared output conflicts.

• Documentation

  • Added documentation describing the causes and verification of recent CI flakiness fixes.

Add conditional component dependencies through dependencies.components[].required.

• required defaults to true.
• required: false makes an edge optional when its target is unavailable.
• Existing dependency ordering is retained when a target is present.

Resolution Flow

flowchart TD
    A[Read component dependency] --> B{Dependency parses and templates resolve?}
    B -- no --> C[Error: identify declaring component and stack]
    B -- yes --> D{Source component is in the selected closure?}
    D -- no --> E[Do not validate this required target]
    D -- yes --> F{required is false?}
    F -- yes --> G{Target present and enabled?}
    G -- yes --> H[Include optional edge]
    G -- no --> I[Skip optional edge and continue]
    F -- no --> J{Target present and enabled?}
    J -- yes --> K[Include required edge]
    J -- no --> L[Error: source component and stack, target component and stack, reason]

missing, disabled, and abstract targets all take the unavailable-target branch. An abstract target is reported as missing so every graph builder has the same typed error contract.

Scope Flow

flowchart TD
    A[Terraform bulk command] --> B{Any stack, component, tag, label, query, or affected filter?}
    B -- yes --> C[Select matching components]
    C --> D[Expand requested dependency and dependent closure]
    D --> E[Validate only closure sources]
    B -- no --> F[Bare --all selects every component in every stack]
    F --> G[Validate every source]

--all --stack dev

--all means every component inside the current filter scope, not every component in the repository.

flowchart TD
    A[atmos terraform plan --all --stack dev] --> B[Select every dev component]
    B --> C{Required target available?}
    C -- yes --> D[Plan selected dev components]
    C -- no --> E[Error with source, target, and reason]
    F[Broken qa component] --> G[Excluded by --stack dev]
    G --> H[Cannot block the dev command]

Bare --all

flowchart TD
    A[atmos terraform plan --all] --> B[Select every component in every stack]
    B --> C{Any selected required target missing, disabled, or abstract?}
    C -- no --> D[Plan all components]
    C -- yes --> E[Error with source, target, and reason]

Test Fixture Changes

The dependencies-components-inheritance fixture intentionally references network-baseline and security-group, but does not define either target. Those fixture entries now declare required: false.

This preserves the fixture purpose: verify that a child dependency list replaces inherited entries, without accidentally asserting that intentionally absent targets are required.

Verification

• Added scoped-graph regressions for required-target validation inside and outside the resolved closure.
• Added a Terraform preflight regression: --all --stack dev ignores a broken required target in qa, while preserving strict validation for dev.
• Added dependents coverage for path-only modern entries falling back to legacy component relationships.
• Updated list integration tests for the explicit optional fixture edges.

Release Artifacts

• Changelog: conditional-component-dependencies
• Roadmap milestone: Extensibility & Custom Components

Closes #3053

Summary by CodeRabbit

• New Features

  • Added optional component dependencies with required: false, including templated values and custom delimiters.
  • Supports modern, cross-type, and cross-stack dependency declarations.
  • Dependency listings identify optional relationships in tree, JSON, and YAML output.
  • Selection-based commands validate dependencies within the selected scope.
  • TFLint skips abstract and disabled components and unrequested dependency targets.

• Bug Fixes

  • Invalid dependency configurations now fail explicitly.
  • Required unavailable targets return clear errors, while optional targets are skipped.
  • Improved scoped and cross-stack dependent discovery.

• Documentation

  • Added guidance and examples for conditional component dependencies.

• chore: add cred preventions within .gitignore

why

• Improve repohealth scores

references

• See #3160

Summary by CodeRabbit

• Chores
  • Added ignore rules for private keys and credential files to help prevent them from being tracked.

• Adds fingerprint-based "smart auto-init": terraform init is skipped when nothing that affects it (root config, lock file, CLI config, resolved binary, relevant env vars) has changed since the last successful init for a component.
• Adds three new components.terraform.init settings — mode, reconfigure, upgrade (each auto/always/never, default auto) — with matching --init-mode/--init-reconfigure/--init-upgrade flags and ATMOS_COMPONENTS_TERRAFORM_INIT_* env vars.
• -reconfigure and -upgrade are now added only when warranted (backend change, or a Terraform/OpenTofu diagnostic requires it) instead of unconditionally on every init.
• Adds one automatic retry when a skipped/under-flagged init turns out to have been wrong: a closed set of Terraform/OpenTofu diagnostics is recognized before any state read/write, init is re-run with the flags the diagnostic calls for, and the original command retries once. No state migration is ever performed implicitly.
• Applies uniformly to explicit CLI commands and the implicit init behind !terraform.output/atmos.Component.
• Documents migration from the legacy init_run_reconfigure boolean: false maps to init.reconfigure: never; the previous default true now maps to init.reconfigure: auto (not always) — the one deliberate default-behavior change, callable out explicitly in the docs and blog post.

why

• Issue #620 asked for Terragrunt-style Auto-Init: today, every atmos terraform subcommand — plan, apply, shell, destroy, and even the read path behind !terraform.output/atmos.Component — runs a full terraform init -reconfigure unconditionally, so atmos terraform apply followed immediately by atmos terraform output on the same component pays the full init cost twice for identical inputs.
• Issue #1263 asked for automatic -upgrade handling instead of requiring users to pass it by hand after every provider version bump.
• --skip-init already exists but is all-or-nothing and per-invocation, with no middle ground between "always re-init" and "the user manually judges when it's safe to skip." A fingerprint-based skip rule with automatic recovery closes that gap safely.

references

• Closes #620
• Closes #1263
• PRD: docs/prd/terraform-auto-init.md
• Blog post: website/blog/2026-09-11-smart-terraform-init.mdx
• Docs: /cli/commands/terraform/init#automatic-initialization, /cli/configuration/components/terraform#configuration-reference

Summary by CodeRabbit

• New Features

  • Terraform/OpenTofu initialization now runs automatically only when needed.
  • Added auto, always, and never controls for initialization, reconfiguration, and upgrades through configuration, flags, and environment variables.
  • Initialization failures can trigger one corrective init and retry.
  • Added initialization overrides to Terraform output and shell commands.
  • --skip-init remains available for one-time opt-out; workspace selection and creation still perform required initialization.

• Documentation

  • Updated Terraform command, configuration, environment-variable, and usage documentation, including legacy-setting guidance and upgrade-default details.

Harden the existing Atmos Helm plugin installer against transient download failures and incomplete installs. CI declares Helm Diff in stack configuration and reuses the existing Atmos toolchain cache.

• Delegate every plugin installation to Helm, preserving plugin hooks and their final-directory paths. Retry transient failures at most three times with 15-/30-second backoffs and clean partial installations between attempts.
• Serialize installs sharing a managed directory. Record successful hooks and metadata validation in a source/version receipt; repair older incomplete installs. Restore the previous plugin after failed replacement, retaining its backup if rollback fails.
• Warm stack-declared plugins in the existing platform build jobs and verify the restored cache in consumers using direct atmos helm plugin install --component ci-plugins --stack dev commands. Hash the stack pins into the cache key; preserve shard counts and parallelism.
• Fix the source invocation-guard regression using workdir.BuildPath, a loopback source, and assertions for zero downloads, preserved fixture contents, and the expected guard.
• Update the Helm and Helmfile skills to document declarative plugins, automatic provisioning, cache reuse, and the distinction between native Helm's embedded diff library and Helmfile's CLI plugin.

why

The source-cache regression seeded an obsolete path and unexpectedly cloned GitHub, failing on DNS in #3001. A repeated Helm Diff release download returned HTTP 500 before tests in #3000. These failures belong in Atmos's existing provisioning and plugin paths.

The installer remains generic: Helm controls repository installation and hooks. Validation checks plugin metadata and completed-install receipts; it does not run plugin-specific binary version commands. No custom setup action, shell wrapper, or separate artifact transport is needed.

Public commands and application APIs are unchanged. This PR targets main; existing CloudFormation branches and PRs remain unchanged.

validation

• Source invocation-guard regression passed with -race -count=10 -shuffle=on; full source/workdir tests also passed with race detection.
• Plugin and Helm CLI tests passed with -race -shuffle=on, covering transient recovery, exhaustion, cleanup, cancellation, metadata/receipt validation, custom plugin names, concurrency, rollback, and preserved file modes.
• Local changed executable-line coverage: 89.08% (204/229). Codecov remains authoritative for CI patch coverage.
• Generic installer lint and actionlint passed. Both modified skills passed the skill validator.
• Real stack-declared installation passed on macOS ARM with Helm v3.21.4. A second invocation with an unreachable HTTP/HTTPS proxy reused the completed installation successfully.
• Final-commit Linux/macOS/Windows CI and CodeRabbit review are pending.

references

• Failure context: #3000
• Implementation and regression details

Summary by CodeRabbit

• New Features

  • Configure Helm and Helmfile CLI plugins declaratively, with inheritance and configurable merge strategies.
  • Atmos now installs declared plugins automatically before Helm or Helmfile operations.
  • Plugin installations use Helm’s standard hooks and support pinned versions, receipts, retries, locking, and rollback recovery.
  • Helmfile plugin configuration and usage guidance is now available in the documentation.

• Bug Fixes

  • Improved handling of failed, incomplete, stale, and concurrent plugin installations.
  • Preserved existing working plugins when replacement installations fail.
  • Command cancellation is now respected during plugin operations.

• CI

  • CI installs declared plugins through Atmos and shares them through an updated cache.

• Fix flociHealthCheck (pkg/emulator/driver/floci.go) to use the floci image's own /usr/local/bin/healthcheck.sh readiness script when present, falling back to the previous curl-based probe only for older images that don't ship the script. A failing native probe is never masked by a curl fallback.
• Add TestFlociHealthCheck_Readiness (pkg/emulator/driver/floci_health_test.go) covering native-only success, native failure not falling back to curl, legacy curl-only success, and legacy curl-only failure.
• Add a fix record at docs/fixes/2026-09-15-floci-health-check-curl-missing.md.

why

• The minimal GCP and Azure floci images dropped curl. Since the health check probed exclusively with curl, it failed to execute at all against those images (the emulator was reachable; the check itself couldn't run), breaking atmos emulator up against those images and the floci E2E jobs in CI.
• Because every open PR whose CI spins up the GCP/Azure floci emulator hits this, the fix is landed on its own so it can merge to main quickly and unblock CI everywhere, rather than waiting on a larger, unrelated PR that happens to bundle the same fix.

references

• Failing job that surfaced this: https://github.com/cloudposse/atmos/actions/runs/34981357896/job/104426326374
• docs/fixes/2026-08-31-floci-azure-health-check-race.md — prior, unrelated floci health-check incident (TCP-accepted-before-HTTP-ready race), already fixed.

Summary by CodeRabbit

• Bug Fixes

  • Floci health checks now use the image’s native readiness probe when available.
  • Native probe failures are reported directly without falling back.
  • Images without a native probe now use a TCP connectivity check instead of curl, supporting both HTTP and TLS endpoints.
  • Health checks no longer treat arbitrary HTTP responses, such as 404 errors, as healthy.

• Documentation

  • Added documentation covering the updated health-check behavior and validation results.

• Apply the active theme and terminal color profile to progress bars, with dedicated gradient colors restoring Atmos’s original purple → pink, standardize Dot spinners, refresh semantic and Markdown styles, and draw Braille cells without font fallback.
• Fit playback to the recorded terminal width so progress bars and counts remain visible in narrow players; paint full cells without SVG edge seams.
• Add regression coverage and progress-color validation, regenerate 15 casts, repair KICS/Kubernetes recording setup, isolate the vendoring test from GitHub downloads and shared fixture writes, and repair Floci readiness checks for images that no longer include curl.

why

• Fix color loss, inconsistent spinners, and missing-glyph boxes while preserving caller styling and playback timing.

references

• Validation: affected Go tests and lint, 29 player tests, production website build, and browser checks; interactive-menu and Helmfile casts remain unchanged because of existing CLI and local Kubernetes failures.
• Companion Apps playback and artifact fixes: https://github.com/cloudposse-corp/apps/pull/1735

Summary by CodeRabbit

• New Features

  • Terminal interfaces now consistently follow the active theme, including tables, status indicators, Terraform output, authentication screens, and AI chat views.
  • Progress bars support theme-specific gradient colors, with customizable start and end colors.
  • Shared spinner and progress displays provide more consistent themed output.
  • Cast Player now renders Braille graphics and automatically fits recordings to the available terminal width.

• Bug Fixes

  • Improved terminal cast rendering for solid progress blocks and cleanup before final prompts.
  • Improved emulator readiness checks across HTTP and TLS listeners.

• atmos describe affected now honors the ATMOS_PROCESS_TEMPLATES and ATMOS_PROCESS_FUNCTIONS
  environment variables, matching the --process-templates / --process-functions CLI flags.
• Precedence is CLI flag > environment variable > default, consistent with the rest of Atmos.
• Adds unit tests for the resolver (default no-op, each env var, CLI-wins-over-env, direct Viper
  key, and the unregistered-flag no-op) plus an end-to-end test proving the env var reaches
  DescribeAffectedCmdArgs.ProcessYamlFunctions.
• Adds a fix doc under docs/fixes/.

why

• The two flags already worked, and these same env vars are honored by the list, terraform,
  and terraform generate command families — but describe affected silently ignored them, so
  the only way to toggle template/function processing there was to pass the CLI flags explicitly.
• Root cause: the flags were registered as raw Cobra PersistentFlags and read back only when
  cmd.Flags().Changed(name) is true. Setting an environment variable never flips a Cobra flag's
  Changed bit, so env-sourced values were dropped before reaching the affected computation.
• This is the natural knob for CI: ATMOS_PROCESS_FUNCTIONS=false skips the credential-backed
  YAML functions (!store, !terraform.state, !terraform.output) during affected detection —
  which is a Git-config diff that does not need their resolved values — letting the affected job
  run without credentials. Not being able to set it via the environment was the gap.
• The fix mirrors the existing --error-mode pattern (cmd/describe_error_mode_flag.go): a
  minimal flags.StandardParser with WithEnvVars registers the flags and binds the env vars
  (namespaced under the describe Viper prefix to avoid colliding with the list family's bare
  keys), and a resolve step writes the env-sourced value back onto the Cobra flag so the existing
  legacy reader picks it up. All binding goes through pkg/flags — no direct
  viper.BindEnv / viper.BindPFlag (Forbidigo-compliant).

references

• Fix doc: docs/fixes/2026-09-13-describe-affected-process-env-vars.md
• Follows the established single-flag StandardParser pattern in cmd/describe_error_mode_flag.go
  (which added ATMOS_DESCRIBE_ERROR_MODE the same way).

Summary by CodeRabbit

• Bug Fixes

  • atmos describe affected now honors the ATMOS_PROCESS_TEMPLATES and ATMOS_PROCESS_FUNCTIONS environment variables.
  • Command-line options take precedence over environment variable values.
  • Invalid environment variable values are rejected with clear validation errors.

• Tests

  • Added coverage for defaults, environment variables, CLI precedence, validation, and end-to-end flag handling.

• Documentation

  • Documented environment variable support and precedence rules for describe affected.

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.