cloudposse/atmos v1.229.1-rc.3

on GitHub

• Automatically report CLI exceptions to Atmos Pro from eligible GitHub Actions runs when Pro is enabled, with explicit opt-out, fresh OIDC authentication, masking, bounded delivery and shutdown, separate Sentry destinations, unprefixed metadata tags, and shared execution IDs.
• Extend the existing Atmos consumer Pact with success/401 envelope contracts and CI verification; add configuration schemas, regression tests, usage documentation, release notes, roadmap, and edition migration notes.

why

• Connect failures to their stack, component, team, and execution without manual reporter setup while preserving command exit codes; existing Pro-enabled stacks gain automatic reporting and can retain prior behavior through the opt-out.

references

• Validated all 23 Pact interactions, race and CLI/configuration tests, lint, workflow syntax, binary and website builds; Pro provider verification and persisted-tag assertions remain tracked in #3219.

Summary by CodeRabbit

• New Features
  • Added automatic CLI exception reporting to Atmos Pro for eligible GitHub Actions runs when Pro is enabled. Reports include execution and component context, with sensitive values masked.
  • Added settings.pro.errors.enabled and the ATMOS_PRO_ERRORS_ENABLED environment variable to control reporting independently. Reporting can be disabled without changing command exit codes or existing Sentry destinations.
• Documentation
  • Added setup, eligibility, configuration, GitHub OIDC requirements, and opt-out guidance for Atmos Pro exception reporting.

• Preserve .tool-versions during automatic installs, enforce existing artifact checksums, record missing lock entries, and add opt-in frozen lockfile configuration for CI.
• Resolve configured toolchain paths against the project base and honor ATMOS_TOOLCHAIN_FILE_PATH and ATMOS_TOOLCHAIN_INSTALL_PATH during explicit installs, automatic dependencies, and Atmos self-bootstrap.
• Use the active project configuration for bootstrap and default to XDG storage outside projects, while honoring explicit installation paths. Include regression tests, configuration docs, migration notes, a changelog, and a roadmap update.

why

• Prevent incidental dependency edits and working-directory files while keeping installation metadata reproducible.

references

• Closes #3213
• Validation: Go build, affected package tests, focused race tests, lint, and website production build

Summary by CodeRabbit

• New Features
  • Added frozen lockfile mode, which requires complete URL and checksum entries for the requested tool and platform, including cached tools, and prevents lockfile updates.
  • Added environment settings for toolchain install paths and frozen lockfile mode.
• Improvements
  • Relative toolchain paths now resolve from the project directory, even when commands run elsewhere.
  • Automatic installs preserve declared tool versions and existing matching lockfile entries, recording missing entries after successful installation.
  • Atmos version bootstrapping uses active project settings, or an XDG cache location when run outside a project.
• Documentation
  • Updated toolchain configuration and installation guidance for path resolution and frozen installs.

• Restore the interactive picker for bare atmos when stacks exist, retain help for stackless projects, and preserve CLI/environment configuration overrides.
• Make list/describe evaluation demand-driven through a shared pkg/deferred contract with subsystem-owned auth, store, secret, and stack adapters; one AuthManager owns deferred/disabled state and cached authentication instead of parallel resolver fields and caller flags.
• Keep provider error classification in providers, preserve explicit-identity failures, isolate caches and concurrent store/secret reads by authentication scope, and add deterministic regressions and documentation.

why

• Unused values must never authenticate; requested unavailable values should render (computed) according to warn/silent policy while strict mode remains fatal.

references

• Closes #3221

• Closes #1950

• Related to #2504

• Demand-driven authentication regression record

• Subsystem ownership

• Manager-owned state and validation

• Authentication isolation and review verification

Summary by CodeRabbit

• New Features

  • Running atmos without a subcommand opens the interactive picker when stack configuration is available and both input and output are interactive; otherwise, help is shown.
  • List and describe commands evaluate requested values on demand. Unused fields and columns no longer trigger authentication or evaluate unrelated values.
  • Unavailable implicit credentials can be handled according to the command’s error mode: show computed values with a warning, omit the warning, or fail.

• Bug Fixes

  • Explicit identity selection, including through ATMOS_IDENTITY, is validated before processing; authentication failures are no longer silently skipped.
  • AWS access-denied responses remain authorization errors rather than being reported as unavailable credentials.
  • Authentication and authorization errors during deferred store lookups are no longer replaced by configured defaults.
  • Cached Terraform outputs are isolated by authentication context to prevent values from being reused across identities.

what

• atmos describe affected now evaluates the full eight-type canonical set of component types in both its added/modified and deleted paths — matching describe component / describe dependents.
  • Deleted path (was #3199): detect deleted native helm and kubernetes components (previously only terraform/helmfile/packer).
  • Both paths (was #3203): add ansible, container, and emulator.

why

• describe affected was the outlier: its added/modified path (processStackAffected) and deleted path (detectDeletedComponents) each enumerated a partial, hardcoded type list, so changed/deleted components of the missing types were silently unreported — breaking CI/CD pipelines built on it.
• #3199: an added native Helm component was detected but a deleted one wasn't (added path had helm/kubernetes; deleted path didn't).
• #3203: ansible/container/emulator were absent from both paths.

changes

• Shared deletableComponentTypes = the full 8 types, so the deleted path stays in sync with the added/modified path.
• Replaced the byte-identical processHelmfileComponentsIndexed/processPackerComponentsIndexed with a generic processSimpleComponentsIndexed(componentType, ...); routes helmfile/packer/ansible/container/emulator through it via simpleAffectedComponentTypes. terraform/kubernetes/helm keep dedicated processors (Spacelift/Atlantis, k8s manifests, helm values files).
• emulator has no filesystem source tree (getComponentBasePath returns ""): empty path pattern, folder-change detection skipped; ansible/container base paths added to the pattern cache, relevant-files switch, and base-path index; BuildComponentPath resolves ansible/container.
• Index each changed file under every containing base path (nested-base-path case).
• File/folder dependency checks run even without a settings section; settings-equality guarded on presence (!= nil), so an emptied settings: {} is still reported.

tests

• Deleted: all 8 types detected; native helm (component + entire-stack); ComponentPath populated for ansible/container, empty for emulator; abstract/malformed skipped.
• Added/modified: vars+env changes for ansible/container/emulator (assert both stack.vars and stack.env); settings-section + emptied-settings cases; file dependency without settings; pattern cache resolves ansible/container and returns empty for emulator.

scope note

ansible/container/emulator component-instance first-class fields (e.g. container image/build/run, emulator driver) are not compared — no such schema exists yet (those kinds are upcoming; driver lives on container workflow steps). The section-check mechanism already covers the standard sections these components use.

references

• Closes #3199
• Closes #3203
• Supersedes #3202
• Custom (non-built-in) component types remain out of scope — follow-up #3208.

validation

• go build ./...
• go test ./internal/exec/ -run 'Affected|DetectDeleted|IsAbstract|ProcessComponents|ComponentPathPattern'
• atmos lint --changed (0 issues)

Summary by CodeRabbit

• New Features
  • describe affected detects added, modified, and deleted Ansible, container, and emulator components, alongside existing component types, including native Helm and Kubernetes deletions.
  • Ansible and container source-file changes are matched to their components. Emulator components are evaluated without requiring a source directory.
  • Changes within nested component paths can be reported for each matching component.
  • File and folder dependencies are checked even when a component has no settings section.
  • Added, modified, emptied, and removed settings sections are detected as changes.

• Wrap Terraform --ui attribute values within the terminal width, preserve tree rails and aligned attribute headers, align scalar continuations after →, and place multiline documents beneath their attribute headers at every terminal width.
• Detect and pretty-print JSON/YAML strings with existing syntax-highlighting settings while retaining update diffs, sensitive/unknown placeholders, replacement annotations, and configured collapsing.

why

• Long KMS policy strings overflowed during a demo, causing terminal wrapping to lose indentation and interrupt the left rail; explicit Unicode/ANSI-aware wrapping preserves the complete content.

references

• Validation: KMS regression coverage at 60/80/120/180 columns, Terraform UI and tree tests (94.4% UI coverage), streaming-executor tests, custom lint (zero issues), and the website production build.

Summary by CodeRabbit

• Improvements
  • Terraform dependency-tree output formats attribute changes with aligned values and readable diffs for structured or multiline content.
  • Long values wrap without losing content, and column alignment accounts for Unicode characters.
  • Sensitive and not-yet-known values are clearly labeled.
  • Structured JSON and YAML values can be syntax-highlighted when enabled.
  • Terraform dependency-tree output respects the active terminal width and formatting settings.