github cloudposse/atmos v1.232.0
on GitHub

3 hours ago

📦 Other Changes

docs(validation): add OPA-focused example and repoint validation docs @aknysh (#3360)
  • New Features
    • Added an OPA validation demo with VPC policies for VPC names, development Availability Zones, and production public IP settings. Invalid configurations display policy errors and block Terraform apply.
  • Documentation
    • Updated validation guides to use the OPA demo and clarified the JSON Schema example with an S3 bucket component.
fix(ci): stop Quality Gate concurrency queue overflow @osterman (#3367)
  • Workflow Updates
    • Benchmark reports are grouped by pull request, with a fallback for runs not associated with one.
    • Quality reports run after workflows complete, and scheduled reconciliation runs every 15 minutes instead of every five.
    • Report runs use more specific concurrency groups to reduce interference between unrelated reports.
  • Bug Fixes
    • Quality reports re-check comments before publishing and retry when another update occurs, helping preserve concurrent report content.
fix(ci): use ARM benchmarks and improve quality reports @osterman (#3363)
  • Improvements
    • Benchmark reports now explain why comparisons are unavailable, retain candidate measurements without a matching baseline, and separate affected benchmarks from other results.
    • CPU identification supports ARM systems, improving benchmark compatibility reporting across processor types.
    • Benchmark jobs run on ARM-based Linux runners, and benchmark reports can queue instead of cancelling pending runs.
    • Quality reports can queue instead of cancelling pending runs, and better account for missed runs.
    • Quality review guidance links to manual review instructions.
feat(ci): add benchmark history and extensible quality gates @osterman (#3356)
  • New Features
    • Added automated pull request benchmarks with comparisons against compatible main-branch snapshots, including reports of significant changes or unavailable results.
    • Added pull request quality reports covering current CI, coverage, review approval, commit signatures, resolved review threads, changed-file limits, and benchmark-report status.
    • Added local performance comparisons that rebuild historical revisions and generate reports.
  • Improvements
    • Quality reports assess readiness against the current pull request revision.
    • Performance warnings remain advisory, with guidance for investigating results.
    • Go tool installation now times out after three minutes.
  • Documentation
    • Added guidance for quality checks and performance investigation.
fix(ci): tap homebrew/core before bumping the Homebrew formula @aknysh (#3336)
  • Bug Fixes
    • Updated Homebrew release publishing to tap homebrew/core before bumping the formula.
  • Documentation
    • Added guidance on the Homebrew tap requirement and dry-run results.
fix(ci): dedupe govulncheck SARIF stacks via ci:vulncheck mage target @osterman (#3347)
  • Bug Fixes
    • Vulnerability scan reports now remove duplicate stack entries before submission, preventing duplicate-entry errors. Reports are preserved if scanning or report processing fails.
  • Chores
    • Updated the vulnerability scan workflow and artifact handling to improve CI reliability.
  • Documentation
    • Added guidance on vulnerability scan report handling and validation.

✨ Features

Use .tool-versions as the tool baseline for every command and component @osterman (#3346)
  • New Features
    • Added project-wide .tool-versions support across components, workflows, custom commands, hooks, and commands. Explicit tool dependencies take precedence over matching manifest entries.
    • Added toolchain.install policies: never, declared, auto (default), and always. Projects pinned to editions before 2026-10-09 retain the declared default; ATMOS_TOOLCHAIN_INSTALL can override the setting.
  • Bug Fixes
    • Improved errors for missing tools, conflicting version entries, invalid policies, and unavailable tool registry data.
    • Improved handling of configured tool-version file paths and environment overrides, including PATH behavior when switching projects.
  • Documentation
    • Updated toolchain configuration and usage guidance, including installation policies and version selection.
Honor color opt-outs and add independent log color control @osterman (#3345)
  • New Features
    • Added independent log-color controls through logs.color, --logs-color, and ATMOS_LOGS_COLOR. Log color is enabled by default when available, and CLICOLOR=0 disables automatic color unless color is forced.
    • Boolean flags accept separate true or false values, such as --logs-color false.
  • Bug Fixes
    • Invalid logs.color values now produce a clear error instead of being silently interpreted as false.
    • --no-color and nonempty NO_COLOR disable color across logs and terminal output, even when color is forced. Nonempty NO_COLOR takes precedence over conflicting flag values.

🐛 Bug Fixes

fix(auth): honor AWS ambient identity environment overrides @osterman (#3362)
  • New Features
    • AWS ambient identities can define environment-variable overrides that are included in authentication environments and subprocesses, including Terraform commands.
    • Identity-level values take precedence over global settings, inherited shell variables, and principal-region settings. Empty values are preserved, and the last repeated key takes effect.
    • Atmos continues to resolve its own AWS credentials through the AWS SDK’s default credential chain.
  • Documentation
    • Updated AWS authentication guidance with override behavior and a LocalStack example.
fix(config): preserve imported auth identities when main config defines identities @osterman (#3339)
  • Bug Fixes
    • Imported authentication identities are now preserved when configuration is loaded, including identities from temporary import files.
    • Identity fields merge correctly across configuration sources, preserving names and existing values when later sources provide partial overrides.
    • If identity reconstruction fails, an already decoded identity remains available when possible.
fix(auth): refresh AWS user chain sessions and stabilize CI @osterman (#3351)
  • Bug Fixes
    • AWS user credentials are validated before reuse in authentication chains. If cached credentials lack required session details or become invalid, authentication restarts from the chain root.
    • Standalone identities can authenticate as roots in longer identity chains.
  • Tests
    • Expanded coverage for authentication-chain credential handling and latest-version Terraform installation.
    • Updated acceptance tests to use local mocks for GitHub-dependent data and downloads.
  • Chores
    • Updated CI network policies to allow required Go downloads and skip SARIF uploads when no report is available.
fix(auth): paginate and cache SSO account name lookups @osterman (#3344)
  • Bug Fixes
    • AWS SSO account-name lookups now search through all available account results, so accounts beyond the first page can be found.
    • Successful account-name lookups are cached for up to one hour, reducing repeated lookups. Cache issues won’t prevent account resolution, and unsuccessful lookups aren’t cached. Changes to an account name may take up to an hour to appear.
fix(store): cache deferred atmos.Store template lookups @osterman (#3354)
  • Performance
    • Deferred-auth store lookups reuse successful results within an invocation, reducing repeated backend reads.
    • Concurrent requests for the same store value share a single backend read.
  • Reliability
    • Failed lookups and nil results are not cached, allowing later requests to retry.
    • Cache entries are scoped to the relevant store configuration and credentials.

🤖 Automatic Updates

build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 @dependabot[bot] (#3146)
Check out latest releases or
releases around cloudposse/atmos v1.232.0

Don't miss a new atmos release

NewReleases is sending notifications on new releases.

Get notifications