cloudposse/atmos v1.233.0

on GitHub

• Improved pull request quality-check accuracy by including merge results only when the merge commit contains the pull request’s head commit. Temporary merge-queue results no longer incorrectly affect the pull request’s CI status.
• Merge-commit lookup failures are now surfaced instead of silently changing the reported check state.

• Catalog category selections are reflected in the URL, so filtered views can be revisited through browser history or shared as links. Selecting “All” clears the category fragment.

• Catalog navigation restores the scroll position associated with each history entry, including when clearing a category filter. Restoration also handles pages where the saved position exceeds the current viewport.

• Added guidance for discovering, repairing, publishing, reviewing, and merging pull request stacks and dependent chains.
• Clarified when to use stack-aware maintenance, how to verify stack membership and order, and when conversion to a native stack requires authorization.
• Documented validation of live branches, approvals, CI, review coordination, publication safeguards, and recovery from partial updates.
• Clarified review-size limits, authorization requirements for history rewrites, and the prohibition on force-pushing during maintenance, including stack push and sync operations.

• Added a proposal outlining a future workflow for explicitly tearing down deleted components, including preparation, review, execution, and failure recovery.
• The proposal does not change existing command behavior.

• Updated CloudFormation examples across guides, reference pages, and blog posts to show the aws/cloudformation YAML key without quotes. Both quoted and unquoted forms remain valid, with the unquoted form preferred.
• Revised blog titles and descriptions to better reflect their topics, including automation steps, reliable command inputs, monorepo change detection, and CI reporting.

• Improved DNS setup and diagnostics for macOS-based container test runs, including checks that DNS is ready before image pulls and clearer failure details.
• Pull-request benchmarks now use the merge commit’s first parent as their comparison baseline.

• Clarified the difference between toolchain artifact lockfiles and locks used for concurrent access to .tool-versions.
• Added guidance on committing artifact lockfiles for reproducible installations and ignoring sidecar lockfiles created by older releases.

• Updated the secrets demo to show secret initialization, setting, and retrieval, including masked output and confirmation that declared secrets are received.
• Added pauses and typing delays to make the secret-entry steps and command confirmations easier to follow.

• Clarified how to identify deleted Terraform components and handle teardown, including comparison commits, dependency order, and reviewing plans. Added guidance for terraform destroy --affected and filtering with --query.
• Updated CI examples with native base detection and documented limitations of matrix output.
• Added guidance on backend and workspace changes, preserving state identity when renaming a stack, and troubleshooting configuration, templates, stacks, and errors.
• Expanded state-sharing recommendations for outputs, configuration, stores, and workflows, including when component output lookups can trigger Terraform/OpenTofu operations.
• Clarified safe handling of passwords and API keys with encrypted stores and !secret.

• Landing-page demos now use interactive terminal recordings, with examples covering infrastructure planning and deployment, native Kubernetes workflows, emulators, secrets, and more.
• Added a searchable FAQ with expandable answers, result counts, and direct links to questions.
• Added a CloudFormation link to the landing page’s supported-tools list.

• Expanded guidance for adopting Atmos with existing Terraform projects, managing component sources, and using remote execution.
• Clarified when saved plans are supported and when planfiles can be skipped.

• Updated custom component examples and guidance to use the example component type.
• Clarified when to use Go templates versus Starlark scripting, with examples of validation and reusable logic.

• Updated demo and configuration examples to inspect and deploy the example component.
• Changed the documented deployment command to atmos example deploy-app --stack dev.

• Reports cover eligible open pull requests targeting any branch, including stacked and fork pull requests.
• Scheduled and manual checks consider open pull requests across target branches and identify reports needing refresh after base-branch changes, missing revision details, or unavailable evidence.
• Reports record the evaluated target branch and revision. When evidence is unavailable, an existing report and its labels are retained only if they match the current pull request head and base.
• Results are not published if the pull request revision changes during evaluation.
• Merge-conflict checks evaluate conflicts against the pull request’s target branch.

what

why

• Refreshed CLI help recordings with updated command listings and guidance, including gcp, sbom, and store.
• Clarified emulator listing options and toolchain update behavior.
• Documented cache values written to GitHub Actions environment files and the auth login --webflow option.
• Updated upgrade guidance for features moving to stable status: upgrade Atmos without configuration changes, and expect no experimental warnings for graduated features. Updated the optional configuration example to silence warnings for features that remain experimental.

• Automated merge rules no longer update eligible dependency-update pull requests targeting the primary branches.
• Renovate no longer rebases pull requests solely because they are behind the base branch.

• Added support for downloading files and directories from S3, including versioned objects and scoped AWS credentials.
• Backend listings now show errors for individual targets while still displaying healthy targets.
• Source provisioning tracks managed directories and applies configured refresh intervals; dry-run pull and delete commands report their targets without performing those actions.
• CloudFormation operation commands now accept an identity option.
• CloudFormation template outputs use the identity configured for their producer when available.

• CloudFormation operations and output lookups now use the appropriate target identity.
• Invalid CloudFormation configuration receives clearer validation guidance.
• Source deletion protects directories without provisioning records or owned by components without a source.
• Archive downloads warn when links are present.
• CloudFormation apply summaries retain change-set details when an operation fails.
• Secret selectors and component detection handle additional configuration cases.

• Added guidance for managing dependent pull request stacks and a product specification for an AWS CloudFormation component.
• Clarified stack freshness, preview cleanup, and AWS sign-in reference information.

• Improved recovery and readiness checks for services used in automated builds, and strengthened handling of GitHub API rate limits and access restrictions.
• Updated Windows build and acceptance checks to improve reliability.

• Improved isolation and reliability across CLI, scheduler, authentication, process, and toolchain tests.

• Added draft guidance for native AWS CloudFormation components and CLI workflows, including rendering, previewing, deploying, validating, viewing outputs, and deleting stacks. These CLI commands are not available in this release.
• Clarified delivery-target behavior, stack policy paths, and CloudFormation example setup.

• Added a local-emulator CloudFormation example and command help recordings, with expanded validation coverage.

• Draft documentation is excluded from release and unreleased-document listings.

• Added native AWS CloudFormation components with commands to render, plan, diff, apply, deploy, delete, validate templates, and view stack outputs.
• Configure templates, stack settings, authentication, and provisioning targets; deploy directly or package templates for delivery.
• Export stack outputs as JSON, YAML, environment variables, CSV, and other supported formats, with options to flatten nested values or uppercase keys.

• CloudFormation components support affected-component detection, configuration inheritance, and component selection.
• Single-file sources can be vendored directly into component directories.

• Published documentation for experimental native AWS CloudFormation stack deployment through the CLI and as a component type, including configuration options and examples.
• Added CloudFormation to the supported component types and component navigation.
• Clarified that AWS changeset APIs don’t support stack timeouts: Atmos stops watching after 60 minutes but does not cancel the AWS operation.
• Updated AWS command and component guidance to link to the CloudFormation documentation and command reference.

• Improved cleanup retries when deleting a CloudFormation change set is temporarily rejected.

• Added CloudFormation commands for creating, executing, listing, and deleting change sets; detecting and reporting drift; listing deployed stacks; retrieving templates and policies; and formatting templates.
• Added !aws.cloudformation.output to reference deployed stack outputs in configuration.
• Added CloudFormation source management commands and dry-run support for source pulls and deletions.

• Stack listings identify configured stacks, and template formatting preserves comments and CloudFormation tags.
• Retrieved templates are rendered as readable YAML; output lookups respect authentication context and keep cached results separate across credentials.

• Added CloudFormation StackSet commands to create, update, delete, and list instances across accounts and regions, with configurable targets and permissions.
• Added nested-stack tree views, combined event logs with resource timelines, and live operation monitoring.

• Expanded CloudFormation command references with usage examples, configuration guidance, and CLI help recordings, including changeset, drift, source, formatting, and template and policy commands.
• Documented retrieving deployed CloudFormation Outputs in templates and component functions.

• Added CloudFormation backend command references and a Rain-to-Atmos migration guide, with notes on feature availability.
• Clarified comma-separated label-filter syntax and when Kubernetes commands require --stack.
• Updated CloudFormation guidance on lifecycle hooks, termination protection, templates, provisioning, and example prerequisites; added reports on related fixes and their status.

• Added a recorded CloudFormation lifecycle walkthrough, example configuration, lifecycle hooks, and validation.

• Added recordings of CloudFormation backend command help.

• Added CloudFormation backend commands to create, update, delete, describe, and list S3 artifact buckets.
• CloudFormation templates can now be provided inline or by file path. Packaging can automatically provision an enabled backend bucket.
• Added live CloudFormation log following and repeatable --labels filters across commands.
• Added stack selection prompts when applicable.

• Re-applying CloudFormation components no longer disables termination protection; deletion remains explicitly controllable.
• Improved stack deletion handling and backend bucket cleanup warnings.

• Added an experimental CloudFormation component supporting inline and file-based templates, stack operations, changesets, drift detection, StackSets, and backend management.
• Added migration guidance for Rain-managed and raw CloudFormation projects, along with an inline-template example.

• Applying a stack no longer changes termination protection when the setting is omitted or false. Deleting a protected stack requires explicitly disabling protection.
• Improved example browsing so secondary-tag examples appear in relevant sections when needed; search results remain grouped by their primary tag.

• Published CloudFormation command and component documentation, a launch announcement, and updated migration resources and examples.

• Provision targets can define scoped authentication, and CloudFormation stack policies can be supplied inline.
• CloudFormation components support inline templates and locals.
• Secret declarations support deferred backend selectors. Secret listings can show successfully evaluated entries alongside failures, with reasons for unresolved or errored entries.
• Secret file-dependency information accounts for unresolved selectors.

• Secret enumeration retains healthy entries when other declarations fail, while still reporting failures that affect SOPS safety.
• Secret commands provide clearer errors when interactive confirmation is unavailable and indicate when --force is needed.
• YAML handling better preserves digit-like strings and top-level string values.
• Authentication selection reports conflicting defaults and clearer guidance when interactive selection is unavailable.
• Store authentication respects explicit identity choices and warns when a pinned identity cannot be used.

• Website pages now display branded, page-specific preview images when shared on social platforms, with titles and descriptions reflected in the card where available.
• A branded default preview image is available for pages without a page-specific card.

• Edition pins can select older or newer behavior based on the pin date; unpinned projects use the newer path.
• Edition comparisons, pin descriptions, and date-range results include behavior transitions alongside configuration changes.
• Terraform plan diffs and deployment verification support exact resource-type and top-level attribute exclusions, configurable across editions.
• Current editions display computed-attribute changes that older editions hid; unknown values are rendered as “known after apply.”

• Invalid edition pins, malformed exclusion entries, and unrecognized behavior keys return errors. Unmatched exclusions generate warnings.

• Updated edition and plan-diff guidance, including transition dates and exclusion behavior.

• Quality reports now correctly associate fork-based pull requests with their head commits, including when standard commit lookup does not find them.
• Scheduled reporting prioritizes open pull requests without a report for their current commit, as well as those with recent commits.
• A failure to inspect one pull request no longer prevents others from being processed. Existing reports, comments, and labels are preserved when review evidence is unavailable.
• Reports now identify unavailable review evidence, and partial processing failures no longer fail the entire run.

• Clarified scheduled report selection and recovery behavior.

• Updated the Homebrew release workflow to handle tapping homebrew/core with Homebrew 7.x, preventing the release step from failing.

• Added a note describing the release-workflow issue and a possible alternative if similar failures recur.

• Added guidance for script-based CI summaries, comments, statuses, environment exports, and fork pull request safeguards, including when reporting is held and how the safety gate can be bypassed.
• Expanded automation references for script inputs, flags, output modes, templates, retries, timeouts, cancellation, Git hooks, and computed YAML values.
• Clarified CI permissions and comment targets, as well as command-specific configuration and behavior.

• Reorganized the scripting guides around Starlark, with expanded guidance for workflows, custom commands, lifecycle hooks, testing, and standalone CLI apps.
• Clarified custom-command argument behavior, including required and optional arguments, default values, and handling of commas, empty strings, and non-ASCII text.
• Updated scripting documentation links and navigation throughout the site, including related guides and blog posts.

• Added a Starlark scripting engine with standalone script detection, parallel tasks, retries, and dry-run support.
• Scripts can run Atmos commands, execute processes, read files, resolve components, install tools, and use logging and regex utilities.
• Added command and flag discovery for scripts, plus structured task output and cancellation support.

• Added Starlark runtime guidance and notes on component resolution and runtime behavior.

• Standalone scripts can now read source from stdin, with support for script arguments and interpreter selection.
• Added the errors.build helper for reporting script failures with structured details.
• Added extensive reference documentation for the Automation Language, its built-ins, data types, execution, and available functions.

• Expanded guides and examples for workflows, custom commands, lifecycle hooks, testing, and standalone scripts, including passing values between workflow steps.

• Clarified Git hook arguments, step execution, environment sharing, installation validation, and uninstall behavior.
• Expanded Starlark guidance for available APIs, process results, retries, tool installation, standalone CLI flags, and command output.
• Documented file-based configuration reads and clarified stack identity, script context, validation errors, and command usage.
• Updated examples for component settings and Starlark values.

• Added coverage for Git hooks, Starlark scripts and steps, standalone CLI behavior, stack identity, and configuration edge cases.

• Quality reports are published after all workflows for a pull request have finished, including failed or canceled runs.
• Scheduled checks reconcile open pull requests to main updated within the past 24 hours; manual checks cover all open pull requests to main.
• Periodic reconciliation helps recover missed events and late results.
• Benchmark reports now run manually using a completed benchmark run ID.

• Existing labels and comments are left unchanged when they already match the report.

what

why

references

• Workflow, custom-command, and lifecycle-hook step templates now support delimiters configured in template settings, including nested and multi-pass templates.
• Projects pinned to editions before 2026-10-19 continue using {{ }} for step templates.
• Template-based output modes now work with configured delimiters.

• Invalid output modes are reported after template rendering, including when custom delimiters are used.

• Updated template and edition guides with delimiter behavior and edition compatibility details.

• Added an experimental Gomplate setting for enabling experimental template functions, such as net.CIDRHost. It defaults to off and can be configured globally or overridden per stack. Stacks inherit the global value when no override is set.
• Import templates use the global setting; it does not apply to document generation or scaffold templates.

• Updated template configuration examples and references with the setting’s default, inheritance, and scope, with examples of experimental functions and per-stack overrides.

• CLI configuration imports can be required or optional. Object-form imports are required by default; skip_if_missing: true warns and skips failures, while legacy string imports remain optional.
• Imports support conditional loading for local, CI, or CEL-defined environments, including nested imports.
• Optional MCP servers are skipped with a warning when their identity is unavailable; other startup failures remain errors.
• Git-backed imports with missing or mutable references generate advisory warnings and continue resolving.

• Added configuration guidance, examples, and a blog post covering imports and optional MCP servers.

• Added experimental CEL policies to evaluate saved Terraform plans before publication or application.
• Added policy-selected lifecycle hooks for supported Terraform, Helmfile, Helm, and Kubernetes operations.
• Added --from-plan support for applying saved Terraform plans.
• With plan policies enabled, apply requires an explicit saved plan, and direct destroy is blocked.
• Added GitHub Actions context for policy checks.

• Improved error messages by quoting component, stack, and other identifiers consistently, including identifiers with special characters.

• Added policy setup, configuration, examples, CI context, lifecycle hook guidance, and details about experimental capabilities and limitations.

• Added a searchable, tag-filtered Policy Library with reusable examples for Terraform plans, lifecycle events, GitHub Actions, and affected changes.
• Expanded policy support with restricted Starlark rules, instance selectors, and affected-change checks. During affected analysis, policies can block commands when changes are denied or comparison data is unavailable.
• Policies load from policy.d/ by default, with ATMOS_POLICY_DIR available to override the location.

• Updated policy guides with configuration, inputs, execution limits, enforcement boundaries, affected-change behavior, and library contribution guidance.

• Added offline commands to validate, inspect, and test policy bundles, plus ci context to view CI data or field paths without exposing values.
• Policies can govern CLI and component commands, YAML and template functions, and local or remote sources, with optional path restrictions and approval requirements.
• Added --explain to show policy decisions and evaluation details on stderr.
• GitHub pull request approvals are checked against current review evidence before approval-gated actions proceed.

• Policy checks can block disallowed commands, function calls, file access, imports, and downloads before execution or access.

• Terraform dry runs now report when policy evaluation is unavailable because no saved plan was evaluated.

• Added policy controls for command and component execution, YAML functions, Go templates, and source access, including destroy detection and approval requirements.
• Added CI context inspection with query filtering and offline policy commands for checking, listing, validating, and testing policies.
• Redesigned the Policy Library with search, category filters, CEL and Starlark variants, examples, and references.
• Policy denials now show configured explanations and use a distinct exit code. Nested Atmos commands identify denials and inherit explanation settings.

• Improved plain-text rendering of Markdown explanations and hints, and corrected policy enforcement and policy discovery.

• Added guidance on policy admission, approvals, source restrictions, CI context, and Policy Library usage.

• CI systems now receive annotations for command failures. Policy denials produce one annotation per denied rule, with its reason or a fallback message; other failures include the error’s title, message, and details, plus a file location when available.
• Nested command failures are reported once. Policy denials detected before configuration loads are annotated when a CI provider is detected.

• Added guidance on CI failure annotations, including how CI detection and configuration affect reporting and what annotations contain.
• Updated the website’s extensibility overview to cover policies and validation together.

• Cast recordings can group steps into playback segments with a specified positive duration. Captured events fit the segment, while step execution, live output, and wait timeouts remain in real time.
• Playback segments work in session and steps modes and cannot be nested.

• Improved recording of text when UTF-8 characters arrive across multiple reads.

• Added guidance and examples for configuring playback segments.

• Added support for using external AWS credential helpers as Atmos identities and exporting Atmos credentials in AWS credential_process format for CLI profiles and SDK-based tools.
• Added minimum-validity controls, credential caching, role chaining, AWS ambient credentials, and non-interactive identity selection.
• AWS credential-process identities can open the web console when helpers return temporary credentials with a session token.
• atmos auth user configure now supports selecting an AWS user identity directly and uses the configured credential store.

• Improved authentication error reporting and guidance, and made interactive authentication fail promptly when a terminal is unavailable.

• Added declarative AI skill sources with commands to manage declarations and synchronize installations from local or Git repositories.
• Added project and user scopes, version tracks, installation status, and synchronization modes for previews, validation, and recovery.
• Added saved-session support to ai ask.
• Added Claude Code approval handling across chat, ask, and exec, with clearer approval choices and unattended-run policies.

• AI questions now include stack context in prompts without changing the recorded question or conversation history.
• Improved cleanup of provider processes when requests are cancelled or time out.

• Added the !ci.labels YAML function to return sorted review labels or check whether all specified labels match exactly and case-sensitively. Supports GitHub Actions and GitHub Enterprise, including merge-queue pull requests.
• CI labels can be used in stack configuration and component selectors. Results are shared for each CLI invocation and refreshed on the next.
• Metadata labels now accept boolean values, such as preview: true, for filtering components and stacks.
• Outside a review context, label lists return empty and checks return false; lookup failures during a review are reported as errors.

• Added guidance and examples for CI label functions, review contexts, merge queues, and boolean metadata labels.

• Git provision targets can publish rendered manifests through pull requests on GitHub and Azure DevOps.
• Configure the head branch, title, body, labels, draft status, reviewers, and assignees. Deliveries open or update pull requests against the configured or default branch without force-pushing.

• Added setup guidance and examples covering supported repository URLs, authentication, and pull-request delivery.

• atmos ai ask supports interactive tool approvals, AI-directed questions, progress updates, and terminal follow-up prompts.
• Configure tool permissions with ai.tools.mode: require_confirmation prompts for approval, allow skips prompts while honoring blocked tools, and yolo bypasses permission checks.
• Claude Code approval wait time does not count toward the request timeout.

• Empty answers, provider failures, and invalid permission modes return clear errors.
• Requests requiring approval fail clearly when no terminal is available.

• Updated AI configuration, usage, and troubleshooting guidance. Legacy permission booleans remain supported as deprecated aliases.

• Documentation templates can access parsed Terraform module data—including inputs, outputs, resources, providers, and module calls—to create custom README layouts.
• Existing Terraform documentation output remains available. Templates can still render when Terraform documentation is disabled or its source directory is unavailable.
• Added an example Terraform README format with module details, categorized variables, and obsolete-item labels.
• Terraform documentation formatting honors section visibility, empty-section hiding, and heading-level settings for unpinned projects and editions dated 2026-10-17 or later. Earlier edition pins retain legacy formatting behavior.

• Added guidance and examples for using Terraform data and formatting settings in documentation templates.

• Atmos CI, Auth, Toolchain, Emulator, source vendoring, and Terraform workdir management are now stable and no longer require experimental opt-in. Their CLI help and documentation no longer show experimental labels.
• CI commands still require ci.enabled. Newer Auth providers and integrations may have less production history.

• Updated feature-status guidance and the roadmap to distinguish stable capabilities from those that remain experimental, including workdir provisioning for local-only components.

• Added support for YAML-function-based secret backend selectors, with clearer reporting when selectors cannot be resolved.
• Added documentation for inline CloudFormation stack policies and identity-aware cross-account output lookups.

• Expanded guidance for the experimental CloudFormation component, including templates, delivery targets, StackSets, authentication, and template packaging.
• Clarified CloudFormation rendering, source downloads, output masking, and deployment behavior.
• Added Helm and Kubernetes component guides, plus workflow naming guidance.
• Clarified secret management and interactive confirmation requirements.

• Added a workflow publish step for sending local files and directories to S3 or Git, using named or inline targets. Results report changed and unchanged files, and dry runs validate configuration without publishing.
• Added an advanced CloudFormation example demonstrating build, publish, deploy, and HTTP validation.
• Added browsable example catalogs with search, filters, source-file views, and recorded demos.

• S3 publishing skips unchanged files; Git publishing commits and pushes changes while retaining destination-only files.
• HTTP steps retry expectation mismatches for safe methods and report attempt details on failure. Write methods retry those mismatches only when explicitly configured.
• CloudFormation previews and stack-event output are clearer, and structured outputs are easier to read.

• Added publish-step guidance and updated CloudFormation asset-packaging examples.

• CloudFormation changeset creation and execution have dedicated lifecycle hooks and support --skip-hooks.
• YAML !include supports opt-in function evaluation with | eval, while preserving CloudFormation intrinsic tags; short-form intrinsics are supported in inline templates.
• Eligible apply and deploy operations can create missing packaging buckets when provisioning is enabled.
• Unset !env variables without defaults resolve to an empty string and log a warning.

• Rain directives in CloudFormation templates fail locally with migration guidance.
• Invalid stack tag formats and first-deployment CREATE changesets using previous parameter values are rejected with guidance.
• Stack deletion checks live termination protection and handles missing stacks; tree shows deployed nested-stack hierarchies.
• Missing packaging buckets produce guidance before template upload.

• Added and updated Rain migration guidance, including replacement patterns and command mappings.

• CloudFormation commands can publish CI job summaries for changes, stack operations, and drift results, with reproduction commands and drift counts.
• Drift detection and description now trigger lifecycle hooks.
• CloudFormation output and apply summaries mask values linked to sensitive parameters when masking is enabled.

• Dry runs validate static configuration without evaluating dynamic expressions or contacting AWS.
• Bulk deletions now process dependents before their dependencies.
• StackSet targets reject malformed account and region values before changes are made.
• Successful named changeset deployments apply configured termination protection.

• Planfile storage can use a dedicated authentication identity per store, independent of the Terraform component’s identity. If none is configured, the store inherits the component identity.

• Added configuration guidance and a working example for using separate identities with planfile storage.

• Added customizable templates for CI summaries and comments, including container image reports. Container builds and pushes can publish per-image summaries and, when enabled, pull request comments.
• CI scripts can render summaries and comments from templates and supplied data.
• Pull request context now identifies fork-origin requests. On elevated events, comments and checks are held for fork pull requests unless unsafe fork execution is enabled; same-repository pull requests can post normally.

• Generic CI output and summary writers now use the current environment settings when called, so changes made after initialization take effect.

• Added CI support for pull request and commit comments, including automatic comment targeting and keyed updates.
• Container builds and pushes can publish image summaries to CI job summaries and, when enabled, post grouped comments by image repository.
• Added controls for fork-related CI writes and clearer warnings when unsafe fork checkout is allowed.

• Invalid CI provider URLs now fail the command instead of being treated as warnings.
• Improved CI output formatting, check-run details, and reporting of skipped uploads.

• Added live viewport output for supported scripts and process commands, with standard streaming as a fallback.
• Expanded CI scripting with templated summaries and comments, pull-request or commit comment targets, and reporter support in nested steps.
• Added the atmos.tf alias and improved standalone script discovery, including case-insensitive extensions and more flexible shebangs.

• Integer flags now parse base-10 values; invalid defaults, out-of-choice values, and explicitly empty constrained choices are rejected.
• Standalone scripts retain their original path when --chdir is used. Ctrl-C runs deferred cleanup, and help exits before later script actions.
• Literal YAML values are preserved, and retry conditions can match error messages or captured process output.
• Command arguments without a default or explicit optional setting are now required.

• Updated CI function guidance and examples for comment targets, templates, and annotation validation.

• Added Atmos Automation (Starlark) support for standalone scripts, custom commands, workflows, lifecycle hooks, and test steps, with parallel tasks, retries, and structured results.
• Added examples and terminal recordings for scripts, custom commands, ownership checks, and release planning.
• Moved tool-version lock files outside project directories.

• Improved secret masking across streamed output and applied configured masking to command output.
• Embedded scripts are validated before execution, and dry runs parse scripts without running them.
• Improved workflow include path resolution and test-failure summaries.

• Expanded guidance for Starlark, script paths, terminal settings, and cast validation.

• Run standalone Starlark scripts as CLI apps with declared positional arguments and typed flags, generated help, and input validation.
• Access parsed arguments and flags in scripts, custom commands, and workflow steps, including parallel and matrix tasks.

• Starlark limits excessive recursion and presents clearer, more concise traceback details.
• Standalone scripts show the local metrics summary only when explicitly enabled.
• Starlark step output defaults to raw output without labels; labels can be enabled in configuration.

• Added guides and examples for Starlark apps, custom commands, workflows, hooks, and testing.

• Added integer flags for custom commands, with whole-number defaults and integer values in templates and scripts.
• Optional command arguments can be omitted and resolve to empty strings; argument values preserve commas, empty strings, and non-ASCII text.
• Added !literal support for step fields and declared environment values, allowing template-like text to pass through unchanged.
• Added enforced step timeouts for supported step types, including across retries and backoff.
• Added validation for supported step output modes and JSON-formatted structured script outputs.

• Improved template rendering for parallel and matrix child steps, and clarified handling of inherited environment values.

• Automation scripts can call registered workflow steps and use their returned values, metadata, and outputs in later operations.
• Process calls support configurable timeouts and retries for eligible failures; captured output reflects the final attempt.
• Automation query commands capture JSON by default and expose decoded results through data.
• config get, stack config get, and stack get support --format/-f with raw and json output.

• Added guidance and examples for step-library calls, structured query results, and process controls.

• Git hooks can now run ordered Atmos steps, including inline Starlark scripts; existing command-based hooks remain supported.
• Automation scripts can inspect local files with functions for matching paths, checking metadata and existence, and reading symlink targets.
• Pre-commit checks flag broken tracked symlinks and instruction files exceeding their configured size limits.

• Updated guides cover Git hook steps and filesystem functions, with examples and usage details.

• Added !starlark expressions in stack manifests to compute typed configuration from merged component context. Expressions can reference other computed values, with dependency cycles reported as errors.
• Terraform generators now use resolved component values when determining stack names, workspaces, and output paths.

• Added guidance and examples for computed YAML values, including supported locations, evaluation behavior, and limitations.

• Preserved Starlark expressions through YAML and template processing so they evaluate against the final merged configuration.

• Custom-command and standalone-script help now describes positional arguments, required values, defaults, and allowed options.
• Git hooks support configured steps, run from the repository root, and pass configured environment values through to steps. Uninstalling without hook names removes Atmos-managed shims, including orphaned ones.
• Step and stack templates provide clearer validation and error reporting, including rendered output modes and retry settings.

• Invalid custom commands no longer prevent other commands from registering; warnings explain the issue, and invoking the affected command reports its error.
• Explicit stack-file reads now report errors when files cannot be read. Starlark context values and stack locals are more consistent, and computed stack identities are rejected with a clear error.
• Git hook resource-usage summaries are off by default unless explicitly enabled. Standalone scripts provide clearer flag and validation errors and pass active profile and identity selections to nested commands.
• Git hook installation validates selected hooks before writing shims, repairs permissions on unchanged shims, and r…

• Added CI reporting for automation scripts, including summaries, outputs, annotations, comments, checks, and SARIF reports. Reports also render locally when no CI provider is available.
• Added deferred cleanup, digest functions, executable lookup, and filesystem path resolution with home-directory expansion.

• Expanded automation and CI references with usage guidance, examples, configuration behavior, and safety details.

• Improved local SARIF messages to identify the report file when its path is available.

• Clarified how to track follow-up work before and after changes merge, and how to work with stacked pull requests.

• Added OCI artifact support for YAML !include and !include.raw, allowing files to be selected from within an artifact.
• OCI sources can now be fetched through the shared downloader for vendoring and generation workflows.

• Improved handling of explicitly forced Git sources, including credential injection for supported hosts.
• Invalid OCI references, missing include paths, and unsupported single-file requests now return clear errors.

• Updated OCI include syntax and added guidance on artifact paths and fetching behavior.

• Duration settings now support a consistent range of formats, including Go-style durations, bare numbers in seconds, day units, named intervals, and ISO-8601 values where supported. Numeric seconds are also supported in retry configuration.

• Component lookup reports processing errors from the requested stack rather than misidentifying components as missing.
• Interactive prompts appear before input is entered while secret masking remains active.
• External script output continues draining after the interpreter exits, with cancellation and output errors handled during draining.

• Updated duration guidance and examples to explain supported formats and numeric seconds.

• Azure PIM activation requests now cap durations that exceed the role’s policy maximum, while leaving durations within the limit unchanged. If the maximum cannot be retrieved, the configured duration is used. Unset or nonpositive durations are sent without a duration value.

• Updated Azure PIM guidance to reflect the activation-duration cap and its implementation.

• Fixed archive timestamp handling for Git linked worktrees by resolving shared Git metadata instead of incorrectly falling back to the Unix epoch.
• Preserved per-file commit timestamps and the latest commit timestamp for the archived source subtree.

• Added coverage for timestamp behavior in linked worktrees using Git and epoch modes.

• atmos doctor now reports dependency issues with clearer locations and verifies that dependency repairs preserve effective dependencies, including inherited ones.
• Supports legacy list-form depends_on declarations and can migrate them when effective dependencies remain unchanged.
• Improves monorepo source guidance for mixed-case URLs, nested module paths, and subdirectories placed in query strings.
• Suggested repair commands preserve relevant scoping options; unmatched exclude patterns are reported.

• JSON and SARIF reports now include invocation errors, --affected guidance is clearer, and interrupted runs provide a summary.
• Read-only files are identified for manual review without blocking repairs to writable files. EditorConfig checks honor Git-aware file selection and exclusions.

• Expanded guidance for doctor checks, repair behavior, and dependency declarations.

• Repeated --labels values now preserve literal quotes and are parsed consistently across commands and configuration sources.
• Workflow retry conditions can match output from failed attempts.
• Shell commands support executable scripts without shebangs and commands found through shell-local PATH settings.
• Stack-name templates correctly handle integer-valued decimal and exponent arguments.
• YAML include queries preserve multiple results and handle empty values consistently; quoted eval text no longer triggers command execution.

• Added guidance for regression investigations and records describing recent fixes.

• Added a dry-run YAML editing option that returns edited content without changing the source file.
• Configuration paths can now be resolved relative to a specified working directory, with expanded discovery for configuration files, directories, and active profiles.
• Local stack imports now support additional path and template patterns.
• Repository change detection now includes staged files and finds untracked files from nested directories.
• Added GitHub repository health checks and directory tree lookups.
• Diagnostic progress displays clearer status, timing, and failure information.

• Legacy Terraform reconfiguration flags and environment variables now follow documented precedence and map to the corresponding reconfiguration policy.

• Clarified legacy Terraform reconfiguration behavior and migration guidance.

• Set an entire component section to !unset to remove values from applicable lower-priority configuration layers. This works with base components and overrides, while higher-priority values remain in effect.

• Manifest validation now provides clearer guidance when section references use an unsupported YAML tag.

• AWS EKS and Azure AKS update-kubeconfig commands now apply --kubeconfig and --alias overrides with --integration; empty overrides preserve the integration’s configured values.
• Custom kubeconfig paths used by AWS, Azure, and GCP integrations now expand ~ and environment variables. Paths containing an unset environment variable return an error.

• Updated EKS and AKS command documentation to describe integration overrides, environment-variable bindings, and path expansion.

• Added dry-run support when cleaning a specific Terraform component, showing which component and stack would be cleaned without removing files.
• Planfile storage supports configured defaults and priority ordering, selecting an available store or reporting an error when selection fails.

• GitHub comments over the platform limit are safely truncated while preserving valid text and handling markers and masked content.
• Changes to pinned source versions are detected, and source values are redacted in change messages.
• Aqua release tags are preserved when package metadata is unavailable.
• Tool checksum verification uses the resolved version being installed or locked.

• Clarified planfile store selection, availability requirements, and error behavior.

• Helm and Kubernetes components are included in component listings and unique component results.
• Change detection recognizes updated files in Helm component folders.
• Component descriptions retain Helm- and Kubernetes-specific configuration, along with shared generation, source, and provisioning details.
• Dependency lookups support registered component types.

• Deletion detection reports Helm and Kubernetes components when components or entire stacks are deleted, while excluding registered custom providers.

• CloudFormation outputs can be selected by key and rendered in supported formats; bulk output is grouped by stack and component.
• Added stack listing with managed-stack annotations, bulk formatting checks, lifecycle-hook skip options, and CI output variables.
• Backend dry runs describe planned actions without AWS calls.

• Apply previews changes before confirmation; no-op and declined changes are handled with clearer feedback and cleanup.
• Parameter configuration accepts maps or AWS CLI/Rain-style lists. Invalid parameters and capabilities are reported before AWS calls.
• Drift details include property-level differences, and dry runs validate more static configuration.
• Template retrieval can preserve the original response; packaging can reuse matching uploaded templates.

• Expanded CloudFormation command, configuration, migration, and CI guidance.

• Bulk Terraform deploys now verify each component’s stored plan using that component’s authentication context and manager.
• Deploys use the plan selected by verification, helping prevent execution with a missing or drifted stored plan.
• Deploy workdir operations are serialized when they share a source directory and plan verification is enabled.

• Updated Terraform deploy guidance to describe plan verification for both single-component and bulk deploys.

• Improved reuse of Terraform outputs, state, component references, and deferred lookups while keeping results separate across credentials, configuration, and inspection modes.
• Inspection lookups continue to mask secrets, and incomplete or failed results are retried rather than retained as completed results.
• Fixed cache invalidation and handling of empty component authentication settings.

• Added regression coverage and benchmarks for lookup reuse, credential isolation, retries, and cross-stack store reads.

• config get, stack get, and stack config get support command-specific format environment variables; an explicit --format flag takes precedence.
• Git hooks can pass their arguments and supported stdin to hook steps. Installed hooks can use the installing Atmos binary, falling back to the system PATH if unavailable.
• Starlark references can evaluate only the configuration values they read; unsupported !starlark tags in atmos.yaml now produce an error.

• Workflow retries can use configured conditions, and step timeouts now report the affected step type.
• Hook execution stops with an error when nesting reaches the recursion limit.

• Standalone scripts now handle leading Atmos flags, --chdir, and version-pinned reruns while forwarding script arguments correctly.
• Standalone CLI inputs support CSV-formatted string lists, base-10 integers, and environment values parsed like command-line values. Help output includes required fields, valid choices, and environment bindings.
• Assigning None to top-level output produces no standalone output; None inside lists or dictionaries remains JSON null.

• Invalid standalone CLI input now produces clearer usage errors, without a Starlark traceback.
• Script selection distinguishes missing .star paths from other paths and directories.

• Expanded guidance for standalone CLI inputs, flags, help, errors, and output.

• Canceling a command or exiting Atmos now also terminates its descendant processes on supported Unix systems, reducing the chance of leftover processes.
• Commands with terminal input and Windows commands continue to use direct-child termination.
• Background processes holding command output open no longer cause successful commands to hang or fail.

• Added unified CI reporting for scripts and workflows, with local output when no CI provider is detected. Supported reports include summaries, outputs, environment and PATH updates, annotations, comments, checks, log groups, secret masking, and SARIF.
• Added controls for enabling reporting features and restricting reporting in elevated pull-request events.
• Added GitHub API URL configuration and CI run links for check results.

• Updated CI configuration and environment-variable guidance, including comment opt-in behavior.

• Updated workflow security actions to version 2.22.0.

• Added streaming secret masking across command output, terminal sessions, pagers, and captured errors—even when secrets are split across writes.
• Improved YAML include resolution across working directories and configuration layouts, with local script-source tracking and support for clearing inherited commands using commands: !unset.
• Added terminal query emulation when interactive input is unavailable.
• Added checksum-verified Atmos bootstrap installation and public attestation verification fallback for GitHub quota limits.

• Improved command lookup using each invocation’s environment and working directory.
• Corrected GitHub rate-limit handling for raw-content downloads and improved logger color behavior and Markdown rendering.
• Retry operations now respond promptly when their context is already canceled.

• Clarified requirements for custom multiline masking patterns.

Release Notes

v3.2.2

what * Added 'ignore-error=true' to the default cache-to configuration.

why * Intermittent "error writing layer blob: failed to reserve cache" during GHA cache export (gha exporter) — not quota, not permissions

references * https://github.com/docker/build-push-action/issues/1571#issuecomment-4855448865