cloudposse/atmos v1.233.2 on GitHub

📦 Other Changes

chore(ci): raise patch coverage target to 90%; fix PTY resize race @osterman (#3441)

The Codecov patch coverage target for new and changed lines increases from 85% to 90%; the status remains informational rather than an enforced required check.
PTY terminal cleanup now captures the configured stdin and waits for the SIGWINCH resize goroutine to exit, preventing a data race when os.Stdin is reassigned.

chore: bump Claude Code plugin version to v1.233.0 @cloudposse-releaser[bot] (#3444)

Add runnable examples to command documentation @osterman (#3448)

Command and related configuration documentation now includes runnable Try it out sections for 134 pages, using real example targets with setup, expected results, and cleanup. Command groups demonstrate relevant subcommands, and the examples cover vendoring, version tracks, toolchains, Terraform, workflows, profiles, scaffolding, emulators, development containers, and other supported projects.

fix(ci): repair benchmark provenance and failed license scans @osterman (#3451)

Benchmark reports now validate artifact bases against the current main branch instead of GitHub's cached pull-request base SHA, preserving merge-parent and artifact provenance checks.
License scans that return no entries are retried; failed retries expose scanner diagnostics and leave NOTICE unchanged, while successful empty scans and usable partial reports retain their existing behavior.

ci: unify runner hardening, DNS repair, and shared allowlists @osterman (#3493)

Block-mode CI jobs now use a shared hardening action and route host DNS through StepSecurity's active resolver, aligning application lookups with firewall-allowed IP addresses while preserving Docker DNS, firewall rules, and lifecycle hooks.
.github/allowlist.yaml provides reusable, validated, deduplicated endpoint policies with OS-specific background-service and update rules; the action loads policies from its pinned repository revision without checkout or runtime npm installation.
Harden-runner diagnostics now use a tested Node action with bounded host and container probes, sanitized artifacts, step summaries, and strict canary rejection evidence before allowing a job to pass.

fix(release): improve feedback and reserve sequential RC tags @osterman (#3500)

Release workflows now validate repository lookups, display aligned milestone PR listings and native milestone feedback, and replace raw release-plan JSON with concise summaries while retaining the exact plan for confirmation.
Release candidates reserve sequential annotated tags per version, recover reservations on retry, and carry the reserved tag through verification and publication summaries without changing nightly or feature numbering.
Actions run titles, job names, and stage summaries now expose release identity, checkpoint outcomes, and artifact links; release preparation also forwards secrets correctly, reports credential diagnostics, and avoids deprecated token inputs.

Fix repository metadata URLs in release milestone checks @osterman (#3501)

Release milestone checks now request repository metadata as repos/<owner>/<repo> without a trailing slash, while nested resource and query URLs remain unchanged. This fixes the default-branch lookup used by Release milestones / enforce, which previously received HTTP 404 from GitHub.

ci: bump scorecard-action to v2.5.0 for $/ action support @osterman (#3503)

Upgrades ossf/scorecard-action from v2.4.4 to v2.5.0, pinned by full commit SHA, so Scorecard recognizes same-repository uses: $/.github/actions/... references and no longer recreates the related false-positive pinned-dependency alerts.

fix(release): validate action inputs and show live RC progress @osterman (#3504)

Release preparation, verification, and finalization now receive the release cutover flag explicitly and perform local composite-action contract checks before packaging.
Release commands follow the correlated GitHub Actions run with gh run watch --exit-status, retain final API verification, identify RC requests explicitly, and show live release progress.
Publication now checks repository immutability and credentials before dispatch, rejects changed draft prerelease status, and verifies the published target commit and classification.

fix(release): restore attestations and notes, warm release caches @osterman (#3506)

Release artifacts now require both GitHub-generated SLSA provenance and a separate attestation for the selected source, while draft release notes are prevented from being formatted twice.
Release builds gain isolated caches with main-only daily or manual warmup, pinned prebuilt signing and SBOM tools, and cache/build summaries.

Make documentation examples easy to try @osterman (#3447)

Changelog posts and example pages now provide copyable setup commands through the reusable TryExample component, with shared Install Atmos and named example tabs such as Dev Container and Build Geodesic.
Documentation adds runnable walkthroughs for CloudFormation and policy examples, including emulator or deployment setup, cleanup, offline policy fixtures, command allowlists, and destroy denials.
atmos policy check now defaults to terminal-friendly text; use --format text|json or ATMOS_POLICY_CHECK_FORMAT to select output. JSON remains available with its existing fields on stdout, while the default summary is written to stderr.

fix: !terraform.state honors remote_state_backend (read-only role) @aknysh (#3450)

!terraform.state now reads a component's remote_state_backend and remote_state_backend_type when configured, including read-only role and sse_customer_key overrides, and falls back to backend and backend_type otherwise. The change affects in-process state reads only; terraform plan and terraform apply are unchanged.

fix: enforce milestone releases and verified artifact publication @osterman (#3474)

Release management now uses tested Mage operations behind atmos release check, atmos release cut, and atmos release candidate; the next milestone defines the version, local confirmation binds the commit SHA, and GitHub Actions owns tagging and publication.
Merge checks and the quality gate enforce label compatibility and milestone ordering while maintaining three minor milestones, stable-release previews, and configuration-driven PR summaries.
Stable, candidate, nightly, and feature releases share artifact verification, including uploaded-asset and published-input checks before distribution; publication credentials are minted after build and verification, and identical partial uploads can resume.