cloudposse/atmos v1.233.2-rc.3 on GitHub

📦 Other Changes

chore(ci): raise patch coverage target to 90%; fix PTY resize race @osterman (#3441)

Codecov’s patch coverage target for new and changed lines is now 90% instead of 85%; documentation reflects that the status remains informational rather than enforced.
PTY terminal cleanup now captures the setup-time stdin and waits for the SIGWINCH resize goroutine to exit, preventing a data race with later os.Stdin changes.

chore: bump Claude Code plugin version to v1.233.0 @cloudposse-releaser[bot] (#3444)

Add runnable examples to command documentation @osterman (#3448)

Add Try it out quick starts to 134 command and related configuration pages, using real example targets with setup, expected results, and cleanup; command groups demonstrate relevant subcommands.

fix(ci): repair benchmark provenance and failed license scans @osterman (#3451)

Benchmark reports now validate artifact bases against the current main branch rather than GitHub’s cached PR base SHA, preserving merge-parent and artifact provenance checks.
License scans retry when they produce no entries, return scanner diagnostics when retries fail, and leave NOTICE unchanged on failure while preserving successful empty and usable partial reports.

ci: unify runner hardening, DNS repair, and shared allowlists @osterman (#3493)

CI runner hardening now routes host DNS through StepSecurity’s active resolver and uses shared, OS-scoped policies from .github/allowlist.yaml across block-mode jobs. The downloaded action repository supplies validated policies and diagnostics without checkout or runtime npm installation, while recovery preserves resolver state, Docker DNS, firewall rules, and final reporting.

fix(release): improve feedback and reserve sequential RC tags @osterman (#3500)

Release workflows now provide concise repository, milestone, release-plan, and stage feedback, including colored PR statuses, checkpoint outcomes, artifact links, release identity in run titles, credential diagnostics, and cancellation summaries.
RC preparation reserves sequential annotated tags, recovers reservations on retries, carries the reserved tag through verification and publication, and updates release documentation.

Fix repository metadata URLs in release milestone checks @osterman (#3501)

Release milestone repository metadata requests now use repos/<owner>/<repo> without a trailing slash, while nested resource and query URLs remain unchanged. This fixes the default-branch lookup used by atmos release milestone enforcement.

ci: bump scorecard-action to v2.5.0 for $/ action support @osterman (#3503)

Upgrade ossf/scorecard-action from v2.4.4 to v2.5.0, pinned by full commit SHA, so Scorecard recognizes same-repository uses: $/.github/actions/... references and stops reporting them as false-positive pinned-dependency alerts.

fix(release): validate action inputs and show live RC progress @osterman (#3504)

Release commands now pass the cutover flag explicitly through preparation, verification, and finalization, validate local action contracts before packaging, watch the exact correlated run with gh run watch --exit-status, and identify RC requests explicitly.
Publication preflight checks repository immutability and draft prerelease changes, then verifies the published target commit and classification while preserving publishing App privileges.

fix(release): restore attestations and notes, warm release caches @osterman (#3506)

Releases now restore GitHub-generated SLSA provenance, separately attest the selected release source, require both signatures for every artifact, and avoid formatting draft notes twice.
Add isolated release caches with main-only daily or manual warmups, pinned prebuilt signing and SBOM tools, and cache/build summaries.

Make documentation examples easy to try @osterman (#3447)

Documentation examples now use a reusable TryExample component with copyable setup commands, shared Install Atmos tabs, named example tabs, and runnable quick starts for changelog posts and example pages.
The policies example now runs offline with admission rules and fixtures, while atmos policy check defaults to terminal-friendly text and supports explicit --format text|json or ATMOS_POLICY_CHECK_FORMAT.
Scripts consuming the previous JSON default must add --format json; JSON remains on stdout and the default text summary is written to stderr.

fix: !terraform.state honors remote_state_backend (read-only role) @aknysh (#3450)

!terraform.state now reads through a component’s remote_state_backend and remote_state_backend_type when configured, falling back to backend and backend_type otherwise. This supports read-only remote-state credentials, including sse_customer_key, without changing terraform plan or terraform apply.

fix: enforce milestone releases and verified artifact publication @osterman (#3474)

Replace Release Drafter with atmos release check/cut/candidate; milestone versioning, local SHA confirmation, label compatibility, milestone ordering, and release summaries are now enforced through Mage operations and the quality gate.
Stable, candidate, nightly, and feature releases share artifact verification, verify assets before publication and published inputs before distribution, and mint publication credentials only after build and verification for resumable partial uploads.