cloudposse/atmos v1.234.0-nightly.40251868208 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expand mock AWS auth provider coverage for credential expiration, expiration reporting, environment projection without secret leakage, validation, identity metadata, provider resolution, credential-file persistence, missing or invalid credentials, and idempotent logout behavior.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Add command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and preserved source metadata for ordinary and cross-command aliases.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Register documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Document a runnable local preview of CI failure annotations, including the expected annotation output, intentional exit code 77, and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilize quality reporting by selecting the newest CI and Codecov checks, publishing one pending snapshot followed by the final report, recovering unfinished reports and long-running reruns, and avoiding edits caused only by changed summary URLs.
Improve CI resilience with grouped Readiness, Reviews, and Measures summaries, bounded toolchain retries, Windows artifact hosts, REST artifact downloads, corrected Ubuntu mirrors, local release fixtures, and retrying local Atmos-based Pact installation.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Add runnable examples/cdk-cloudformation and examples/cdk-terraform applications that use the native CloudFormation and Terraform components against the local Floci AWS emulator, with lifecycle casts, smoke checks, and CDK tutorial links.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Add CodeRabbit path instructions encouraging behavior and test logic touched in internal/exec and pkg/utils to be extracted into owning packages, using thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bump the Claude Code plugin to version v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history validation now recognizes merged native stack members when their merge commits are present in the verified release source range, even if GitHub retains the original parent branch as the pull request base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready pull requests whose head commit has a combined status of failure or error, even when the report is current and the commit is more than 24 hours old. It does not select quality:not-ready pull requests or combined pending statuses.
Update website/ pnpm overrides for dompurify, follow-redirects, and launch-editor to patched releases and regenerate pnpm-lock.yaml.

✨ Features

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Add native OPA and JSON Schema policy engines with shared environment, runtime, version/FIPS, calendar, and CI context, plus boolean and diagnostic Rego results and YAML/JSON file checks. Add deployment and authentication guardrails, shared version/date checks, migration guidance, and reference documentation.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. edition: "2026-10-19", condition shorthand, and explicit evaluation APIs retain legacy behavior, while quoted !env, !exec, and !unset values remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Add command discovery through --docs, --docs=md (also --docs=markdown), and --example: help and usage errors show documentation URLs, --docs can open or render them, and --example selects and initializes runnable examples with installation and overwrite confirmations. Discovery works before normal project validation, preserves aliases, --chdir, custom flag ownership, and initialization behavior, and generates linked documentation indexes from resolved navigation.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Add Fogg migration, AWS CDK, and CDK Terrain guides, along with changelog, roadmap, and Learn navigation updates.
CloudFormation synthesis hooks now run before generated files are read; inherited region and duration-based timeout settings are supported, with Doctor migrations enforcing legacy minute values.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Add module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading.
Add typed YAML/JSON configuration loading and validation through stdlib/config, supporting inline or local/HTTPS JSON Schemas, defaults, bounds, optional fields, lists, enums, immutable dot-access records, source diagnostics, and config1.merge(config2) with configurable list strategies.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Add settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions; the default 1 preserves serial evaluation. Results remain in their original positions, outstanding commands are canceled after failure, function policy is checked before launch, and --skip=exec behavior is unchanged.

🐛 Bug Fixes

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Restore Terraform destroy, before/after, and per-component lifecycle hooks for bulk init and test runs, executing them in prepared workdirs while preserving resolved paths and credentials for after-hooks. Test fixtures can start before authentication without being overwritten, and tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Preserve repository credentials, TLS options, and credential-forwarding policy across native Helm render, install, upgrade, and chart lookup operations. Populate AWS ambient authentication context while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Resolve inherited metadata.component values before backend generation while preserving explicit overrides, legacy component selection, and disabled metadata inheritance. This keeps execution directories aligned with inherited component metadata.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, avoiding the backend_type is required error for provider-free test modules and preserving existing backend files.

fix(secret): allow stack secrets without a component @osterman (#3517)

Allow secret set NAME=value -s <stack> and secret validate -s <stack> to operate on stack-scoped declarations without an unrelated component, while retaining the component requirement for instance-scoped operations.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Add duration.Format in pkg/duration and use it for local resource summaries and Native CI Terraform summaries. Durations of at least a minute now render as combinations such as 34m 47s or 1h 2m 3s, while sub-minute values retain their existing format and boundary rounding avoids displaying 60.0s.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Update github.com/posthog/posthog-go from 1.12.6 to 1.17.4.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Update al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.