cloudposse/atmos v1.234.0-nightly.40429554338 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS auth provider coverage for credential expiration, expiration reporting, environment projection without secret leakage, validation, identity metadata, provider resolution, credential persistence, invalid and missing files, and idempotent logout behavior.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Core commands can now register their own documentation URLs and ordered examples, with independently inherited documentation and example metadata; ordinary and cross-command aliases retain their source metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Supporting commands now register documentation URLs and ordered examples, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent’s documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

The CI failure annotations documentation now includes a runnable local preview, expected annotation output, intentional exit code 77 behavior, and early admission guidance.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Quality reporting now selects the newest CI and Codecov checks, publishes one pending snapshot followed by the final report, recovers unfinished reports and long-running reruns, and groups results into Readiness, Reviews, and Measures with a job-summary link.
CI reliability updates add bounded toolchain retries, Windows artifact hosts, REST artifact downloads for demo lint, corrected Ubuntu mirrors, local fixtures for latest-release checks, and retrying installation for Pact contracts.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Add runnable examples/cdk-cloudformation and examples/cdk-terraform projects that use CDK with the native CloudFormation or Terraform components against the local Floci AWS emulator. The examples include freshness-aware synth hooks, atmos test smoke checks, lifecycle casts, and links from the CDK tutorial.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Copyable Atmos examples no longer override incidental logging, redundant approval/init settings, or global caching approval; quick-start guidance and generated configuration snapshots now reflect inherited defaults and current directory and AWS-account instructions.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

CodeRabbit path instructions now encourage extracting touched behavior and tests from internal/exec and pkg/utils into owning packages, using thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bump the Claude Code plugin to version v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged members of a native PR stack when their merge commits are present in the verified release source range, even if GitHub retains the original parent branch as the PR base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready pull requests whose head combined status is failure or error, even when the report is current and the commit is more than 24 hours old. The change also updates frontend dependency overrides for patched dompurify, follow-redirects, and launch-editor releases.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks from superseded runs only when their check-suite ID confirms the association. Current failures, pending runs, unknown or shared suite IDs, external checks, and synthetic merge-commit checks remain enforced.

✨ Features

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Doctor can safely migrate legacy naming patterns and tokens to templates when production before/after identity checks pass, and provides guidance for local Atmos schema copies. Plain errors now remove raw Markdown, preserve terminal color through wrappers, separate metadata explanations from actionable hints, and log hook dispatches at Debug level.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Add native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version/FIPS, calendar, and CI evidence across all four engines. Policies can now enforce production deployment and authentication guardrails using shared version and date checks.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 must use explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Edition 2026-10-19 retains legacy behavior, including condition shorthand and explicit evaluation APIs, while quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show documentation URLs, with global --docs to print or open them and --docs=md (alias --docs=markdown) to fetch and render Markdown. Global --example selects and initializes bundled examples through atmos init, with installation checks, overwrite confirmation, --force=true handling, cancellation warnings, and support outside a valid project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Add a Fogg migration guide, AWS CDK and CDK Terrain tutorials, and related Learn navigation, changelog, and roadmap content. CloudFormation synthesis hooks now run before generated files are read, while inherited region and duration-based timeout settings are supported with Doctor migrations.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, Git hooks, CI, and autofix now use a shared YAML/Starlark suite instead of the pre-commit framework. Fixes preserve staged and unstaged edits, use atomic writes and native Git sandboxes, support bounded parallel copying and terminal-aware progress, and back up existing hook launchers when forcibly replaced.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Automation scripts now support module.load(path) with cached, frozen exports, cycle detection, cancellation, and parallel loading, plus struct(**fields). The new stdlib/config package loads and validates YAML/JSON against inline, local, or HTTPS JSON Schemas, provides immutable dot-access records and source diagnostics, and merges configurations with configurable list strategies.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Add stdin= to exec.run, component.exec, and all atmos.* wrappers for sending exact bytes without shell processing or command-line exposure, including retry replay. Scripts also gain the predeclared os module, invocation-local os.setenv and os.chdir, and fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation by default.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Add settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions, defaulting to 1; results retain their original positions, --skip=exec is preserved, failed evaluations cancel outstanding commands, and policy checks run before execution.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI configuration hints for atmos <command> --ai now use each provider’s DefaultModel, including the Anthropic model in the disabled-AI hint, instead of a separate hardcoded model list.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform destroy, before/after, and per-component lifecycle hooks now run for bulk init and test operations in prepared work directories, with resolved paths and credentials preserved for after-hooks. Test fixtures start before authentication, and tool-version discovery is scoped to each project’s configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm render, install, and upgrade chart lookup now preserve repository credentials, TLS options, and credential-forwarding policy. AWS secret-store operations retain SDK credential discovery, including AWS_PROFILE, while explicit managed credential overrides continue to take precedence.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component values are now resolved before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This keeps component descriptions, affected-component lookups, and backend prefixes aligned with the resolved component directory.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now propagate options such as --skip=secret to dependency evaluations and partition caches by skip list, preventing skipped secret functions from contacting secret providers in dependency components.

fix(terraform): run tests without generating a backend @osterman (#3514)

terraform test no longer generates a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run without backend_type and preserving any existing backend files.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves stack, component, and type providers without evaluating secret values, including provider-only stacks with imported or templated configuration. Ambiguous overrides and unmatched explicit selections are rejected, while registered component types participate in stack filtering and description.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now searches from encrypted files and generates recipient regexes relative to each recipient file, including nested .sops.yaml files. Omitted spec.file rules derive wildcards from the configured secrets directory, with Unix and Windows path separators supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

Stack- and globally scoped declarations can now be written and validated with secret set NAME=value -s <stack> and secret validate -s <stack> without specifying a component. Instance-scoped operations continue to require a component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom Atmos steps with type: atmos now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.
Race-test package planning now distributes the four expensive suites across shards before assigning the remaining shuffled packages, while preserving package coverage, deterministic ordering, timeout, and parallelism.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations whose overridden container.ports omit the Kubernetes API port 6443/tcp; existing port-list replacement semantics remain unchanged.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

ui.info terminal messages now render email autolinks once while preserving explicit Markdown destinations. Documentation also clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving existing recipient rules and explicit recipients. Ambiguous multiple identities are rejected with remediation guidance.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now use duration.Format: durations of at least a minute appear as 34m 47s or 1h 2m 3s, with zero units omitted, while sub-minute values retain their existing format and boundary rounding is handled consistently.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Security reporting now suppresses 62 Semgrep false positives for same-repository actions, groups backlogs by scanner, and documents remaining findings while excluding permission-gated alert URLs from public link checks.
Upgrade Go to 1.26.10 and patch frontend dependencies for the validated Windows runtime workaround; Terraform hook test state is also restored between runs.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Upgrade github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for duplicate distinct_id values in feature-flag properties and retries for transient feature-flag and network errors.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Upgrade al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Upgrade golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.