cloudposse/atmos v1.234.0-nightly.40610559474 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expand mock AWS authentication provider coverage for credential expiration, expiration accessors, BuildWhoamiInfo, validation, identity metadata, provider selection, environment preparation, credential-file persistence, missing or invalid credentials, and idempotent logout behavior.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Add command-owned documentation URLs and ordered example metadata to the command registry for core stack, cloud, CI, configuration, and profile commands. Documentation and example lists inherit independently, and aliases retain their source command metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Register documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit documentation from their parent.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Update the CI failure annotations changelog and policy example README with a runnable local preview, expected annotation output, and an explanation of exit code 77 and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilize quality reporting by selecting the newest CI and Codecov checks, publishing one pending snapshot followed by the final report, recovering unfinished reports and long-running reruns, and avoiding edits caused only by summary URL changes. Reports are grouped into Readiness, Reviews, and Measures with a job-summary link; CI also gains bounded retries, Windows artifact support, local fixtures, and local Atmos-based Pact execution.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Add runnable examples/cdk-cloudformation and examples/cdk-terraform CDK examples that use the local Floci AWS emulator, so the CDK tutorial can be followed without an AWS account. The examples include hook freshness settings, smoke tests, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Remove incidental logging, redundant approval and initialization settings, and global caching auto-approval from copyable Atmos examples while retaining required and instructional configuration. Update quick-start guidance and snapshots for inherited Warning logging.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Add CodeRabbit path instructions that encourage extracting touched behavior and tests into their owning packages, using thin adapters where necessary.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bump the Claude Code plugin to version v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged pull requests from native stacks when their merge commits are present in the verified release source range, even if GitHub retains the original branch as the PR base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready pull requests when the head's combined commit status is failure or error, including after the report is current and the commit is more than 24 hours old. It does not select quality:not-ready pull requests or combined pending statuses.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and ignores GitHub Actions checks from superseded runs only when their check-suite ID proves the association. Current failed or pending runs, unknown suite IDs, external checks, and synthetic merge-commit checks remain enforced.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can interpret VHS tapes supplied inline with tape: or from .tape files with tape_file:, in steps or PTY-backed session mode without requiring the VHS binary. Add atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable shell startup, prompt-aware waits, screenshots, and VHS-compatible setup and output behavior.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Add atmos stack plan and stack test with native Terraform, Helm, Kubernetes, and CloudFormation operations, Helmfile diffs, custom commands, dependency ordering, hooks, CI reporting, and --dry-run. Stack lifecycle commands support --stack, --component, repeated or comma-separated selections, --all, --affected, tags, labels, and interactive pickers; add stack list, stack describe, stack instances, and multi-stack stack create --target scaffolding.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Add cast.recorder(...) for Starlark scripts, including command execution, PTY blocks, setup and cleanup groups, assertions, policies, replacements, and declaration fingerprints for read-only validation. Script steps can load .star, .py, .sh, and .bash files with source:, while session waits now ignore typed command echoes and YAML hide/show actions execute correctly.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Add dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for unpinned projects and editions from 2026-10-19; earlier editions retain arbitrary hook names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Add safe Doctor migrations for legacy naming patterns and tokens, gated by production before/after identity checks, with guidance for local Atmos schema copies. Improve error rendering, preserve terminal color through wrappers, support global workspace templates, and move hook dispatch logs to Debug.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Add native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version/FIPS, calendar, and CI evidence across all four engines. Add deployment and authentication guardrails plus shared version and date checks.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Require explicit YAML function tags for unpinned configurations and editions from 2026-10-20, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Configurations using edition: "2026-10-19" retain legacy behavior.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Add global --docs, --docs=md/--docs=markdown, and --example command discovery. Help and usage errors show documentation URLs; --docs=md renders fetched Markdown, while --example selects and initializes examples with confirmation, overwrite protection, progress, and noninteractive installation commands.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Add Fogg migration, AWS CDK, and CDK Terrain guides, tutorials, changelog content, and Learn navigation. CloudFormation synthesis hooks now run before generated files are read, with inherited region and duration-based timeout settings and Doctor migrations for legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Add conditional stack imports with when, allowing labels and tags to select optional mixins and identify component instances with selectors such as atmos list instances --tags pci and --labels pci:true. Fix deferred inherited-map rendering beneath YAML function overrides and add tagging and Terraform-file sharing tutorials.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Replace the pre-commit framework with shared YAML and Starlark suites for Git hooks, repository check and format commands, CI, and autofix. The workflow uses native Git sandboxes and atomic writes while preserving staged and unstaged edits when fixes are applied.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Add module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. Add typed YAML/JSON configuration loading and validation through schemas, immutable records, source diagnostics, defaults, constraints, enums, and config1.merge(config2) with configurable list strategies.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Add stdin= to exec.run, component.exec, and all atmos.* wrappers for exact byte input without shell arguments, and add the predeclared os module with getenv, environ, getcwd, platform, arch, setenv, and chdir. Add fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation by default.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Add settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions; the default 1 preserves serial behavior. Results remain in their original positions, outstanding commands are canceled after failure, and --skip=exec and function-policy checks remain supported.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now use each provider's DefaultModel, including the Anthropic model in the disabled-configuration hint, instead of maintaining a separate hardcoded model list.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Restore Terraform destroy, before/after, and per-component hooks for bulk init and test runs, executing them in prepared work directories while preserving resolved paths and credentials for after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Preserve Helm repository credentials, TLS options, and credential-forwarding policy during native chart lookup and render/install or upgrade operations. Populate AWS ambient authentication context while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Resolve inherited metadata.component values before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This keeps displayed component paths consistent with execution and affected-component resolution.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now propagate options such as --skip=secret to dependency evaluations and partition caches by skip list, preventing skipped secret providers from being contacted.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run while preserving existing files.

fix(secret): honor scoped providers during key generation @osterman (#3515)

keygen -s <stack> now resolves stack, component, and type providers without evaluating secret values, including provider-only stacks with imported or templated configuration. Ambiguous provider overrides are rejected, and registered component types participate in filtering and description.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now searches from encrypted files and generates recipient regexes relative to each recipient file directory, including nested .sops.yaml files. Omitted spec.file values derive wildcard rules from the configured secrets directory, with Unix and Windows path separators supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

secret set NAME=value -s <stack> and secret validate -s <stack> now support stack- and globally scoped declarations without requiring an unrelated component. Instance-scoped operations still require a component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack: value to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace container.ports without retaining the 6443/tcp API port. Existing port-list replacement semantics remain unchanged.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal messages now render email autolinks once while preserving explicit Markdown destinations. Documentation clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from existing age private keys without changing private key material or replacing recipient rules. Ambiguous multiple identities are rejected with remediation guidance.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of at least one minute as 34m 47s or 1h 2m 3s, omitting zero units; sub-minute values remain unchanged, and values such as 59.96s round to 1m.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduce security-scanner noise by suppressing 62 Semgrep false positives for same-repository actions and reporting security backlogs by scanner. Upgrade Go to 1.26.10 and patch the Windows runtime dependencies body-parser, fast-uri, and serialize-javascript.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Add AuthenticateIsolated, which authenticates an identity using a separate manager that shares effective configuration, credential store, validator, and realm without changing the caller's chain, stack information, or credentials. Store authentication for AWS, Azure, and GCP now uses this isolated context.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Upgrade github.com/posthog/posthog-go from 1.12.6 to 1.17.4.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Upgrade al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Upgrade golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller.