cloudposse/atmos v1.234.0-nightly.40795840633 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS auth provider coverage for credential expiration, expiration metadata, identity validation, environment projection, persistence, loading, invalid credentials, and idempotent logout behavior.

feat: add plugin distribution and verification services @osterman (#3457)

Added plugin distribution and trust services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, configuration updates remain transactional, and compatible variants are preserved for installation, cache verification, signatures, and offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Added plugin bootstrap and authoring services, including SDK documentation and protobuf includes, configuration-driven build/scaffold/conformance commands, OIDC templates, standalone dependency preparation, and signed output. Archive installation now preserves entrypoint names and permissions and rolls back safely, retaining recovery artifacts when cleanup cannot complete.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Added command-owned documentation URLs and ordered example metadata to the command registry, with backward-compatible registration options. Metadata inheritance and alias behavior preserve each command's source information across the core command tree.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Registered documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands can own metadata, while commands without dedicated pages inherit their parent's documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updated the CI failure annotations documentation with a runnable local preview, expected annotation output, intentional exit code 77 behavior, and an explanation of early admission.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilized quality reporting by selecting the newest CI and Codecov results, publishing one pending snapshot followed by the final report, and recovering unfinished reports and long-running reruns. Reports now group evidence into Readiness, Reviews, and Measures, while CI retries, artifact downloads, mirrors, release fixtures, and Pact execution use more reliable behavior.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Added runnable CDK examples for CloudFormation and Terraform/CDK Terrain using the local Floci AWS emulator, so both tutorials work without an AWS account. The examples include synth hooks with per-step freshness, smoke tests, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Cleaned up 57 copyable Atmos examples by removing incidental logging, redundant approval and initialization settings, and global auto-approval while retaining required and intentional configuration. Updated quick-start guidance and snapshots now reflect inherited logging defaults.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Added CodeRabbit path instructions encouraging domain logic and tests to be extracted from legacy catch-all packages into focused owning packages, using thin adapters where necessary.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumped the Claude Code plugin to version 1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack PRs when their merge commits are present in the verified release range, even if GitHub retains the original parent branch as the PR base. Unmerged and unrelated merges still fail validation, and included PRs continue to require release labels and milestones.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now rechecks a quality:ready PR when its combined head status is failure or error, even if the report is current and the commit is more than 24 hours old. Pending statuses and quality:not-ready PRs are not selected.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when several runs target the same commit, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures, pending runs, unknown suites, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Plugin release inputs no longer treat the repository root go.mod as an auth-secrets build input, and the plugin is bumped to 1.0.1. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes its cast metadata.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can now interpret VHS tapes supplied inline or through tape_file, in steps or interactive session mode, without requiring VHS or writing generated YAML. Added atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable clean shell startup, screenshots, waits, terminal controls, and VHS-compatible setup behavior.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Added atmos stack plan and stack test with native component plans, Terraform tests, custom capabilities, dependency ordering, hooks, CI reporting, and --dry-run. Lifecycle commands now support --stack, --component, repeated or comma-separated selectors, --all, --affected, tags, labels, and interactive selection; stack list, describe, and instances provide stack introspection, while stack create --target can generate multiple stack directories.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Added cast.recorder(...) for Starlark scripts, combining command execution and cast generation with PTY blocks, setup and cleanup groups, assertions, policies, replacements, and fingerprint validation. Script steps can load local sources by extension, session waits no longer match typed echo, and a Validation (casts) CI job validates all committed casts.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Added dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for current editions, while scaffold planning, failure reporting, stale-generation recovery, and existing aliases remain supported.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Added safe Doctor migrations from legacy naming patterns and tokens to templates, guarded by production before-and-after identity checks. Improved nested error rendering, preserved terminal color through wrappers, separated metadata explanations from actionable hints, and moved hook dispatch logs to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enabled the experimental native plugin command family, startup integration, built-in OCI identity, policy checks, and OIDC authentication. Added plugin build --platform and --all-platforms with environment bindings and partial-success reporting, while preserving policy output compatibility and YAML field structure.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Added native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence across all four engines. Added deployment and authentication guardrails plus migration and reference documentation.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templating, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19", while quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Added command discovery through --docs, --docs=md/--docs=markdown, and --example. Help and usage errors show documentation URLs; Markdown can be fetched and rendered; examples can be selected, confirmed, and initialized through atmos init, including overwrite protection, cancellation, progress, and behavior outside a valid project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Added Fogg migration, AWS CDK, and CDK Terrain guides, plus CloudFormation synthesis improvements. Synthesis hooks run before generated files are read, and inherited region and duration-based timeout settings now support Doctor migrations and legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Added conditional stack imports using when, with native labels and tags available to CLI selectors such as atmos list instances --tags pci and --labels pci:true. Import decisions respect ordered metadata precedence and unavailable values, while deferred inherited-map rendering now applies merge precedence before evaluating templates and YAML functions.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks now run through a shared YAML/Starlark suite for Git hooks, check and format commands, CI, and autofix, using Git sandboxes and atomic writes. Staged and unstaged edits are preserved when fixes are returned, and installed launchers are safely backed up during replacement.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Added module.load(path) and struct(**fields) to automation scripts with cached, frozen module exports, cycle detection, cancellation, and parallel loading. Added typed YAML/JSON configuration loading and validation with schemas, defaults, bounds, optional fields, enums, source diagnostics, immutable records, and config1.merge(config2).

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Added public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. New native commands manage release planning, builds, signing, verification, public access, and catalog synchronization; secrets/store and secrets/env provide scoped secret access and environment projection with masking, expiry, cycle checks, and logout.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Added stdin= to exec.run, component.exec, and atmos.* wrappers for exact byte input without shell or argument exposure. Added invocation-scoped os.getenv, os.environ, os.getcwd, os.platform, os.arch, os.setenv, and os.chdir, plus fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation and permission-preserving overwrites.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Added settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions, with a default of 1. Results retain their document positions, policy checks occur before execution, failures cancel outstanding commands, and --skip=exec behavior is preserved.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now use each provider's configured DefaultModel, including the Anthropic model in the “AI not enabled” example, instead of maintaining a separate hardcoded list. The hints therefore track provider-supported defaults for Anthropic, Bedrock, Gemini, Ollama, and Grok.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the working directory, while ./ and ../ paths remain relative to the including manifest and absolute paths are used as-is. The working directory remains a last resort for bare paths, fixing describe affected comparisons across rebased worktrees.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Global terraform_workspace_template metadata is now covered in stack processing and documented alongside terraform_workspace_pattern.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Added the shared Atmos API contracts, standalone Go plugin SDK, protocol bindings, native transport, and manifest/configuration primitives while preserving existing pkg/automation imports through deprecated aliases. Native plugins now select compatible CPU variants from immutable build metadata, and installed binaries retain atomic replacement and symlink protections.

fix: unify credential handling and OCI registry access @osterman (#3456)

Added extension descriptors and shared OCI registry services, unified built-in authentication and credential handling, and serialized credential publication and provider logout cleanup. Registry authentication preserves GHCR token priority and avoids nested deadlocks, while OCI export/import failures and bound-identity authentication receive safer handling.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform bulk init and test runs now execute destroy, before, after, and per-component lifecycle hooks in prepared work directories while preserving resolved paths and credentials. Tool-version discovery is scoped to each project's configuration, and test fixtures can start before emulator authentication without being overwritten.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS settings, and credential-forwarding policy during chart lookup and installation. AWS ambient authentication context is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation, while explicit overrides, legacy component selection, and disabled metadata inheritance remain supported. This fixes component descriptions, affected lookups, nested inheritance, validation, and backend prefixes that previously used an instance name during execution.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Releases now publish six binaries and six Linux packages, with prebuilt Linux 386, 32-bit ARM, and FreeBSD downloads retired. atmos release cut --resume can recover unfinished production releases, Quality Gate uses current policy and status evidence, and shared Git hooks select the current checkout's build/atmos or build/atmos.exe.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now preserve evaluation options such as --skip=secret, preventing dependency components from contacting skipped secret providers. Caches are partitioned by skip list so results from different evaluation modes do not overlap.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run without backend_type and preserving existing backend files.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves providers from the selected stack and component/type scope without evaluating secret values, including provider-only stacks with imported or templated configuration. Ambiguous provider overrides and invalid explicit selections are rejected, while registered component types participate in filtering and description.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now searches from the encrypted file for nested .sops.yaml files and generates recipient rules relative to the recipient file directory. Omitted spec.file values derive wildcard rules from the configured secrets directory, with Unix and Windows separators supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

secret set and secret validate now support stack- and globally scoped declarations without requiring an unrelated component. Instance-scoped operations continue to require a component, and inherited shared declarations are validated consistently.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom Atmos steps with stack: dev now pass -s dev to child commands unless an explicit stack flag is already present, including attached short forms such as -sprod; the flag is inserted before passthrough --. Workflow execution follows the same behavior.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes containers whose overridden port list omits 6443/tcp, preventing startup with no bound Kubernetes API server port. Existing port-list replacement semantics remain unchanged.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

ui.info now renders email autolinks once while preserving explicit Markdown destinations. Documentation clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving existing recipient rules and explicit recipients. Multiple ambiguous identities are rejected with remediation guidance.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage durations now use duration.Format: values of at least a minute display as units such as 34m 47s or 1h 2m 3s, while sub-minute values retain millisecond or decimal-second formatting. The local invocation and Native CI Terraform summaries now use the same formatter.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduced security scanner noise by suppressing 62 false positives for same-repository actions and reporting security backlogs by scanner. Updated Go to 1.26.10 and patched Windows runtime dependencies, while restoring Terraform hook test state between runs.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Added AuthenticateIsolated to authenticate a store identity on a separate manager without changing the caller's chain, stack information, or credentials. AWS, Azure, and GCP store bridges now use the isolated context, preventing store secret resolution from changing the identity used by subsequent component state or secret lookups.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifests and atmos.yaml imports now support oci://host/repo:tag//path sources for files, directories, and globs, including nested_imports: remote. OCI artifacts are pulled once per invocation and cached under XDG stack-imports with imports.ttl; missing paths return a dedicated error, and shared Git/OCI cache copies retain extensions and refresh after repulling.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updated github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for feature-flag retries, event property handling, capture error reporting, and capture-v1 compression support.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updated al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updated golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.