cloudposse/atmos v1.234.0-nightly.40981497086 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS authentication provider coverage for credential expiration, expiration accessors, environment projection without secret leakage, validation, identity metadata, provider selection, credential-file paths, environment preparation, persisted credential loading, invalid JSON, missing credentials, logout, and idempotent deletion.

feat: add plugin distribution and verification services @osterman (#3457)

Adds plugin distribution and trust services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, configuration updates remain transactional, and compatible variants are preserved for installation, cache verification, signatures, and frozen offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Adds plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, and output workflows. Archive installation preserves configured entrypoint names and permissions, rejects collisions, and rolls back incomplete installs while retaining recovery artifacts when cleanup cannot finish.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Core command registration can now own documentation URLs and ordered examples through backward-compatible metadata options. Documentation and example lists inherit independently, and aliases retain the metadata of their source commands.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Adds documentation URLs and ordered examples to supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands register their own metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updates the CI failure annotations changelog and policy example README with a runnable local preview, expected annotation output, intentional exit code 77, and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Quality reporting now selects the newest CI and Codecov checks, publishes one pending snapshot followed by the final report, and recovers unfinished reports and active reruns beyond 24 hours. Reports are grouped into Readiness, Reviews, and Measures, while race-shard retries, Windows artifact hosts, local fixtures, and local Atmos Pact execution are supported.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Adds runnable examples/cdk-cloudformation and examples/cdk-terraform applications using the native CloudFormation and Terraform components against the local Floci AWS emulator, without requiring an AWS account. Each example includes a kind: steps synth hook with per-step freshness and an atmos test smoke check, and is linked from the CDK tutorial.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Cleans up 57 copyable Atmos examples by removing incidental logging, redundant approval and initialization settings, and global auto-approval overrides while retaining required configuration and intentional demonstrations. Quick-start guidance and generated config snapshots are updated for the current inherited Warning log level.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Adds CodeRabbit path instructions encouraging focused extraction of touched behavior and tests into owning packages, with thin adapters where necessary.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumps the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retains the original parent branch as the PR base. Unmerged, unrelated, or otherwise invalid PRs continue to fail release validation.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates a quality:ready PR when its combined commit status is failure or error, even if the report is current and the commit is more than 24 hours old. quality:not-ready PRs and pending statuses are not selected.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures and pending runs, unknown or shared suite IDs, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Removes the repository root go.mod from the auth-secrets plugin release inputs and bumps auth-secrets to 1.0.1. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes the cast and castTitle metadata required for its timeline card.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can interpret VHS tapes supplied inline with tape: or from .tape files with tape_file:, without invoking vhs or writing generated YAML. mode: steps produces executable shell steps with individual exit codes, while mode: session replays interactive PTY behavior including waits, screenshots, keypresses, and shell setup.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Adds dependency-aware atmos stack plan and stack test, selectors for --stack, --component, --all, and --affected, and introspection through stack list, stack describe, and stack instances. --dry-run previews plans, tests, and hooks without execution, while stack create --target can generate one or multiple decomposed stack directories with independent validation and rollback.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Adds cast.recorder(...) for Starlark scripts, combining command execution, terminal interactions, assertions, policies, replacements, cast generation, and read-only fingerprint validation. type: script steps can load local .star, .py, .sh, and .bash files through source:, and casts validate all is backed by CI reachability and terminal checks.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Adds dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for unpinned projects and editions from 2026-10-19, while earlier editions retain arbitrary hook names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Adds safe Doctor migrations from legacy naming patterns and tokens to templates, gated by production before-and-after identity checks. Plain errors no longer contain raw Markdown, terminal color is preserved through wrappers, metadata explanations are separated from actionable hints, and hook dispatch logs move to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enables the experimental native plugin command family, startup integration, built-in OCI identity, CLI policy checks, and OIDC authentication. Adds plugin build --platform and --all-platforms with environment bindings and partial-success reporting, while preserving policy output field names and YAML/JSON compatibility.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Adds native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version/FIPS, calendar, and CI evidence across all four engines. Deployment and authentication guardrails and shared version/date checks are included.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Quoted strings such as "!env SOMETHING" remain literal, while legacy behavior is retained with edition: "2026-10-19".

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show copyable documentation URLs, with global --docs to print or open them and --example to select and initialize an example. --docs=md/--docs=markdown fetches and renders Markdown with bounded downloads, progress, cancellation, and resolved relative links, while discovery works before normal validation and outside an Atmos project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Adds Fogg migration, AWS CDK, and CDK Terrain guides and tutorials. CloudFormation synthesis hooks now run before generated files are read, with inherited region and duration-based timeout settings plus Doctor migrations for legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Adds conditional stack imports through when, allowing labels and tags to select optional mixins and identify component instances for selectors such as atmos list instances --tags pci and --labels pci:true. It also fixes deferred inherited-map rendering beneath YAML function overrides so replaced values are not rendered prematurely.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Adds auth validate --stack with optional --component to validate each selected component's merged authentication configuration while retaining strict global validation. Secret discovery remains lazy, the default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Adds consistent --command support to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and command-line precedence. Helmfile dry-run behavior, global options, and stderr forwarding are also corrected.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Replaces the pre-commit framework with a shared YAML/Starlark suite for Git hooks, repository check and format commands, CI, and autofix. Native Git sandboxes, atomic writes, staged and unstaged edit preservation, bounded parallel copying, and terminal-aware progress are included.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Adds module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. The new stdlib/config package provides typed YAML/JSON loading, local or HTTPS JSON Schema validation, immutable records, source diagnostics, defaults, bounds, enums, and config1.merge(config2) with configurable list strategies.

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Adds public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Native commands now cover plugin release, release plan, test --build --coverprofile, verify-public, and catalog sync --inventory, while secrets/store and secrets/env provide scoped secret access and masked environment projection.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Adds stdin= to exec.run, component.exec, and all atmos.* wrappers, sending exact bytes without a shell or command-line payload. The predeclared os module provides getenv, environ(), getcwd, platform, arch, invocation-local setenv and chdir, and fs.write_file(path, content, overwrite=False, mode=0o600) supports exclusive creation and permission-preserving overwrite.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Adds settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions, with a default of 1. Results retain their document positions, outstanding commands are cancelled after failure, policy checks occur before execution, and --skip=exec behavior is preserved.

Add conditional retries for component error events @osterman (#3542)

Adds action: retry policies with scalar, list, wildcard, predicate, alias, and retry settings across supported component types and emulators, while preserving cancellation, Terraform exit codes, and existing fallback behavior. AWS config and credential updates are serialized on Windows, and screengrab recordings stage temporary files on the destination filesystem for atomic publication.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now take each provider's model from its DefaultModel, including the Anthropic model shown when AI is not enabled, instead of maintaining a separate hardcoded list. Hints therefore track provider default changes and no longer suggest retired or invalid model IDs.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the working directory, while ./ and ../ paths remain strictly relative to the including manifest. The working directory remains a last resort for bare paths, improving atmos describe affected detection when included files are rebased into another checkout.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Stack-wide terraform_workspace_template is now covered in component metadata, and the metadata documentation lists it alongside terraform_workspace_pattern.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Establishes the shared pkg/api contracts, standalone Go plugin SDK, protocol bindings, native transport, and manifest/configuration primitives while preserving deprecated pkg/automation imports. Native plugins select compatible CPU variants using immutable Atmos build metadata without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Adds shared extension-registry descriptors, unified authentication construction, OCI registry support, and policy/configuration primitives. Credential publication and provider logout cleanup are serialized, nested registry-auth deadlocks are prevented, and GHCR token priority is preserved.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform lifecycle hooks now run in prepared work directories for bulk init and test operations, including destroy and per-component hooks, with resolved paths and credentials available to after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm render, install, and upgrade chart lookup now preserve repository credentials, TLS options, and credential-forwarding policy. AWS ambient authentication context is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Stack function values and literal template text now remain explicit through loading, merging, templates, and output, while stack random and current-working-directory evaluation is supported. Doctor diagnoses functions in unsupported locations, and raw YAML shielding no longer affects decoded command arguments or import paths.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updates the downloaded AWS SAML driver runtime and website toolchain to Node 24.22.1, moves the website from Node 25 to the Node 24 LTS line, and upgrades Go to 1.26.10. Patched dompurify, launch-editor, and follow-redirects overrides are also applied.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component directories are now resolved before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This fixes component execution paths and affected-component detection for inherited metadata.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Release builds now publish six binaries and six Linux packages, retiring prebuilt Linux 386, 32-bit ARM, and FreeBSD downloads. atmos release cut --resume can recover unfinished production releases, and shared Git hook launchers select the current checkout's build/atmos or build/atmos.exe before falling back to the system binary.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now propagate evaluation options such as --skip=secret and partition caches by skip list, preventing dependency lookups from contacting skipped secret providers.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, so provider-free test modules do not require backend_type. Existing backend files are preserved.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves stack, component, and type providers without evaluating secret values, including provider-only stacks with imported or templated configuration. Ambiguous provider overrides and unmatched explicit selections are rejected.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now searches from the encrypted file for nested .sops.yaml files and generates matching rules relative to each recipients file, supporting relative and absolute paths, custom secret directories, and both Unix and Windows separators. Omitted spec.file values derive wildcard rules from the configured secrets directory.

fix(secret): allow stack secrets without a component @osterman (#3517)

secret set and secret validate now support stack- and globally scoped declarations without requiring an unrelated component. Instance-scoped operations continue to require a component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit flags such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace the port list without retaining 6443/tcp, preventing startup with no bound Kubernetes API server port.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal email autolinks are rendered once instead of twice, while explicit Markdown destinations remain unchanged. Documentation clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material. Existing recipient rules and explicit recipients are preserved, while ambiguous multiple identities produce a remediation error.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of a minute or more as 34m 47s or 1h 2m 3s, omitting zero units; sub-minute values retain formats such as 800ms and 45.2s. The local Total for this invocation summary and Native CI Terraform summary now use the shared duration.Format behavior.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduces Semgrep noise for same-repository actions, reports security backlogs by scanner, and documents remaining findings. Go is upgraded to 1.26.10, dependency patches are applied for body-parser, fast-uri, and serialize-javascript, and Terraform hook test state is restored between runs.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Adds AuthenticateIsolated to authenticate an identity using a separate manager that shares effective configuration, credential store, validator, and realm without changing the caller's chain, stack information, or credentials. Store authentication for AWS, Azure, and GCP now uses this isolated context, preventing store identity resolution from changing subsequent component state or secret lookups.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changes the default Gemini model to gemini-3.8-flash; the TUI fallback provider list and --ai setup hints follow automatically. The function-calling hint and AI provider documentation now use the new model.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifests and atmos.yaml imports now support oci://host/repo:tag//path sources for files, directories, and globs, including nested_imports: remote. OCI artifacts are pulled once per invocation into the XDG stack-imports cache and honor imports.ttl; missing paths return ErrOCIImportMissingPath with a hint.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible response parsing now reports cached prompt tokens from usage.prompt_tokens_details.cached_tokens in Usage.CacheReadTokens, so atmos ai chat and executor usage output show cache reads for OpenAI, Grok, Ollama, Azure OpenAI, and other compatible providers.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updates github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for duplicate distinct_id flag properties and retries for transient feature-flag request failures.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updates the development dependency @types/node from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updates the tsx dependency from 4.23.13 to 4.23.15, including fixes for bare built-in namespace inheritance, CommonJS require.cache and require.extensions exposure, and portable namespaced register() declarations.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updates al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updates Prettier from 3.9.9 to 3.9.10, including a Markdown table parsing fix through the micromark-extension-gfm-table update.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updates golang.org/x/tools from 0.51.0 to 0.52.0, including dependency, gopls, SSA, declaration-movement, and cache improvements.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updates github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3, including the smithy-go sparse-in-dense fix and regenerated AWS clients and API models.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updates github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, adding the top-level goquery.Text helper and performance improvements.