cloudposse/atmos v1.234.0-nightly.41150961340 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expand mock AWS authentication coverage for credential expiration, environment projection without secret leakage, validation, identity metadata, provider resolution, persistence, JSON errors, and idempotent logout behavior.

feat: add plugin distribution and verification services @osterman (#3457)

Add plugin distribution and verification services for catalogs, discovery, installation, lockfiles, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive contents and alias collisions are rejected, and configuration updates remain transactional.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Add plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, and output workflows. Archive installation preserves entrypoint names and permissions, rejects collisions, and rolls back incomplete installs with recovery artifacts when cleanup cannot finish.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Add command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and preserved source metadata for aliases.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Register documentation URLs and ordered examples for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Add a runnable local preview to the CI failure annotations documentation, including the expected annotation output, intentional exit code 77, and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilize quality reporting by selecting the newest CI and Codecov results, publishing one pending snapshot followed by the final report, and recovering unfinished reports and long-running reruns. Reports are grouped into Readiness, Reviews, and Measures, with bounded retries and more resilient artifact and dependency handling.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Add runnable CDK examples for CloudFormation and Terraform using the local Floci AWS emulator, so the tutorials require no AWS account. The examples include hook freshness settings, smoke tests, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Remove incidental logging, redundant approval and initialization settings, and global auto-approval overrides from copyable Atmos examples while retaining required configuration and intentional demonstrations. Refresh quick-start guidance and config-output snapshots for the inherited Warning log level.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconcile bundled skill examples and command documentation with current behavior, including dependencies.workflows, toolchain aliases, ECR login, retry fields, vendor pinning, Ansible introspection, themes, authentication, and scoped-auth restrictions. Remove unsupported command examples and correct OCI guidance to accept any image.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Add CodeRabbit path instructions encouraging touched behavior and tests to be extracted into their owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bump the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Update release tooling to recognize merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retains the original parent branch as the PR base.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

Make the scheduled Quality Gate reconciler re-evaluate quality:ready pull requests whose combined head status is failure or error, even when the report is current and the commit is older than 24 hours.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Make Quality Gate select the newest run when multiple executions of the same workflow target one commit, using creation time and run ID. Checks from superseded GitHub Actions suites are excluded only when their suite ID proves the association; current failures, pending runs, external checks, and synthetic merge checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Stop treating the repository root go.mod as an auth-secrets plugin release input and bump that plugin to 1.0.1 once. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes its cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Add /plugins and /plugins/official documentation pages with quick-start and official package guidance. StepSecurity diagnostics now allow up to 60 seconds for network protection startup and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Group release preview issues by the same categories and order used by published release notes, sorting pull requests by number within each category while preserving each preview entry's state and summary.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

Add VHS tape interpretation to type: cast steps through inline tape: or .tape tape_file: sources, with steps and PTY-backed session modes, supported VHS directives, shell setup handling, screenshots, and safe output behavior. Add atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable clean-shell initialization.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Add atmos stack plan and stack test with native Terraform, Helm, Kubernetes, CloudFormation, and Helmfile operations, custom command support, dependency ordering, CI reporting, and --dry-run. Add stack and component selectors for lifecycle commands, stack introspection commands, and multi-stack stack create --target directory scaffolding.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Add cast.recorder(...) for Starlark scripts, combining command execution and cast generation with PTY blocks, assertions, policies, replacements, and fingerprint validation. Add source: support for script files, correct session wait and hidden-output behavior, and a Validation (casts) workflow for committed recordings.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Add dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against lifecycle events for current editions, while scaffold planning preserves failure context and reports stale generation records with recovery guidance.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Add safe Doctor migrations for legacy naming patterns and tokens, guarded by production before-and-after identity checks. Improve nested error rendering, preserve terminal color through wrappers, support global workspace templates, and move hook dispatch logs to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enable native plugin commands, startup integration, built-in OCI identity, policy checks, OIDC authentication, and multi-platform plugin build with --platform and --all-platforms. Preserve policy output compatibility and add JSON/YAML report handling for embedded objects and omitted fields.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Add native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence across all four engines.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Require explicit YAML function tags for unpinned configurations and editions from 2026-10-20, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Configurations with edition: "2026-10-19" retain legacy behavior.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Add command discovery through --docs, --docs=md (or --docs=markdown), and --example. Help and usage output show documentation URLs; Markdown can be fetched and rendered, while examples can be selected, confirmed, and initialized through atmos init, including outside a valid project.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Add Fogg migration and AWS CDK/CDK Terrain tutorials, plus Learn navigation and an agent skill reference. CloudFormation synthesis hooks now run before generated files are read, with inherited region and duration-based timeout settings and Doctor migrations for legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Add conditional stack imports using when conditions over native labels, tags, CI facts, local facts, and environment variables, with selectors such as --tags and --labels. Fix deferred rendering so overridden templates and list elements are resolved only after merge precedence is applied, and add tagging and shared Terraform-file tutorials.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Add auth validate --stack with optional --component validation of each selected component's merged authentication configuration while retaining strict global validation. Preserve lazy secret discovery, support default GCP ADC configuration, and repair the first SOPS write after key generation.

Generalize component executable overrides and execution flags @osterman (#3488)

Add consistent --command executable overrides to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Repair Helmfile dry-run behavior, global options, and stderr forwarding.

Fix source handling and add backend and alias inspection @osterman (#3490)

Add atmos toolchain aliases to display effective built-in and configured aliases as sorted table or JSON/YAML output, and add static atmos terraform backend list and describe inspection without authentication or expression execution. Also repair related init, registry, Git, version-manager, vendor, OCI whiteout, and source-query behaviors.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Replace the pre-commit framework with shared YAML/Starlark Git hooks and repository check, format, CI, and autofix commands using native Git sandboxes and atomic writes. Fixes preserve staged and unstaged edits and document the new workflow.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Add module.load(path) and struct(**fields) to Starlark automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. Add typed stdlib/config loading and validation for YAML/JSON documents and schemas, immutable records with source diagnostics, and config1.merge(config2) with configurable list strategies.

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Add public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Provide secrets/store and secrets/env, built-in catalog configuration, native release and verification commands, and workflows that build, sign, verify, publish, and reconcile packages across declared platforms.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Add stdin= to exec.run, component.exec, and atmos.* wrappers, sending exact bytes without shell interpolation or command-line payloads. Add the predeclared os module with getenv, environ, getcwd, platform, arch, setenv, and chdir, plus fs.write_file(path, content, overwrite=False, mode=0o600).

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Add settings.functions.exec.max_concurrency to bound parallel evaluation of ordinary !exec expressions, defaulting to serial execution with 1. Results retain their document positions, policy checks run before commands, failures cancel outstanding work, and --skip=exec remains supported.

Add conditional retries for component error events @osterman (#3542)

Add conditional action: retry policies for component error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators, with predicates, budgets, aliases, schemas, and diagnostics. Serialize AWS credential and configuration updates on Windows and stage screengrabs on the destination filesystem for atomic publication.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

Make atmos <cmd> --ai setup hints and provider configuration examples use each provider's DefaultModel, preventing stale or invalid model IDs from being suggested.

fix(include): resolve base_path before the working directory @djal (#3426)

Resolve bare !include and !include.raw paths relative to base_path before the working directory, while keeping ./ and ../ paths relative to the including manifest and using the working directory only as a final fallback for bare paths. This makes describe affected detect changes in base-path-relative includes across rebased checkouts.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Document terraform_workspace_template as a supported stack-wide metadata field and cover its propagation into Terraform component metadata.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Establish shared Atmos API contracts, the standalone Go plugin SDK, protocol bindings, native transport, and manifest/configuration primitives while preserving existing pkg/automation imports through deprecated aliases. Native plugins select compatible CPU variants using immutable build metadata, and installed toolchain binaries remain identical when content is unchanged.

fix: unify credential handling and OCI registry access @osterman (#3456)

Add shared extension-registry, OCI registry, authentication, credential, policy, and configuration primitives for the plugin stack. Credential publication and logout cleanup are serialized, nested registry authentication avoids deadlocks, GHCR token priority is preserved, and OCI export/import failures receive safer handling.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Restore Terraform destroy, bulk init, bulk test, and per-component lifecycle hooks, running them in prepared work directories with resolved paths and credentials preserved for after-hooks. Scope tool-version discovery to each project's configuration and ensure test fixtures start before emulator authentication.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Preserve Helm repository credentials, TLS options, and credential-forwarding policy across native render, install, upgrade, and chart lookup operations. Populate AWS ambient authentication context while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserve literal YAML values through loading, merging, templates, and output while enabling stack random and cwd evaluation; Doctor now diagnoses functions in unsupported locations. Raw YAML shielding no longer affects decoded command arguments or import paths, and plugin archive inventories validate host-local paths.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserve saved plans during inspection and restore single-component destroy CI output. Correct custom-command boundaries, devcontainer ports, MCP exports, schema-directory flags, Ansible and workflow paths, retry defaults, SBOM discovery, and native Helm rendering and repository handling.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Upgrade the downloaded AWS SAML driver runtime to Node.js 24.22.1, move the website to the Node 24 LTS line, patch website dependency overrides, and update Go to 1.26.10 for certificate-verification security fixes.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Resolve inherited metadata.component directories before backend generation while preserving explicit overrides, legacy component selection, and disabled metadata inheritance. This prevents execution from using an instance name when inherited metadata specifies a module path.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Reduce releases to six binaries and six Linux packages, with source installation documented for retired targets. Add resumable atmos release cut --resume, current release-policy and status evidence in Quality Gate, accurate Git sandbox comparisons, and checkout-aware shared Git hook launchers.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Propagate --skip options, including --skip=secret, through nested Terraform output and state lookups and partition caches by skip list, preventing dependency evaluation from contacting skipped secret providers.

fix(terraform): run tests without generating a backend @osterman (#3514)

Skip backend-file generation during Terraform tests when auto_generate_backend_file is enabled, preserving existing files and allowing provider-free test modules to run without backend_type.

fix(secret): honor scoped providers during key generation @osterman (#3515)

Make secret keygen -s <stack> resolve stack, component, and type-scoped providers without evaluating secret values, including provider-only stacks. Ambiguous overrides are rejected, registered component types participate in filtering, and explicit missing selections still fail.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

Fix SOPS discovery for nested .sops.yaml recipient files by searching from the encrypted file and generating rules relative to the recipient file directory. Omitted spec.file values now derive wildcard rules from the configured secrets directory, with Unix and Windows separators supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

Allow secret set and secret validate to operate on stack- and globally scoped declarations without requiring an unrelated component, while retaining the component requirement for instance-scoped operations.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Pass a custom Atmos step's rendered stack value to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit flags such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Validate that Kubernetes emulator specifications retain the 6443/tcp API port before startup, preventing configurations that replace container.ports without a usable Kubernetes API endpoint.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Ensure email autolinks appear once in terminal UI messages and clarify --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

Recover a missing SOPS public recipient from an existing age private key without changing private key material. Preserve existing and explicit recipient rules, and reject ambiguous multiple identities with remediation guidance.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Preserve Markdown list markers and layout in Starlark ui.info, ui.success, and ui.warning messages, including nested and wrapped lists, while rendering terminal email autolinks only once.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Format resource-usage durations through duration.Format, showing minute- and hour-scale values as 34m 47s or 1h 2m 3s while retaining concise sub-minute output. Values such as 59.96s round to 1m instead of 60.0s.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Suppress Semgrep false positives for same-repository actions, report security backlogs by scanner, and patch Go, Node, and JavaScript dependencies. Restore Terraform hook test state to prevent shuffled-suite failures.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Add AuthenticateIsolated to authenticate an identity through a separate manager without changing the caller's chain, stack information, or credentials. Store authentication for AWS, Azure, and GCP now uses this isolated context, preventing a store identity from affecting subsequent component state or secret reads.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Change the default Gemini model to gemini-3.8-flash and update TUI hints, --ai setup guidance, and provider documentation to match.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Support oci://host/repo:tag//path imports in stack manifests and atmos.yaml, including files, directories, globs, and nested_imports: remote, with XDG stack-imports caching and imports.ttl. Missing paths return ErrOCIImportMissingPath, and remote-import caches now preserve extensions and refresh after source re-pulls.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

Report cached prompt tokens for OpenAI-compatible providers by mapping usage.prompt_tokens_details.cached_tokens to Usage.CacheReadTokens, so atmos ai chat and executor usage output can show cache reads.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

Send max_completion_tokens instead of max_tokens for OpenAI-compatible o-series models and gpt-6* models, while retaining max_tokens for unrelated names such as ollama.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilize CI and script workflows by preserving environments, recognizing StepSecurity eBPF enforcement, warming native CI caches with Floci, refreshing AWS credentials before website deployment, and handling already-merged milestone queue entries. Clarify intentional Starlark failures and formatting guidance.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Restore template-based summaries for every executed bulk Terraform plan component, including no-change runs, and use shared duration formatting. Aggregate reports and masked summary-file writes are bounded, with a deduplicated warning recommending --tags or --labels when output exceeds available space.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Update the github.com/posthog/posthog-go dependency from 1.12.6 to 1.17.4.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Update the website's @types/node dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Update the tsx dependency from 4.23.13 to 4.23.15.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Update al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Update the website's Prettier dependency from 3.9.9 to 3.9.10.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Update golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Update github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Update github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, including the new top-level goquery.Text helper and performance improvements.