cloudposse/atmos v1.234.0-nightly.41257944273 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS authentication provider coverage for credential expiration, expiration metadata, identity validation, environment projection without secret leakage, persisted credential loading, invalid credential files, typed missing-credential errors, provider resolution, and idempotent logout cleanup.

feat: add plugin distribution and verification services @osterman (#3457)

Added plugin distribution and trust services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Package verification rejects alias collisions and undeclared archive files, preserves transactional configuration updates, supports compatible variants and offline restores, and handles Windows paths and executables.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Added plugin bootstrap, authoring, build, scaffold, conformance, OIDC, and protocol-generation services. Archive installation now preserves configured entrypoint names and permissions, rejects collisions, and rolls back safely with recovery artifacts when cleanup fails; plugin build supports explicit or all declared targets.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Added command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and preserved source metadata for ordinary and cross-command aliases. Core stack, cloud, CI, configuration, and profile commands now register their discovery metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Added documentation URLs and ordered examples to the remaining supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands can own metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updated the CI failure annotations documentation with a runnable local preview, expected annotation output, and the intentional exit code 77 and early-admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilized quality reporting by selecting the newest CI and Codecov checks, publishing one pending snapshot followed by the final report, recovering unfinished reports and long-running reruns, and avoiding comment edits caused only by a changed summary URL. Reports now group Readiness, Reviews, and Measures and support bounded retries, Windows artifact hosts, REST downloads, local fixtures, and local Atmos Pact execution.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Added runnable examples/cdk-cloudformation and examples/cdk-terraform projects using Atmos components and the local Floci AWS emulator, so the CDK tutorial can be followed without an AWS account. The examples include fresh-on-diff hook behavior, atmos test smoke checks, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Removed incidental logging, redundant approval/init settings, and global auto-approval overrides from copyable Atmos examples while retaining required and intentional configuration demonstrations. Updated quick-start guidance and snapshots to reflect inherited defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconciled bundled skills and command documentation with current behavior, including workflow prerequisites through dependencies.workflows, toolchain aliases, OCI examples, backend inspection, scoped authentication restrictions, retry fields, vendor pinning, and executable component selection. Removed unsupported command examples and corrected stale terminology, links, and guidance.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Added CodeRabbit path instructions encouraging behavior and test logic to live in focused owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumped the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retains the original non-main base branch. Unmerged or unrelated merges still fail validation, and landed stack members retain their release notes.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready PRs whose combined commit status is failure or error, even when the report is current and the commit is more than 24 hours old. Pending statuses and quality:not-ready PRs are not selected; patched website dependencies are also included.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures, pending runs, unknown or shared suite IDs, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Removed the repository root go.mod from the auth-secrets plugin release inputs and bumped that plugin to 1.0.1 once. Changelog posts now display a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes the required cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Added /plugins and /plugins/official documentation pages with quick-start guidance, official package details, and navigation. CI network protection now allows up to 60 seconds for StepSecurity startup and recognizes exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone PRs under the same ordered categories as published release notes, including Breaking Changes, Features, Bug Fixes, and Other Changes, with PRs sorted within each category and their state and summary preserved.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their trigger events, and legacy reports blocked by those runs are re-evaluated once. action_required results now direct users to approve waiting workflow runs instead of opening logs.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can now interpret VHS .tape scripts supplied inline or through tape_file, using mode: steps for typed commands with individual exit codes or mode: session for PTY replay. Added atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus VHS-compatible setup, timing, key, screenshot, and output behavior.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Added atmos stack plan and stack test with native Terraform, Helm, Kubernetes, CloudFormation, Helmfile, and custom-command operations, dependency ordering, hooks, CI reporting, and --dry-run. Lifecycle commands now support --stack, repeated or comma-separated --component, --all, --affected, tags, labels, and interactive selection; added stack list, stack describe, stack instances, and multi-stack stack create --target scaffolding.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Added cast.recorder(...) for Starlark scripts, combining command execution, terminal blocks, assertions, policies, output replacements, and fingerprint-based cast validation. Script steps can load .star, .py, .sh, and .bash files through source:, session waits ignore command echo, YAML session hide/show works, and CI validates committed casts.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Added dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create with planning, hooks, validation, rollback, and recovery guidance. Hook names are validated against registered lifecycle events for unpinned projects and editions from 2026-10-19; older editions retain arbitrary names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Added safe Doctor migrations for legacy naming patterns and tokens, guarded by production before/after identity checks, with guidance for local schema copies. Global workspace templates are supported, terminal color is preserved through wrappers, plain errors no longer contain raw Markdown, and hook dispatch logs move to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enabled the experimental native plugin command family, startup integration, built-in OCI identity, policy checks, and OIDC authentication. Added plugin build --platform and --all-platforms with environment bindings and partial-success reporting, while preserving policy output fields and YAML/JSON compatibility.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Added native OPA and JSON Schema validation engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence across all four engines. Added deployment and authentication guardrails and migration guidance.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Edition 2026-10-19 retains legacy behavior, and quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show copyable documentation URLs. Global --docs prints or opens a command page, --docs=md (or --docs=markdown) fetches and renders Markdown, and --example selects and initializes runnable examples with confirmation, overwrite protection, progress, cancellation, and preserved custom-command flag ownership.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Added Fogg migration, AWS CDK, and CDK Terrain guides and navigation. CloudFormation synthesis hooks now run before generated files are read, with inherited region and duration-based timeout settings and Doctor migrations for legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Stack imports now support conditional when expressions using labels, tags, CI/local facts, and environment variables, and native tags can be selected with atmos list instances --tags or labels with --labels. Import precedence, nested metadata, authentication discovery, and deferred rendering preserve source order and literal values; tagging and shared Terraform-file tutorials were added.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

auth validate --stack with optional --component now validates each selected component's merged authentication configuration while retaining strict global validation. Secret discovery remains lazy, the default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Added consistent --command executable overrides to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Helmfile dry-run behavior, global options, and stderr forwarding were corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Added atmos toolchain aliases to display effective built-in and configured aliases as a sorted table or JSON/YAML mapping, without registry lookup or installation. Added static atmos terraform backend list and describe inspection for merged local configuration, including imports and inheritance without authentication or expression execution.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, CI, autofix, and Git hooks now use a shared YAML/Starlark suite with native Git sandboxes and atomic writes. Fixes preserve staged and unstaged edits, use bounded parallel copying, support terminal-aware test progress, and back up existing hook launchers during forced replacement.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Starlark now supports module.load(path) namespaces and struct(**fields) with cached, frozen, parallel imports and cycle detection. Added typed YAML/JSON configuration loading and validation through stdlib/config, including schemas, defaults, bounds, optional fields, lists, enums, immutable records, source diagnostics, and config.merge with configurable list strategies.

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Added public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. New native release commands support planning, building, signing, verification, public-access checks, catalog synchronization, and all declared platform targets; secrets/store and secrets/env provide scoped secret access and masked environment projection.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Added stdin= to exec.run, component.exec, and all atmos.* wrappers, sending exact bytes without shell expansion or command-line payloads. Added invocation-local os.getenv, os.environ, os.getcwd, os.platform, os.arch, os.setenv, and os.chdir, plus fs.write_file(path, content, overwrite=False, mode=0o600).

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Added settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions; the default 1 preserves serial behavior. Results retain their document positions, policy checks run before commands, failures cancel outstanding work, and --skip=exec remains supported.

Add conditional retries for component error events @osterman (#3542)

Added conditional action: retry policies for component error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators, with predicates, budgets, aliases, schemas, and diagnostics. AWS configuration and credential updates are serialized on Windows, and screengrab recordings stage files on the destination filesystem for atomic publication.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now use each provider's DefaultModel, including the Anthropic model in the disabled-provider example, instead of a separate hardcoded list. This keeps --ai configuration guidance aligned with the models accepted by each provider.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the working directory, while ./ and ../ paths remain relative to the including manifest and absolute paths are used as-is. The working directory remains a final fallback for bare paths, fixing describe affected with rebased checkouts.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Stack-wide terraform_workspace_template is now covered in global metadata documentation and component metadata processing.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Added the canonical pkg/api contracts, standalone native plugin SDK, protocol bindings, transport, manifest and configuration primitives, and Starlark cast integration, while preserving deprecated pkg/automation imports. Native plugin CPU variants now match immutable Atmos build metadata without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Added shared extension descriptors, OCI registry support, and unified authentication and credential handling for the plugin layers. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are prevented, GHCR token priority is preserved, and registry export/import failures receive safer handling.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform lifecycle hooks now run for bulk init and test operations in prepared work directories, including destroy and per-component hooks, with resolved paths and credentials preserved for after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS options, and credential-forwarding policy through chart lookup and render/install or upgrade. AWS ambient authentication context is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Stack function values and literal template text now retain explicit evaluation boundaries through loading, merging, rendering, and output; stack random and cwd evaluation works, and Doctor diagnoses functions in unsupported locations. Plugin archive paths are validated against the host and auth-secrets is bumped to 1.0.2 for its release-input changes.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserved saved plans during inspection and restored single-component destroy CI output. Corrected custom-command argument and identity boundaries, devcontainer ports, MCP exports, schema-directory flags, Ansible paths, workflow directories, retry defaults, SBOM discovery, native Helm rendering, and synchronized CI-mode configuration access.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now sets HELM_DIFF_COLOR=true automatically when Atmos detects color should be enabled and the user has not explicitly set the variable. Explicit component, stack, or shell values continue to take precedence.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updated the downloaded AWS SAML driver Node.js runtime to 24.22.1 and moved the website to the Node 24 LTS line. Patched website dependency overrides and upgraded Go to 1.26.10 for security fixes.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation while preserving explicit overrides, legacy component selection, and disabled metadata inheritance. This fixes component directory resolution and affected-component detection for inherited metadata.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Release tooling now supports six binaries and six Linux packages, atmos release cut --resume for unfinished production releases, and current release-policy and commit-status evidence in Quality Gate. Shared Git hooks select the current checkout's build/atmos executable, with system Atmos fallback for regular clones and linked worktrees.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now preserve evaluation options such as --skip=secret through dependency resolution and partition caches by skip list, preventing skipped secret providers from being contacted.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, so provider-free test modules do not require backend_type; existing backend files are preserved.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves stack, component, and type-scoped providers without evaluating secret values, including provider-only stacks with imports and templates. Ambiguous overrides are rejected and registered component types participate in stack filtering and description.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files and generates matching rules relative to each recipient file. Omitted spec.file values derive wildcard rules from the configured secrets directory, with Unix and Windows separators supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

secret set and secret validate now support stack- and globally scoped declarations without requiring an unrelated component. Instance-scoped operations continue to require a component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace the port list without retaining 6443/tcp, preventing startup with no bound Kubernetes API server port.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Fixed duplicate email autolinks in terminal UI messages and clarified documentation for --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation now recovers a missing public recipient from an existing age private key without changing private material, while preserving existing recipient rules and rejecting ambiguous identities with remediation guidance.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested list indentation, and email text without duplicate addresses. The no-color renderer, status icons, emphasis, code, links, colors, masking, and task routing remain supported.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of a minute or more as 34m 47s or 1h 2m 3s, omit zero units, and round 59.96s to 1m; sub-minute formatting remains unchanged. Local invocation and native CI Terraform summaries use the same formatter.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduced security-scanner noise by suppressing same-repository Semgrep false positives and reporting remaining backlogs by scanner. Updated Go and selected JavaScript dependencies to patched releases and restored Terraform hook test state isolation.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Added isolated authentication for store identities through AuthenticateIsolated, which shares effective configuration and credentials while leaving the caller's identity chain, stack information, and credentials unchanged. Store authentication for AWS, Azure, and GCP now uses this isolated context, preventing store identity resolution from changing subsequent component state or secret access.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changed the default Gemini model to gemini-3.8-flash; the TUI fallback list, --ai setup hints, provider documentation, and function-calling guidance now use that default.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifest and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, including nested_imports: remote, with XDG stack-imports caching and imports.ttl. Missing paths return ErrOCIImportMissingPath, and shared remote-import caching preserves file extensions and refreshes after a source is re-pulled.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens, so atmos ai chat and usage output can show cache reads for OpenAI, Grok, Ollama, Azure OpenAI, and other compatible providers.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible requests now send max_completion_tokens for all o-series models and gpt-6* models, while names such as ollama and other nonnumeric o prefixes continue using max_tokens.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilized CI and deployment behavior by preserving workflow environments, recognizing StepSecurity eBPF enforcement, warming native CI caches with Floci, refreshing AWS credentials before website deployment, and handling already-merged milestone queue entries. Starlark failure and formatting diagnostics are also clearer.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change runs, using shared duration formatting. Aggregate reports and masked summary-file writes are size-limited, with a deduplicated warning recommending --tags or --labels when output would exceed available space.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Bumped github.com/posthog/posthog-go from 1.12.6 to 1.17.4.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updated @types/node from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updated tsx from 4.23.13 to 4.23.15.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Bumped al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updated Prettier from 3.9.9 to 3.9.10.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Bumped golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updated github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Bumped github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, which adds the top-level goquery.Text helper and performance improvements.