cloudposse/atmos v1.234.0-nightly.42430747668 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS auth provider coverage for credential expiration, expiration metadata, environment projection without secret leakage, validation, identity metadata, provider resolution, credential-file lifecycle, persisted JSON errors, logout, and missing-credential handling.

feat: add plugin distribution and verification services @osterman (#3457)

Adds plugin distribution and verification services for catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, configuration updates remain transactional, and compatible variants are preserved across installation, cache verification, signatures, and offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Adds plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, protocol-generation, and output-formatting support. Plugin installation preserves configured command names and permissions, rejects collisions, and rolls back incomplete installs while retaining recovery artifacts when cleanup cannot finish.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Adds command-owned documentation URLs and ordered example metadata to the CLI command registry, with independently inherited documentation and examples. Core stack, cloud, CI, configuration, and profile commands now register their discovery metadata, while aliases retain their source metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Adds documentation URLs and ordered examples to the remaining supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updates the CI failure annotations documentation with a runnable local preview, expected annotation output, and an explanation of exit code 77 and early admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Quality reporting now selects the newest CI and Codecov checks, publishes a pending snapshot followed by the final report, and recovers unfinished reports and active reruns beyond 24 hours. Reports are grouped into Readiness, Reviews, and Measures, while retries, artifact downloads, Ubuntu mirrors, release fixtures, and Pact execution are made more resilient.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Adds runnable examples/cdk-cloudformation and examples/cdk-terraform projects using the native CloudFormation and Terraform components against the local Floci AWS emulator. Each includes a kind: steps synth hook with per-step freshness, an atmos test smoke check, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Cleans up 57 copyable Atmos examples by removing incidental logging, redundant approval and initialization settings, and global caching auto-approval while retaining required configuration and intentional demonstrations. Quick-start guidance and generated configuration snapshots now reflect inherited defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconciles bundled skill examples and command documentation, including workflow prerequisites through dependencies.workflows, toolchain aliases, ECR login, retry fields, vendor pinning, Ansible introspection, theme commands, authentication, component executable selection, and backend inspection. Unsupported vendor pull --version and component/workflow --format tree examples are removed.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Adds CodeRabbit path instructions encouraging touched behavior and tests to be extracted into their owning packages, with thin adapters where necessary.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Updates the Claude Code plugin to version v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retained the original parent branch as the PR base. Unmerged or unrelated commits still fail validation.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates a quality:ready PR when its combined commit status is failure or error, even if the report is current and the commit is older than 24 hours. quality:not-ready PRs and pending statuses are not selected.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks only when their check-suite ID proves they belong to a superseded run. Current failures and pending runs, unknown suites, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

The auth-secrets plugin release no longer treats the repository root go.mod as a build input and is bumped to version 1.0.1. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post includes its cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Adds /plugins and /plugins/official documentation pages with quick-start guidance, official package details, existing guide links, and Capabilities navigation. CI network diagnostics now allow StepSecurity up to 60 seconds to initialize and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone PRs under the same categories and order as published release notes, including Breaking Changes, Features, Bug Fixes, and Other Changes, with PRs sorted by number within each group.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their trigger events, and reports already blocked by those runs are re-evaluated once. action_required results remain blocking but now direct users to approve waiting workflow runs.

fix(release): resolve merge-queue commits GitHub left unmerged @osterman (#3613)

Release milestone checks and release planning can resolve a merge-queue commit that GitHub left unmerged by using the (#N) subject suffix of a GitHub-signed web-flow commit targeting the default branch. The resolved PR then receives the normal milestone and release-label validation.

chore(docs): refresh CLI screengrab casts, batch 2 of 3 @osterman (#3628)

Regenerates the second batch of 138 CLI screengrab casts so the documentation player types > atmos <command> and reflects current command output.

fix(cast): validate screengrab casts record the program name @osterman (#3629)

atmos --chdir=demo/casts casts validate screengrabs cli now rejects casts whose header command does not match the manifest command, while allowing --help=all and the special atmos about --help recording. The help page player title now matches the recorded atmos --help command.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can interpret inline or file-based VHS tapes in steps or PTY-backed session mode without requiring the vhs binary or writing intermediate files. Adds atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable shell initialization, waits, screenshots, and VHS key and setup syntax.

Migrate templates to gomplate v5 and drop AWS SDK for Go v1 @osterman (#3036)

Atmos templates now use gomplate v5, removing the AWS SDK for Go v1 dependency. Legacy gomplate v3 names remain available through compatibility shims with warnings, while datasource behavior and conversion semantics follow documented v5 changes; new coll.JQ and tmpl namespaces are available.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Adds atmos stack plan and stack test, stack-wide selectors for lifecycle commands, --dry-run, stack introspection through stack list, stack describe, and stack instances, and directory-capable stack create. Plans and tests preserve native hooks, dependency ordering, execution safeguards, and CI reporting across supported component types.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Adds cast.recorder(...) for Starlark scripts, allowing one declaration to execute commands, generate casts, or validate saved casts against a declaration fingerprint. Script steps can load local sources, session waits no longer match typed command echoes, and a Validation (casts) CI job checks committed recordings.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Adds dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for unpinned projects and editions from 2026-10-19; older editions retain arbitrary hook names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Adds safe Doctor migrations for legacy naming patterns and tokens, gated by production before/after identity checks. Global workspace templates, terminal color, nested error formatting, metadata hints, and hook logging are also corrected.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enables native Go plugins, the experimental plugin command family, startup integration, built-in OCI identity, and OIDC authentication. Adds plugin build --platform and --all-platforms, preserves policy output compatibility, and supports JSON/YAML policy reports with unchanged field semantics.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Adds native OPA and JSON Schema validation engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence. Deployment and authentication guardrails and shared version/date checks are available across all four engines.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19", while quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show copyable documentation URLs. Global --docs, --docs=md/--docs=markdown, and --example can open or render documentation and initialize selected examples, including outside a valid project; custom commands retain ownership of their own discovery flags.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Adds Fogg migration guidance and AWS CDK/CDK Terrain tutorials. CloudFormation synthesis hooks now run before generated files are read, and inherited region and duration-based timeout settings are supported with Doctor migrations.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Adds conditional stack imports with when, allowing labels and tags to select optional mixins and work with CLI selectors such as atmos list instances --tags pci and --labels pci:true. Deferred rendering of inherited maps beneath YAML function overrides is also corrected, and tagging and scaffolding tutorials are expanded.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Adds auth validate --stack with optional --component to validate merged component authentication configuration while retaining strict global validation. Secret discovery remains lazy, the default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Adds consistent --command executable selection to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and command-line precedence. Helmfile dry-run behavior, global options, and stderr forwarding are corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Adds atmos toolchain aliases to display effective built-in and configured aliases as sorted table or JSON/YAML output, and adds static atmos terraform backend list and describe inspection without authentication or expression execution. OCI vendoring, initialization, registries, Git sources, version inheritance, and related source handling are also corrected.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, CI, autofix, and Git hooks now use a shared YAML/Starlark suite with native Git sandboxes and atomic writes. Fixes preserve staged and unstaged edits, support bounded parallel copying and terminal-aware progress, and back up existing hook launchers during forced replacement.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Adds module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. The stdlib/config package adds typed YAML/JSON loading, JSON Schema validation, immutable records, source diagnostics, and config1.merge(config2) with configurable list strategies.

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Adds public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Native plugin release, release plan, test --build --coverprofile, verify-public, and catalog sync --inventory commands replace the previous Python release scripts.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Adds stdin= to exec.run, component.exec, and all atmos.* wrappers, sending exact bytes without a shell or command-line payload. The predeclared os module provides environment and directory controls scoped to one script invocation, and fs.write_file(path, content, overwrite=False, mode=0o600) supports exclusive creation with explicit overwrite.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Adds settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions; the default 1 preserves serial behavior. Results retain their original positions, policy checks run before commands, and outstanding commands are canceled after failure.

Add conditional retries for component error events @osterman (#3542)

Adds action: retry policies with scalar, list, wildcard, and predicate-based error events across supported component types, including Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators. Windows AWS config and credential updates are serialized with cross-platform file locks.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Vault and OpenBao stores can consume VAULT_TOKEN from a configured native Atmos identity. The auth-secrets provider reads named credentials using store, path, and optional exact top-level field references, while secrets/env renders explicit spec.env templates after authentication without exposing credentials or changing the process environment.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now read each provider's DefaultModel, including the Anthropic hint, instead of maintaining separate model lists. The displayed models therefore stay aligned with the provider configurations.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the process working directory, while ./ and ../ paths remain relative only to the including manifest. This keeps rebased describe affected comparisons pointed at the correct checkout.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

A stack-wide terraform_workspace_template now appears in Terraform component metadata, and the stack component metadata documentation lists it alongside terraform_workspace_pattern.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Establishes the shared Atmos API, standalone Go plugin SDK, protocol bindings, native transport, and manifest/configuration primitives while preserving existing pkg/automation imports through deprecated aliases. Native plugins select compatible CPU variants using immutable Atmos build metadata without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Adds shared extension-registry, authentication, credential, OCI registry, and policy/configuration primitives for the plugin distribution layers. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are prevented, and GHCR token priority is preserved.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform bulk init and test operations again run destroy, before/after, and per-component lifecycle hooks in prepared work directories, preserving resolved paths and credentials for after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS options, and credential-forwarding policy through chart lookup and install or upgrade operations. AWS ambient authentication context is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserves literal YAML values through loading, merging, templating, and output while enabling stack random and cwd evaluation and diagnosing functions in unsupported locations. Raw YAML shielding no longer affects decoded command arguments or import paths.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserves saved plans during inspection and restores single-component destroy CI output. Custom-command boundaries, devcontainer ports, MCP exports, schema-directory flags, Ansible paths, workflow directories, retry defaults, SBOM discovery, and native Helm rendering and repository handling are corrected.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now enables color on a TTY when Atmos color detection allows it, unless HELM_DIFF_COLOR is explicitly set in the component environment or shell. This preserves explicit user overrides while fixing the piped-output TTY detection issue.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updates the AWS SAML Playwright runtime and website Node.js pin to Node 24.22.1, upgrades patched website dependencies, and moves the website from end-of-life Node 25 to the Node 24 LTS line. Go is updated to 1.26.10.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation while preserving explicit overrides, legacy component selection, and disabled metadata inheritance. This aligns displayed module paths with execution and affected-component detection.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Releases now provide six binaries and six Linux packages, with source installation documented for retired targets. atmos release cut --resume can recover unfinished production releases, Quality Gate uses current policy and commit-status evidence, and shared Git hooks select the current checkout's build/atmos binary.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform dependency lookups now preserve --skip options such as --skip=secret, preventing nested evaluation from contacting secret providers. Caches are partitioned by skip list.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, preserving existing files and allowing provider-free test modules to run without a backend_type.

fix(secret): honor scoped providers during key generation @osterman (#3515)

atmos secret keygen -s <stack> now resolves stack, component, and type providers without evaluating secret values, including provider-only stacks. Registered component types participate in stack filtering and description, while ambiguous provider overrides are rejected.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now searches from the encrypted file for nested .sops.yaml recipient files and generates matching rules relative to the recipient directory. Relative and absolute paths, custom secret directories, and Unix or Windows separators are supported.

fix(secret): allow stack secrets without a component @osterman (#3517)

atmos secret set and atmos secret validate now support stack/global declarations without requiring an unrelated component. Instance-scoped operations continue to require --component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit flags such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specifications now reject Kubernetes container port replacements that omit the API port 6443/tcp, preventing startup from succeeding without a bound Kubernetes API server.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal email autolinks in ui.* messages now render once. Documentation clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material. Existing recipient rules and explicit recipients are preserved, while ambiguous multiple identities require remediation.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, wrapping, and email text in terminal and toast output. Literal list markers can be escaped, while headings, quotes, links, emphasis, masking, and task routing remain supported.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of a minute or more as 34m 47s or 1h 2m 3s, omitting zero units; sub-minute values retain formats such as 800ms and 45.2s. Values near a minute round consistently, including 59.96s as 1m.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduces security-scanner noise by suppressing identified same-repository action false positives and reporting security backlogs by scanner. Go and JavaScript dependencies are patched, including Go 1.26.10 and the Windows runtime workaround dependencies.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Adds AuthenticateIsolated to authenticate an identity on a separate manager without changing the caller's chain, stack information, or credentials. Store authentication for AWS, Azure, and GCP now uses the isolated context, preventing store identity resolution from changing subsequent component authentication.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changes the Gemini provider default model to gemini-3.8-flash; the TUI fallback list, --ai setup hints, function-calling guidance, and provider documentation follow the new default.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifest and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, including nested_imports: remote. OCI artifacts are pulled once per invocation into the XDG stack-imports cache, with imports.ttl honored and a specific error for missing paths.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens in atmos ai usage output. The full prompt_tokens value remains the input count, and cache creation tokens remain zero.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible requests now use max_completion_tokens for o-series models and gpt-6* models, while names such as ollama remain on max_tokens. The behavior applies across OpenAI, Azure OpenAI, GitHub, Grok, DeepSeek, OpenRouter, and Z.ai clients.

fix(ai): apply max_tokens to Gemini requests @pcbeingused333 (#3567)

Gemini requests now apply ai.providers.gemini.max_tokens as generationConfig.maxOutputTokens across message and tool-calling methods. A value of zero leaves the model default; otherwise the documented default of 8192 applies when no value is configured.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilizes workflow environments, StepSecurity eBPF block detection, Floci startup, AWS credential refresh, merged milestone handling, CI-mode configuration access, and stack-worker cleanup. Starlark failure and formatting diagnostics now distinguish intentional failures and provide clearer guidance.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change runs, with shared duration formatting. Aggregate reports and masked summary-file writes are bounded, and oversized output produces a deduplicated warning recommending --tags or --labels.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values embedded in template strings now resolve correctly, while unresolved maps, lists, and rewritten function values produce clear errors instead of internal placeholders. Store hooks skip missing Terraform outputs during destroy with a warning, and custom commands may declare --example and --docs flags of any type.

fix(ai): default Anthropic and Bedrock to Claude Sonnet 5 @pcbeingused333 (#3585)

Anthropic and Bedrock now default to Claude Sonnet 5 using claude-sonnet-5 and global.anthropic.claude-sonnet-5. Requests omit a thinking override so model defaults apply, including adaptive thinking.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook before backend and environment setup, injecting identity credentials such as AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, and region settings into Terraform initialization and the interactive shell.

fix: repair plugin publication and AI release previews @osterman (#3605)

Plugin and catalog publication now occurs before --verify-public, with actionable GHCR visibility guidance and safe retries. Milestone previews use AI summaries, forward the API key through the trusted workflow, and reuse unchanged previews.

fix(terraform): show Terraform's error when workspace setup fails @osterman (#3610)

Terraform workspace setup failures now include Terraform's output from both workspace select -or-create and the workspace new fallback, along with the workspace name and guidance to check backend credentials or rerun with ATMOS_LOGS_LEVEL=debug.

fix(list): escape CSV/TSV cells in list vendor output @pcbeingused333 (#3616)

atmos list vendor --format csv|tsv now escapes delimiters, quotes, and newlines using standard CSV/TSV rules, keeping values such as multi-tag lists in a single field.

fix(secret): run every secret command on stack-scoped secrets @osterman (#3618)

atmos secret get, delete, import, pull, push, exec, and shell now accept --stack alone for stack-scoped and global secrets. Whole-stack operations exclude instance secrets unless --component is supplied, and named operations require one consistent shared declaration.

fix(pro): keep the error message in reported exceptions @osterman (#3619)

Exceptions reported to Atmos Pro now retain the masked failure message, prefixed with the failed command and limited to 8 KiB on a rune boundary. Nil event information no longer causes a panic.

fix(auth): retry the GitHub OIDC token request and reuse the JWT per process @mtb-xt (#3621)

GitHub OIDC authentication retries token requests on timeouts, transport errors, HTTP 429, and HTTP 5xx responses with four attempts and exponential backoff. Valid JWTs are reused in memory per process and request identity while their exp claim is more than 60 seconds away; tokens are never persisted.

fix(cast): record the program name in cast headers @osterman (#3627)

Auto-recorded cast headers now include the program name, so atmos --help and similar recordings replay with the correct command. The first batch of 138 CLI screengrab casts was regenerated.

feat(website): render GitHub-style alerts as admonitions @osterman (#3631)

Documentation and changelog Markdown now convert GitHub-style alerts such as > [!NOTE], > [!WARNING], and > [!CAUTION] into native Docusaurus admonitions; CAUTION maps to the danger style.

fix(ai): count Gemini thinking tokens in output usage @pcbeingused333 (#3632)

Gemini usage now counts thoughtsTokenCount together with candidatesTokenCount when reporting completion tokens, including streaming responses and vision calls.

fix(ci): find the merged PR's stored plan when deploying a squash commit @osterman (#3636)

atmos terraform deploy first looks for a stored plan for the deployed commit, then on GitHub Actions can resolve the merged pull request associated with that commit and use its head-commit plan. The fallback validates the merged PR and requires pull-requests: read permission.

fix: regressions found in v1.234.0-rc.1 @osterman (#3637)

Restores performance for describe stacks, describe affected, and list instances, moves legacy atmos stack get|set|delete|format deprecation notices to stderr, improves !include and !include.raw missing-path diagnostics, and restores !ci.labels [list] inside locals:.

fix: address review follow-ups for the v1.234.0-rc.1 regression fixes @osterman (#3638)

Completes the v1.234.0 regression fixes by preserving restored !ci.labels items, retaining full YQ queries in missing-include hints, propagating include errors from template manifests, and honoring gomplate experimental functions enabled through its upstream API.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updates github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for duplicate distinct_id values and retries for transient feature-flag request failures.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updates the website's @types/node dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updates the website's tsx dependency from 4.23.13 to 4.23.15, including fixes for Node built-in namespace inheritance, CommonJS require.cache and require.extensions, and portable namespaced register() declarations.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updates al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updates Prettier from 3.9.9 to 3.9.10, including the Markdown table parsing fix from micromark-extension-gfm-table.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updates golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Updates the .devcontainer Go image from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updates github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updates github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, including the new top-level goquery.Text helper.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Updates the github.com/cyberphone/json-canonicalization dependency from digest 19d51d7 to 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Updates actions/upload-artifact from v7.0.1 to v7.0.2, improving retries for HTTP 429 responses and honoring valid Retry-After headers.

chore(deps): bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4 @dependabot[bot] (#3597)

Updates github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4.

chore(deps): update step-security/harden-runner action to v2.22.1 @renovate[bot] (#3601)

Updates step-security/harden-runner from v2.22.0 to v2.22.1, fixing security-rule initialization on GHES self-hosted runners and GHES connectivity in block mode.

fix(deps): update module github.com/agnivade/levenshtein to v1.2.2 - abandoned @renovate[bot] (#3608)

Updates github.com/agnivade/levenshtein from v1.2.1 to v1.2.2.

chore(deps): update step-security/harden-runner action to v2.22.2 @renovate[bot] (#3612)

Updates step-security/harden-runner from v2.22.1 to v2.22.2, correcting macOS ingress classification and Linux endpoint handling while improving network and DNS tracing.

fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.3 @renovate[bot] (#3615)

Updates github.com/bmatcuk/doublestar/v4 from v4.10.0 to v4.10.3, fixing character-range matching with WithCaseInsensitive and improving Windows junction traversal.

fix(deps): update go.starlark.net digest to 4f4267f @renovate[bot] (#3622)

Updates the go.starlark.net dependency from digest d7438c5 to 4f4267f.