cloudposse/atmos v1.234.0-rc.2 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS auth provider coverage for credential expiration, identity validation, environment projection without secret leakage, persisted credential loading, invalid JSON, missing credentials, and idempotent logout.

feat: add plugin distribution and verification services @osterman (#3457)

Added native plugin distribution and verification services, including catalogs, discovery, installation, lockfiles, package management, signing, signature verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, and configuration updates remain transactional.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Added plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, protocol-generation, and output-formatting support. Plugin installation preserves entrypoint names and permissions, rejects collisions, and rolls back incomplete installs while retaining recovery artifacts when cleanup cannot finish.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Added command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and preserved source metadata for aliases. Core stack, cloud, CI, configuration, and profile commands now register their discovery metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Added documentation URLs and ordered examples to the remaining built-in commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updated the CI failure annotations documentation with a runnable local preview, expected annotation output, and the intentional exit code 77 and early-admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilized Quality Gate reporting by selecting the newest CI and Codecov results, publishing pending and final reports predictably, recovering unfinished reports and long-running reruns, and avoiding edits caused only by a changed summary URL. The report now groups Readiness, Reviews, and Measures and supports more resilient retries and local fixtures.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Added runnable examples/cdk-cloudformation and examples/cdk-terraform projects using the native CloudFormation and Terraform components with the local Floci AWS emulator, so the CDK tutorial examples do not require an AWS account. Both include fresh-on-diff synthesis hooks, atmos test smoke checks, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Removed incidental logging, redundant approval and initialization settings, and global auto-approval overrides from 57 copyable Atmos examples while retaining required configuration and intentional demonstrations. Updated quick-start guidance and snapshots to reflect inherited defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Corrected bundled skill examples and command/configuration guidance, including workflow prerequisites, toolchain aliases, ECR login, retry fields, vendor pinning, Ansible introspection, theme commands, authentication, and component executable selection. Removed unsupported command examples and documented implemented backend inspection, scoped-auth restrictions, and OCI registry usage.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Added CodeRabbit path instructions encouraging focused extraction of touched behavior and tests into owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumped the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes a native stack member when its merge commit is present in the verified release source range, even if GitHub retains the original parent branch as the PR base. Unmerged or unrelated commits still fail the existing release-label and milestone checks.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates a quality:ready PR when its combined head status is failure or error, even if the report is current and the commit is older than 24 hours. quality:not-ready PRs and pending statuses are not selected.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures, pending runs, unknown or shared suite IDs, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Plugin release inputs no longer treat the repository root go.mod as an auth-secrets build input, and auth-secrets is bumped to version 1.0.1. Changelog posts now show a release badge from manual frontmatter, detected release data, or Unreleased, and the CDK hooks post includes its cast metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Added /plugins and /plugins/official documentation pages with quick-start guidance, official package details, and navigation under Capabilities. CI network diagnostics now allow StepSecurity up to 60 seconds to initialize and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone PRs under the same categories and ordering as published release notes, such as Breaking Changes, Features, Bug Fixes, and Other Changes, with PRs sorted by number within each group.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their workflow trigger events, and legacy reports blocked by those runs are re-evaluated once. action_required results now direct users to approve waiting workflow runs rather than inspect logs.

fix(release): resolve merge-queue commits GitHub left unmerged @osterman (#3613)

Release milestone checks and release planning can resolve a merge-queue commit that GitHub left unmerged by using the PR number in a GitHub-signed web-flow commit subject targeting the default branch. Direct pushes, unsigned commits, invalid PR references, and PRs on other bases still fail closed.

chore(docs): refresh CLI screengrab casts, batch 2 of 3 @osterman (#3628)

Regenerated the second batch of 138 CLI screengrab casts so the documentation player types > atmos <command> and reflects current command output.

fix(cast): validate screengrab casts record the program name @osterman (#3629)

Regenerated the final 136 CLI screengrab casts and added validation to atmos --chdir=demo/casts casts validate screengrabs cli, which rejects cast headers whose command does not match the manifest command while allowing --help=all and the special atmos about --help case.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can now interpret VHS-dialect tapes supplied inline with tape: or from tape_file: without requiring the vhs binary or writing generated YAML. Step mode executes typed commands with individual exit codes, while session mode replays PTY input, waits, screenshots, shell setup, and supported VHS directives.

Migrate templates to gomplate v5 and drop AWS SDK for Go v1 @osterman (#3036)

Atmos templates now use gomplate v5, removing the AWS SDK for Go v1 dependency and retaining compatibility shims for supported v3 names with deprecation warnings. Template behavior changes include stricter conversions, updated datasource paths and responses, env:NAME syntax, Vault KV v2 URL handling, removed BoltDB datasources, and new coll.JQ and tmpl support.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Added atmos stack plan and stack test, stack-wide selectors for lifecycle commands, dry-run planning, stack introspection with list, describe, and instances, CI reporting, and directory-capable stack create. Selectors support --stack, --component, repeated or comma-separated values, interactive pickers, tags, labels, and dependency-aware filtering.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Added cast.recorder(...) for Starlark scripts, allowing one declaration to execute commands, generate casts, or validate saved casts against a fingerprint. Added PTY blocks, assertions, policies, output replacements, script source: files, cast validation in CI, and corrected session waits and hidden-output handling.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Added dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create. Hook declarations are validated against registered lifecycle events for unpinned projects and newer editions, while older editions retain arbitrary hook names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Added safe Doctor migrations for legacy naming patterns and tokens, gated by production identity checks, along with guidance for local schema copies. Global workspace templates, terminal color, nested error formatting, metadata hints, and hook log levels were also corrected.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enabled the experimental native plugin command family, startup integration, built-in OCI identity, OIDC authentication, policy checks, and plugin build --platform/--all-platforms with environment bindings and partial-success reporting. Policy reports preserve JSON field names and embedded objects across YAML output.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Added native OPA and JSON Schema validation engines with shared environment, runtime, version/FIPS, calendar, and CI evidence across all four policy engines. Also added deployment and authentication guardrails and shared version/date checks.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19", while quoted strings such as "!env SOMETHING" remain literal.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Added command discovery through --docs, --docs=md/--docs=markdown, and --example. Help and usage output can show documentation URLs, fetch rendered Markdown, open pages, select runnable examples, and initialize them through atmos init, including confirmation, cancellation, overwrite, progress, and --chdir handling.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Added Fogg migration, AWS CDK, and CDK Terrain guides, plus CloudFormation synthesis improvements. Synthesis hooks run before generated files are read, and inherited region and duration-based timeout settings are supported with Doctor migrations.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Added conditional stack imports with when, allowing labels and tags to select optional mixins and work with CLI selectors such as atmos list instances --tags pci and --labels pci:true. Also corrected deferred rendering beneath YAML function overrides and expanded tagging and Terraform file-sharing tutorials.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Added stack-scoped authentication validation with auth validate --stack and optional --component, while keeping global validation strict and secret discovery lazy. The default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Added consistent --command support to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Helmfile dry-run behavior, global options, and stderr forwarding were also corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Added atmos toolchain aliases to display effective built-in and configured aliases as sorted table or JSON/YAML output, and added static atmos terraform backend list and describe inspection without authentication or expression execution. Also corrected vendor, init, registry, Git, version-manager, OCI whiteout, and source-handling behavior.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, Git hooks, CI, and autofix now use a shared YAML/Starlark suite with native Git sandboxes and atomic writes. Fixes preserve staged and unstaged edits, support bounded parallel copying and terminal-aware progress, and back up existing hook launchers when replacing them.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Added module.load(path) and struct(**fields) to automation scripts, with cached imports, frozen exports, cycle detection, cancellation, and parallel loading. Added typed YAML/JSON configuration loading and validation with local or HTTPS JSON Schemas, defaults, bounds, optional fields, lists, enums, diagnostics, immutable records, and config1.merge(config2).

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Added public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Native commands now support plugin release planning, building, signing, verification, public-access checks, and catalog synchronization, while secrets/store and secrets/env provide scoped secret retrieval and masked environment projection.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Added stdin= to exec.run, component.exec, and Atmos wrappers for exact byte input without shell interpolation or command-line exposure. Added invocation-local os.getenv, os.environ, os.getcwd, os.setenv, and os.chdir, plus fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation by default.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Added settings.functions.exec.max_concurrency to bound parallel evaluation of ordinary !exec expressions, with a default of 1. Results retain their original positions, outstanding commands are cancelled after failure, policies are checked before execution, and masked stderr identifies each document path.

Add conditional retries for component error events @osterman (#3542)

Added action: retry policies for component error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators, with predicates, budgets, aliases, schemas, and diagnostics. AWS configuration and credential updates are serialized on Windows, and screengrab staging stays on the destination filesystem for atomic publication.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Vault and OpenBao stores can now consume VAULT_TOKEN from a configured native Atmos identity. The auth-secrets provider reads named credentials using store, path, and optional top-level field, while secrets/env renders explicit spec.env templates after authentication without exposing credentials or changing the process environment.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now use each provider's DefaultModel, including Anthropic, Bedrock, Gemini, Ollama, and Grok, instead of separate hardcoded model lists. The Anthropic disabled-provider hint also uses anthropic.DefaultModel, keeping displayed configuration values aligned with provider defaults.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the process working directory, while ./ and ../ paths remain relative only to the including manifest. This ensures rebased describe affected comparisons read files from the correct checkout.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

A stack-wide terraform_workspace_template now passes validation and appears in Terraform component metadata, and the metadata documentation lists it alongside the other supported global fields.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Added the shared pkg/api contracts, standalone native plugin SDK, protocol bindings, transport, manifest and configuration primitives, and Starlark cast integration while preserving deprecated pkg/automation imports. Compatible native plugin CPU variants are selected from immutable build metadata without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Added shared extension registry, descriptor validation, OCI registry access, and credential handling for the plugin distribution layers. Credential publication and provider logout cleanup are serialized, nested registry-auth deadlocks are avoided, and GHCR token priority is preserved.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform lifecycle hooks now run in prepared work directories for bulk init and test operations, including destroy and per-component hooks, with resolved paths and credentials available to after-hooks. Tool-version discovery is scoped to each project's configuration.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm operations now preserve repository credentials, TLS options, and credential-forwarding policy during chart lookup and install or upgrade. AWS ambient authentication now retains SDK discovery, including AWS_PROFILE, while explicit managed credential overrides remain supported.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserved literal YAML values through loading, merging, templates, and output, enabled stack random and cwd evaluation, and made Doctor diagnose functions in unsupported locations. Raw YAML shielding does not affect decoded command arguments or import paths, and plugin archive inventory now validates host-local paths.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserved saved plans during inspection and restored single-component destroy CI output. Corrected custom-command argument and identity boundaries, devcontainer and MCP settings, schema-directory flags, Ansible and workflow paths, retry defaults, SBOM discovery, and native Helm rendering and repository handling.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now enables HELM_DIFF_COLOR=true when Atmos detects that color should be used and the user has not explicitly set the variable. Explicit component, stack, or shell values continue to take precedence.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updated the AWS SAML Playwright runtime and website to Node.js 24.22.1, moved the website from Node 25 to the Node 24 LTS line, and upgraded patched dompurify, launch-editor, and follow-redirects releases. Go was updated to 1.26.10 for the crypto/x509 security fix.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This prevents execution from using an instance name when metadata specifies a module path.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Release artifacts are reduced to six binaries and six Linux packages, with source installation documented for retired targets. Added atmos release cut --resume, current release-policy and commit-status evidence for Quality Gate, preserved merge metadata in Git sandboxes, and made shared Git hooks select the current checkout's build/atmos.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform dependency lookups now preserve evaluation options such as --skip=secret, preventing nested output and state evaluation from contacting secret providers when those functions are skipped. Caches are partitioned by the skip list.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run and preserving any existing backend files.

fix(secret): honor scoped providers during key generation @osterman (#3515)

atmos secret keygen -s <stack> now resolves stack and component-type providers without evaluating secret values, including provider-only stacks with imported or templated configuration. Ambiguous overrides and unmatched explicit selections are rejected.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files from the encrypted file and generates matching repository-relative rules, supporting relative and absolute paths, custom secret directories, and Unix or Windows separators.

fix(secret): allow stack secrets without a component @osterman (#3517)

atmos secret set and atmos secret validate now support stack and global declarations without requiring an unrelated component. Instance-scoped operations continue to require --component.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom Atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit -s forms. Race-test planning also distributes expensive suites across shards while retaining deterministic package selection.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace the port list without retaining 6443/tcp, preventing startup with no bound Kubernetes API server port.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal messages now render email autolinks once, and the Terraform test documentation clarifies --help=all, stack-variable injection, and retained generated files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving existing recipient rules and rejecting ambiguous identities.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, wrapped layout, and single-rendered email addresses in both colored and no-color output. Literal list markers can be escaped with ui.info("1\\. literal").

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now format durations of a minute or more as 34m 47s or 1h 2m 3s, omitting zero units, while sub-minute formatting remains unchanged. The local invocation summary and Native CI Terraform summary use the same formatter.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduced scanner noise by suppressing 62 Semgrep false positives and documenting remaining security findings by scanner. Also updated Go to 1.26.10, applied the validated Windows runtime workaround, and isolated Terraform hook test state.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Added AuthenticateIsolated to authenticate a store identity on a separate manager without changing the caller's chain, stack information, or credentials. AWS, Azure, and GCP store authentication now uses this isolated context, preventing nested secret resolution from changing the identity used by later state reads.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Changed the Gemini provider default model to gemini-3.8-flash; the TUI fallback list, --ai setup hints, documentation, and function-calling guidance now use the new default.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack manifests and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, including nested_imports: remote. OCI artifacts are pulled once per invocation into the XDG stack-imports cache, and missing paths return ErrOCIImportMissingPath with a hint.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible AI providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens in atmos ai usage output. Full prompt tokens remain in InputTokens, and cache creation tokens remain zero.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible clients now send max_completion_tokens for all o-series models and gpt-6* models, while models such as Ollama names that merely begin with o continue to use max_tokens.

fix(ai): apply max_tokens to Gemini requests @pcbeingused333 (#3567)

Gemini requests now send ai.providers.gemini.max_tokens as generationConfig.maxOutputTokens across regular and tool-calling methods. An unset value uses the provider or model default.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilized workflow environments, StepSecurity eBPF block detection, Floci startup for native CI cache warmup, AWS credential refresh before website deployment, merged milestone handling, stack-worker cleanup, and CI-mode configuration synchronization. Starlark failure and formatting diagnostics were also clarified.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change runs, while using shared duration formatting. Aggregate reports and masked summary-file writes are bounded, with a deduplicated warning recommending --tags or --labels when output exceeds available space.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values inside template strings now resolve correctly, including values such as name: "app-{{ .vars.region }}", while unresolved map, list, or rewritten function values produce clear errors. Store hooks may skip missing Terraform outputs during destroy events, and custom commands may declare --example and --docs flags of any type.

fix(ai): default Anthropic and Bedrock to Claude Sonnet 5 @pcbeingused333 (#3585)

Anthropic and Bedrock now default to Claude Sonnet 5 using claude-sonnet-5 and global.anthropic.claude-sonnet-5. Requests no longer send a thinking override, allowing model defaults and user-configured models that reject that field.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook before backend setup and environment assembly, injecting identity credentials such as AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, and region settings into Terraform and the interactive shell. Authentication errors stop shell setup.

fix: repair plugin publication and AI release previews @osterman (#3605)

Plugin and catalog publication now occurs before --verify-public, with actionable GHCR visibility guidance and safe retries. Milestone release previews now use AI summaries, forward the API key through the trusted workflow, and reuse unchanged previews.

fix(terraform): show Terraform's error when workspace setup fails @osterman (#3610)

Terraform workspace setup errors now include Terraform's output from both workspace select -or-create and its workspace new fallback, along with the workspace name and guidance to check backend credentials and permissions or enable ATMOS_LOGS_LEVEL=debug.

fix(list): escape CSV/TSV cells in list vendor output @pcbeingused333 (#3616)

atmos list vendor --format csv|tsv now escapes delimiters, quotes, and newlines using the standard CSV writer, keeping multi-tag values and other fields in their correct cells.

fix(secret): run every secret command on stack-scoped secrets @osterman (#3618)

Secret commands including get, delete, import, pull, push, exec, and shell now accept --stack alone for stack-scoped and global secrets. Whole-stack operations exclude instance secrets unless --component is provided, and commands prompt for a component or explain why it is required when no shared scope exists.

fix(pro): keep the error message in reported exceptions @osterman (#3619)

Exceptions reported to Atmos Pro now include the masked failed command and its real error text, truncated to 8 KiB on a rune boundary. Nil exception information no longer causes a panic.

fix(auth): retry the GitHub OIDC token request and reuse the JWT per process @mtb-xt (#3621)

GitHub OIDC authentication now retries token requests on timeouts, transport errors, HTTP 429, and HTTP 5xx responses with four attempts and exponential backoff. A valid JWT is reused in memory across identities within one Atmos process while its exp claim is more than 60 seconds away; credentials are not persisted.

fix(cast): record the program name in cast headers @osterman (#3627)

Auto-recorded cast headers now include the program name, so commands such as atmos --help render correctly in the documentation player instead of appearing as --help. The first batch of 138 screengrabs was regenerated.

feat(website): render GitHub-style alerts as admonitions @osterman (#3631)

Documentation and changelog Markdown now convert GitHub-style alerts such as > [!NOTE], > [!WARNING], and > [!CAUTION] into native Docusaurus admonitions; CAUTION maps to the danger style.

fix(ai): count Gemini thinking tokens in output usage @pcbeingused333 (#3632)

Gemini usage reporting now counts thoughtsTokenCount together with candidatesTokenCount as completion tokens, so reasoning tokens are included in output usage for streaming and vision requests.

fix(ci): find the merged PR's stored plan when deploying a squash commit @osterman (#3636)

atmos terraform deploy now checks for a stored plan for the deployed commit first, then falls back on GitHub Actions to the head commit of the merged pull request when appropriate. The fallback validates the merged PR and warns when pull-requests: read permission is missing.

fix: regressions found in v1.234.0-rc.1 @osterman (#3637)

Restored performance for describe stacks, describe affected, and list instances; legacy atmos stack get|set|delete|format deprecation notices now go to stderr; include-not-found errors identify the exact paths tried; and !ci.labels [list] works again inside locals: with explicit YAML tags.

fix: address review follow-ups for the v1.234.0-rc.1 regression fixes @osterman (#3638)

Corrected review follow-ups for the v1.234.0-rc.1 regression fixes: restored !ci.labels values are no longer re-decoded, include hints preserve YQ queries and | eval, template-manifest errors wrap correctly, and Gomplate experimental functions enabled through gomplate.SetExperimental are honored.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Updated github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for feature-flag retries, capture event handling, compression options, and duplicate distinct_id properties.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updated the website's @types/node dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updated the website's tsx dependency from 4.23.13 to 4.23.15, including fixes for built-in namespace inheritance, CommonJS module cache access, and portable register overloads.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Updated al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updated the website's Prettier dependency from 3.9.9 to 3.9.10, including the Markdown table parser update.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updated golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller, including upstream gopls, SSA, and cache fixes.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Updated the development container's Go image from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updated github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3, including the Smithy sparse-in-dense fix and regenerated AWS clients.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updated github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, which includes performance improvements and the top-level goquery.Text helper.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Updated the github.com/cyberphone/json-canonicalization dependency to commit 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Updated actions/upload-artifact from v7.0.1 to v7.0.2, improving artifact download retries for HTTP 429 responses and honoring valid Retry-After headers.

chore(deps): bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4 @dependabot[bot] (#3597)

Updated the AWS Resource Groups Tagging API client from 1.39.0 to 1.41.4, including refreshed service models and endpoint data.

chore(deps): update step-security/harden-runner action to v2.22.1 @renovate[bot] (#3601)

Updated step-security/harden-runner from v2.22.0 to v2.22.1, fixing security-rule initialization and GHES connectivity in block mode.

fix(deps): update module github.com/agnivade/levenshtein to v1.2.2 - abandoned @renovate[bot] (#3608)

Updated github.com/agnivade/levenshtein from v1.2.1 to v1.2.2.

chore(deps): update step-security/harden-runner action to v2.22.2 @renovate[bot] (#3612)

Updated step-security/harden-runner from v2.22.1 to v2.22.2, correcting macOS ingress classification and Linux endpoint handling and improving network and DNS tracing.

fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.3 @renovate[bot] (#3615)

Updated github.com/bmatcuk/doublestar/v4 from v4.10.0 to v4.10.3, fixing character-range matching with case-insensitive globbing and improving Windows junction support.

fix(deps): update go.starlark.net digest to 4f4267f @renovate[bot] (#3622)

Updated the go.starlark.net dependency to commit 4f4267f.