cloudposse/atmos v1.234.1 on GitHub

📦 Other Changes

chore: bump Claude Code plugin version to v1.234.0 @cloudposse-releaser[bot] (#3643)

fix(release): pass the approved plan verbatim; bare milestone titles @osterman (#3644)

atmos release cut now passes RELEASE_APPROVED_PLAN to go tool mage release:cut with Starlark exec.run, preserving release notes that contain template syntax.
milestones ensure and milestones create now use bare version titles such as 1.236.0; release tags continue to include the v prefix.

fix(ci): drop pull_request_target from quality and release reporters @osterman (#3655)

Quality and release reporters no longer subscribe to privileged pull_request_target; supported signals use the unprivileged Quality Gate Signal, while reconciliation also runs on pushes to main.
Adds single-PR refresh and status commands: atmos dev quality refresh <pr> dispatches a refresh, and atmos dev quality status <pr> prints a versioned JSON verdict (pending, ready, or blocked).
Quality reporting now runs independently of the cancellable timing-summary job.

fix(ai): send the system prompt and ATMOS.md to Bedrock, with prompt caching @Haarris (#3626)

Bedrock requests now send the system prompt and ATMOS.md in the system field and mark them for prompt caching. Cache settings are read from ai.providers.<name>.cache, and Bedrock cache usage is shown in the chat footer.

fix(policy): evaluate component admission before authentication @osterman (#3651)

Component admission now runs before authentication, so a denied component.command fails before identity resolution or login; non-policy stack-resolution errors remain with the executor.
The component-deny-agent-production-deploy policy now denies shell as well as apply and deploy for Claude Code and Codex sessions on production stacks.

fix(auth): treat template variable assignments as non-output actions @osterman (#3654)

Go template variable declarations and assignments, along with break and continue, are now treated as non-output actions when Atmos scans authentication templates. Lines containing only these actions are commented out during YAML projection, preventing valid templated auth sources without credentials from being rejected as malformed YAML.

fix(script): forward host color to Starlark child processes @osterman (#3657)

Starlark exec.run and atmos.run child processes now inherit the host's color and terminal preferences when output is streamed, including --force-color and NO_COLOR behavior. Captured output remains free of ANSI codes, and child processes still do not receive interactive stdin.

fix(container): forward run_args to the runtime and only allocate a TTY for terminals @osterman (#3659)

atmos container up and atmos container run now forward run.run_args to Docker or Podman, including options such as --publish and --init; an explicit --network or --net suppresses Atmos's automatic shared network. atmos container exec allocates a TTY only when stdin is a terminal, allowing piped and CI input to work.

chore(deps): update dependency @docsearch/react to v4.7.1 @renovate[bot] (#3623)

Updates the documentation search dependency @docsearch/react from 4.7.0 to 4.7.1.

fix(deps): update module github.com/aws/smithy-go to v1.28.6 @renovate[bot] (#3633)

Updates github.com/aws/smithy-go from v1.28.5 to v1.28.6, including fixes for event-stream header length enforcement and dense-list null deserialization.

fix(deps): update module github.com/charmbracelet/x/ansi to v0.11.9 @renovate[bot] (#3634)

chore(deps): bump the cicd group across 1 directory with 8 updates @dependabot[bot] (#3641)

Updates CI and release dependencies: CodeQL Action 4.39.1, GoReleaser Action 7.3.0, cloudposse/github-action-setup-atmos 3.7.0, actions/create-github-app-token 3.3.0, and TruffleHog 3.99.7.