cloudposse/atmos v1.235.0-nightly.43535111746 on GitHub

📦 Other Changes

chore: bump Claude Code plugin version to v1.234.1 @cloudposse-releaser[bot] (#3664)

fix(ci): render release PR comments as markdown, not a code block @osterman (#3679)

Release notification comments are now rendered as Markdown instead of indented code blocks, keeping hidden markers from appearing as text and release links clickable.

Add Anthropic OSS Scanner build files @osterman (#3680)

Adds .oss-scanner/Dockerfile and .oss-scanner/threat_model.md for Anthropic's OSS Scanner. The Dockerfile installs a pinned released Atmos, builds Atmos from source with atmos build, and compiles the tests to provide a warm offline-audit cache.

feat(ci): add native Gitea Actions CI provider @osterman (#3656)

Adds a native gitea-actions CI provider, selected when GITEA_ACTIONS=true, with Gitea commit statuses, marker-based pull request comments, affected-component detection, runner outputs and summaries, and Gitea-compatible metadata handling. Credentials use ATMOS_CI_GITEA_TOKEN or GITEA_TOKEN, and the API URL and HTTPS behavior can be configured with the documented ATMOS_CI_GITEA_* settings.

feat(starlark): add browser.open for launching URLs from scripts @osterman (#3658)

Starlark scripts can now call browser.open(url) to launch validated absolute http or https URLs in the system browser. Invalid URLs, dry runs, and canceled executions do not launch anything, while launch failures fail the script.

feat(container): support IP:port host mappings @osterman (#3660)

Container port mappings now accept address-and-port values such as host: "127.0.0.1:8080" with container: 3000, including bracketed IPv6 addresses. Validation and formatting are shared across containers, workflow sandboxes and steps, background services, and emulators; malformed or out-of-range host ports are rejected before runtime operations.

feat(git): add --ref to atmos git clone for exact commit/tag checkout @osterman (#3661)

atmos git clone now supports --ref and ATMOS_GIT_REF for checking out an exact branch, tag, full ref, or commit SHA in detached mode. It overrides configured branch, URI, and CI refs, cannot be combined with --branch, and is blocked for elevated fork events unless --allow-unsafe-fork is set.

fix(auth): keep long AWS SSO verification URLs out of the dialog box @osterman (#3667)

AWS SSO verification URLs longer than 80 columns are now displayed outside the dialog box. The new settings.terminal.links, ATMOS_TERMINAL_LINKS, and global --links setting controls whether long URLs use automatic or forced OSC 8 links, clipboard copying, or raw text; atmos auth console uses the same delivery behavior when it does not open a browser.

feat(stores): add operation-scoped Vault identity cleanup @noeljackson (#3668)

Vault and OpenBao stores support opt-in options.identity_lifetime: operation, which authenticates an isolated target identity and logs it out before returning secrets while preserving existing sessions. Results are blocked if cleanup fails, and bounded cleanup also runs during SIGINT or SIGTERM cancellation; session lifetime remains the default.

fix: correct command discovery and quick-start examples @osterman (#3670)

Configured command aliases now forward discovery flags to their target commands, including subcommands. Advanced quick-start workflows no longer include redundant spinner steps, and generated Markdown keeps definition descriptions together with inline code.

fix(telemetry): degrade config-load failures to DEBUG instead of WARN @aknysh (#3671)

Telemetry config-load failures caused by a missing ATMOS_PROFILE now log at DEBUG instead of displaying a user-facing WARN, so commands such as atmos version no longer report a misleading warning when run outside the profile's project directory.

fix(eks): preserve region and working directory in kubeconfig @osterman (#3675)

EKS kubeconfig generation now derives an omitted region from the returned cluster ARN and preserves the effective absolute working directory in ATMOS_CHDIR for direct-identity and integration modes. Existing kubeconfigs may need regeneration to include the corrected authentication context.