cloudposse/atmos v1.235.0-nightly.43659219335 on GitHub

📦 Other Changes

chore: bump Claude Code plugin version to v1.234.1 @cloudposse-releaser[bot] (#3664)

fix(ci): render release PR comments as markdown, not a code block @osterman (#3679)

Release notification comments are now rendered as Markdown instead of indented code blocks, keeping the hidden marker out of the visible text and release links clickable.

Add Anthropic OSS Scanner build files @osterman (#3680)

Added .oss-scanner/Dockerfile and .oss-scanner/threat_model.md for Anthropic's OSS Scanner, including a pinned Atmos release, a source build, and compiled tests for the offline audit. This adds repository build metadata only; it does not change Atmos code or runtime behavior.

feat(ci): add native Gitea Actions CI provider @osterman (#3656)

Added a native gitea-actions CI provider, selected with GITEA_ACTIONS=true, for Gitea commit statuses, marker-based pull request comments, affected-component detection, runner outputs and summaries, and Gitea metadata. It uses ATMOS_CI_GITEA_TOKEN or GITEA_TOKEN, supports configurable API URLs with HTTPS by default, and avoids GitHub provider and artifact-store selection; remote Actions cache, Checks annotations, commit comments, and merged-PR plan provenance remain unsupported.

feat(starlark): add browser.open for launching URLs from scripts @osterman (#3658)

Starlark scripts can now call browser.open(url) to launch validated absolute http or https URLs in the system browser. Invalid URLs, dry runs, and canceled executions are rejected or skipped, and launch failures fail the script.

feat(container): support IP:port host mappings @osterman (#3660)

Container port mappings now accept address-and-port values such as host: "127.0.0.1:8080" with container: 3000, including bracketed IPv6 addresses. Numeric ports remain supported, automatic assignment can be restricted to a host address, and malformed or out-of-range host ports are rejected before runtime operations across container components, workflow sandboxes, background services, and emulators.

feat(git): add --ref to atmos git clone for exact commit/tag checkout @osterman (#3661)

Added --ref (or ATMOS_GIT_REF) to atmos git clone to fetch and check out an exact branch, tag, full ref, or commit SHA in detached mode. It reconciles existing checkouts to the requested revision, overrides configured or CI branches, cannot be combined with --branch, and is blocked for elevated fork events unless --allow-unsafe-fork is set.

fix(auth): keep long AWS SSO verification URLs out of the dialog box @osterman (#3667)

AWS SSO verification URLs longer than 80 columns are now displayed outside the authentication dialog. Configure delivery with settings.terminal.links, ATMOS_TERMINAL_LINKS, or global --links using auto, osc8, clipboard, or raw; atmos auth console uses the same behavior when it cannot open a browser, while --print-only still emits the bare URL.

fix(ci): parse terraform plans that import, move or replace resources @osterman (#3666)

Terraform plan parsing now reports import, move, and replacement changes correctly, handles for_each keys with spaces, tainted, deposed, and imported resources, and treats create_before_destroy as one replacement. Apply outputs with hyphens, brackets, or heredocs are also preserved, and attribute values containing No changes. no longer make a plan appear empty.

feat(stores): add operation-scoped Vault identity cleanup @noeljackson (#3668)

Vault and OpenBao stores support opt-in options.identity_lifetime: operation, which authenticates an isolated target identity and logs it out before returning secrets while preserving existing sessions. Results are blocked when cleanup fails, and bounded cleanup runs during SIGINT/SIGTERM cancellation; session remains the default.

fix: correct command discovery and quick-start examples @osterman (#3670)

Configured command aliases now forward discovery flags to their target commands, including subcommands.
Removed redundant spinner steps from advanced quick-start workflows and their documentation.
Generated Markdown now keeps definition descriptions and inline code together.

fix(telemetry): degrade config-load failures to DEBUG instead of WARN @aknysh (#3671)

Telemetry config-load failures are now logged at DEBUG instead of WARN, so commands such as atmos version no longer show a user-facing warning when ATMOS_PROFILE refers to a missing profile. Command-level configuration errors remain unchanged.

fix(eks): preserve region and working directory in kubeconfig @osterman (#3675)

EKS kubeconfig generation now derives an omitted region from the returned cluster ARN and preserves the effective absolute working directory in ATMOS_CHDIR for direct identity and integration modes. Existing kubeconfigs may need to be regenerated to include this authentication context.