feat: implement source provisioner for JIT component vendoring

.golangci.yml

@@ -69,6 +69,7 @@ linters:
             - "!**/internal/aws_utils/**"
             - "!**/pkg/aws/identity/**"
             - "!**/pkg/provisioner/backend/**"
+            - "!**/pkg/github/**"
             - "$test"
           deny:
             # AWS: Identity and auth-related SDKs

CLAUDE.md

@@ -127,6 +127,12 @@ Maintain aliases: `cfg`, `log`, `u`, `errUtils`
 ### Performance Tracking (MANDATORY)
 Add `defer perf.Track(atmosConfig, "pkg.FuncName")()` + blank line to all public functions. Use `nil` if no atmosConfig param.
 
+**Exceptions (do NOT add perf.Track):**
+- Trivial getters/setters (e.g., `GetName()`, `SetValue()`)
+- Command constructor functions (e.g., `DescribeCommand()`, `ListCommand()`)
+- Simple factory functions that just return structs
+- Functions that only delegate to another tracked function
+
 ### Configuration Loading
 Precedence: CLI flags → ENV vars → config files → defaults (use Viper)
 

cmd/helmfile.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"github.com/spf13/cobra"
 
+	helmfilesource "github.com/cloudposse/atmos/cmd/helmfile/source"
 	e "github.com/cloudposse/atmos/internal/exec"
 )
 
@@ -22,6 +23,9 @@ func init() {
 	helmfileCmd.PersistentFlags().Bool("", false, doubleDashHint)
 	AddStackCompletion(helmfileCmd)
 	RootCmd.AddCommand(helmfileCmd)
+
+	// Add source subcommand from the source subpackage.
+	helmfileCmd.AddCommand(helmfilesource.GetSourceCommand())
 }
 
 func helmfileRun(cmd *cobra.Command, commandName string, args []string) error {

cmd/helmfile/source/source.go

@@ -0,0 +1,45 @@
+// Package source provides CLI commands for managing helmfile component sources.
+// This includes JIT (just-in-time) vendoring from source configuration.
+package source
+
+import (
+	"github.com/spf13/cobra"
+
+	sourcecmd "github.com/cloudposse/atmos/pkg/provisioner/source/cmd"
+)
+
+// helmfileConfig holds the component-type-specific configuration for helmfile.
+var helmfileConfig = &sourcecmd.Config{
+	ComponentType: "helmfile",
+	TypeLabel:     "Helmfile",
+}
+
+// sourceCmd represents the source command.
+var sourceCmd = &cobra.Command{
+	Use:   "source",
+	Short: "Manage Helmfile component sources (JIT vendoring)",
+	Long: `Manage Helmfile component sources defined in stack configuration.
+
+The source provisioner enables just-in-time (JIT) vendoring of component sources
+directly from stack configuration. Components can declare their source location
+inline using the source field without requiring a separate component.yaml file.
+
+Commands:
+  pull      Vendor component source (use --force to re-vendor)
+  list      List components with source in a stack
+  describe  Show source configuration for a component
+  delete    Remove vendored source directory`,
+}
+
+func init() {
+	// Add subcommands from shared package.
+	sourceCmd.AddCommand(sourcecmd.PullCommand(helmfileConfig))
+	sourceCmd.AddCommand(sourcecmd.ListCommand(helmfileConfig))
+	sourceCmd.AddCommand(sourcecmd.DescribeCommand(helmfileConfig))
+	sourceCmd.AddCommand(sourcecmd.DeleteCommand(helmfileConfig))
+}
+
+// GetSourceCommand returns the source command for parent registration.
+func GetSourceCommand() *cobra.Command {
+	return sourceCmd
+}

cmd/packer.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"github.com/spf13/cobra"
 
+	packersource "github.com/cloudposse/atmos/cmd/packer/source"
 	e "github.com/cloudposse/atmos/internal/exec"
 	u "github.com/cloudposse/atmos/pkg/utils"
 )
@@ -25,6 +26,9 @@ func init() {
 
 	AddStackCompletion(packerCmd)
 	RootCmd.AddCommand(packerCmd)
+
+	// Add source subcommand from the source subpackage.
+	packerCmd.AddCommand(packersource.GetSourceCommand())
 }
 
 func packerRun(cmd *cobra.Command, commandName string, args []string) error {

cmd/packer/source/source.go

@@ -0,0 +1,45 @@
+// Package source provides CLI commands for managing packer component sources.
+// This includes JIT (just-in-time) vendoring from source configuration.
+package source
+
+import (
+	"github.com/spf13/cobra"
+
+	sourcecmd "github.com/cloudposse/atmos/pkg/provisioner/source/cmd"
+)
+
+// packerConfig holds the component-type-specific configuration for packer.
+var packerConfig = &sourcecmd.Config{
+	ComponentType: "packer",
+	TypeLabel:     "Packer",
+}
+
+// sourceCmd represents the source command.
+var sourceCmd = &cobra.Command{
+	Use:   "source",
+	Short: "Manage Packer component sources (JIT vendoring)",
+	Long: `Manage Packer component sources defined in stack configuration.
+
+The source provisioner enables just-in-time (JIT) vendoring of component sources
+directly from stack configuration. Components can declare their source location
+inline using the source field without requiring a separate component.yaml file.
+
+Commands:
+  pull      Vendor component source (use --force to re-vendor)
+  list      List components with source in a stack
+  describe  Show source configuration for a component
+  delete    Remove vendored source directory`,
+}
+
+func init() {
+	// Add subcommands from shared package.
+	sourceCmd.AddCommand(sourcecmd.PullCommand(packerConfig))
+	sourceCmd.AddCommand(sourcecmd.ListCommand(packerConfig))
+	sourceCmd.AddCommand(sourcecmd.DescribeCommand(packerConfig))
+	sourceCmd.AddCommand(sourcecmd.DeleteCommand(packerConfig))
+}
+
+// GetSourceCommand returns the source command for parent registration.
+func GetSourceCommand() *cobra.Command {
+	return sourceCmd
+}

cmd/terraform/source/source.go

@@ -0,0 +1,45 @@
+// Package source provides CLI commands for managing terraform component sources.
+// This includes JIT (just-in-time) vendoring from source configuration.
+package source
+
+import (
+	"github.com/spf13/cobra"
+
+	sourcecmd "github.com/cloudposse/atmos/pkg/provisioner/source/cmd"
+)
+
+// terraformConfig holds the component-type-specific configuration for terraform.
+var terraformConfig = &sourcecmd.Config{
+	ComponentType: "terraform",
+	TypeLabel:     "Terraform",
+}
+
+// sourceCmd represents the source command.
+var sourceCmd = &cobra.Command{
+	Use:   "source",
+	Short: "Manage Terraform component sources (JIT vendoring)",
+	Long: `Manage Terraform component sources defined in stack configuration.
+
+The source provisioner enables just-in-time (JIT) vendoring of component sources
+directly from stack configuration. Components can declare their source location
+inline using the source field without requiring a separate component.yaml file.
+
+Commands:
+  pull      Vendor component source (use --force to re-vendor)
+  list      List components with source in a stack
+  describe  Show source configuration for a component
+  delete    Remove vendored source directory`,
+}
+
+func init() {
+	// Add subcommands from shared package.
+	sourceCmd.AddCommand(sourcecmd.PullCommand(terraformConfig))
+	sourceCmd.AddCommand(sourcecmd.ListCommand(terraformConfig))
+	sourceCmd.AddCommand(sourcecmd.DescribeCommand(terraformConfig))
+	sourceCmd.AddCommand(sourcecmd.DeleteCommand(terraformConfig))
+}
+
+// GetSourceCommand returns the source command for parent registration.
+func GetSourceCommand() *cobra.Command {
+	return sourceCmd
+}

cmd/terraform/terraform.go

@@ -9,6 +9,7 @@ import (
 	"github.com/cloudposse/atmos/cmd/internal"
 	"github.com/cloudposse/atmos/cmd/terraform/backend"
 	"github.com/cloudposse/atmos/cmd/terraform/generate"
+	"github.com/cloudposse/atmos/cmd/terraform/source"
 	"github.com/cloudposse/atmos/cmd/terraform/workdir"
 	errUtils "github.com/cloudposse/atmos/errors"
 	e "github.com/cloudposse/atmos/internal/exec"
@@ -64,6 +65,9 @@ func init() {
 	// Add backend subcommand from the backend subpackage.
 	terraformCmd.AddCommand(backend.GetBackendCommand())
 
+	// Add source subcommand from the source subpackage.
+	terraformCmd.AddCommand(source.GetSourceCommand())
+
 	// Add workdir subcommand from the workdir subpackage.
 	terraformCmd.AddCommand(workdir.GetWorkdirCommand())
 

docs/prd/component-workdir.md

@@ -393,7 +393,7 @@ terraform:
 | `ErrSourceDownload` | Failed to download component source |
 | `ErrSourceCacheRead` | Failed to read source cache |
 | `ErrSourceCacheWrite` | Failed to write source cache |
-| `ErrInvalidSource` | Invalid metadata.source configuration |
+| `ErrInvalidSource` | Invalid source configuration |
 
 ---