Repository navigation
Do not allow unknown flags when unnecessary - #290
Merged
Merged
Conversation
stoned
requested review from
Joe Niland (joe-niland) and
Yonatan Koren (korenyoni)
January 1, 2023 14:07
Cloud Posse Bot (CI/CD) (cloudpossebot)
requested a review
from a team
as a code owner
January 1, 2023 14:08
Andriy Knysh (aknysh)
approved these changes
Jan 1, 2023
Erik Osterman (Cloud Posse) (osterman)
added a commit
that referenced
this pull request
Sep 9, 2026
Dependabot (within dependabot.yml's minor/patch-only policy): - js-yaml ^3 -> ^3.15.2, ^4 -> ^4.3.2 (#295, #294) - svgo ^3 -> ^3.3.5 (#293, #292) - joi ^17 -> ^17.13.6, covers both #291 and #289 - colord: new override ^2 -> ^2.9.4 (resolved to 2.10.0) (#290) CodeQL/Scorecard: - .github/workflows/codeql.yml: pin govulncheck install to v1.8.0 instead of @latest (#6050, Scorecard Pinned-Dependencies) Not auto-fixed (reported, not attempted): - #5414 (Scorecard Vulnerabilities): govulncheck confirms 3 of the 5 listed OSVs (golang.org/x/crypto/openpgp, aws-sdk-go S3 crypto SDK) have no fixed version and aren't reachable from our code paths - nothing to bump. - #6059/#5355/#5354 (unsafe-deserialization-interface): flags interface{}-based YAML/JSON decoding central to Atmos's dynamic stack config merging; forcing concrete types would be a breaking architectural change, not a mechanical fix. - #5365 (Dockerfile DS-0002, non-root USER): this image installs docker.io and manages system packages/toolchain paths at runtime; adding USER without auditing every runtime permission need risks breaking it silently. - #5341/#5342/#5343 (secrets: inherit in build.yml/feature-release.yml/ nightlybuilds.yml): established intentional pattern for this repo's internal reusable-workflow calls, not a real cross-boundary exposure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Erik Osterman (Cloud Posse) (osterman)
added a commit
that referenced
this pull request
Sep 9, 2026
- website: bump joi/js-yaml/svgo/colord via pnpm overrides to their patched versions (Dependabot #295, #294, #293, #292, #291, #290, #289 — all patch-level bumps, no major-version jump). - .github/workflows/codeql.yml: pin govulncheck install to v1.8.0 instead of @latest (CodeQL #6050, Scorecard Pinned-Dependencies). Not fixed, with reasons: - #6059/#5355/#5354 (go-unsafe-deserialization-interface): no established safe-fix pattern in this repo for this rule; needs a concrete-struct-type refactor per call site, not a mechanical fix. - #5414 (govulncheck vulnerabilities): all 3 remaining OSV entries report "Fixed in: N/A" upstream (unmaintained golang.org/x/crypto /openpgp, deprecated AWS S3 Crypto SDK) and govulncheck confirms our code doesn't call the vulnerable symbols. No fix exists to apply. - #5365 (Dockerfile DS-0002, image runs as root): existing code comment documents this as a deliberate tradeoff (setuid/setgid stripping instead of a USER directive) already considered and accepted; not a mechanical fix. - #5343/#5342/#5341 (secrets-inherit): established project pattern for these reusable workflow calls, intentionally not "fixed". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Erik Osterman (Cloud Posse) (osterman)
added a commit
that referenced
this pull request
Sep 9, 2026
… colord) Bump pnpm.overrides for four already-overridden transitive deps to their patched versions, and add a new override for colord (previously unpinned): js-yaml 3.15.1->3.15.2 and 4.3.1->4.3.2, svgo 3.3.4->3.3.5, joi 17.13.4->^17.13.6 (resolves 17.13.7), colord 2.9.3->^2.9.4 (resolves 2.10.0). All are patch/minor bumps within a single major version, so none are blocked by dependabot.yml's semver-major ignore policy. Fixes GHSA alerts #295, #294 (js-yaml), #293, #292 (svgo), #291, #289 (joi), #290 (colord). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Andriy Knysh (aknysh)
pushed a commit
to zack-is-cool/atmos
that referenced
this pull request
Sep 9, 2026
* docs: add homebrew skill for atmos formula PR workflow Codifies how to submit/fix a Homebrew/homebrew-core formula PR for atmos: the real PR template, AI/LLM disclosure rules, 50-char commit subject limit, and running brew install/test/audit locally via a disposable tap instead of a full homebrew-core clone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(secret): don't let viper.Set on --stack leak across command invocations parseScopeStack unconditionally called viper.Set(cfg.StackStr, scope.Stack) after resolving --stack, even when the value came from the flag itself. viper.Set installs a permanent override that outranks a bound CLI flag for the rest of the process, so once any secret subcommand resolved one stack this way, every later invocation silently ignored its own --stack flag and kept resolving the first one. In the cmd/secret test binary (all tests share one process/viper instance) this made tests order-dependent under `-shuffle=on`, intermittently failing the "[race] non-acceptance test suite" CI job. Only set the override when a stack was actually chosen via the interactive prompt (the one case that needs it, to make the value visible to the following --component completion) and only when non-empty, since the prompt gracefully returns "" with no error in a non-interactive context. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test(acceptance): retry terraform init in plugin-cache tests on network blips TestTerraformPluginCache failed CI (Acceptance Tests windows, shard 3/10, job 102116372680) on a transient "could not connect to registry.terraform.io" error, not a code regression - registry.terraform.io is already allowlisted in the harden-runner egress policy and the failure was fast (38.71s), not a timeout/degradation. runTerraformInitWithEnv (used by all six terraform init call sites in this file) now retries within a 90s budget via the existing pollUntil helper, absorbing a one-off DNS/TLS blip instead of failing the whole suite. A real failure still fails identically on every attempt and fails the test once the budget is spent. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(secret): stop mirroring the resolved --stack into global viper state Addresses CodeRabbit review on PR cloudposse#3081: - cmd/secret/shared.go: the previous fix only stopped v.Set(cfg.StackStr, ...) from firing on the flag-supplied path. It still fired on the interactive prompt path, and that override still outranked a later invocation's explicit --stack flag in the same process. componentCompletion/ stackCompletion aren't wired to real cobra shell completion anywhere in this codebase - they only back the missing-flag prompt - so there's no reason to bridge the resolved stack through viper at all. requireScopeComponent now gets a componentCompletionForStack(scope.Stack) closure built from the already-resolved value directly, and parseScopeStack no longer touches viper.Set for this at all. - cmd/secret/init.go: found and removed the same anti-pattern in parseInitScope's unconditional viper.GetViper().Set("stack", ...) - it had zero consumers (secret init never prompts for --component), so it was pure dead weight causing the exact same cross-invocation leak. Caught this via the strengthened regression test below, which failed against the full package precisely because of this second, unrelated leak source. - cmd/secret/enumerate.go: removed the now-fully-unused viper-reading componentCompletion (its only production caller was replaced above; its only remaining reference was its own now-removed test). - cmd/secret/enumerate_test.go: added TestComponentCompletionForStack, proving the new closure filters by its parameter and ignores a decoy global viper "stack" value. - cmd/secret/shared_test.go: strengthened TestParseScopeStack_DoesNotLeakAcrossInvocations to capture and assert the actual secretScope passed to loadServiceFn per call, not just the set values - the previous assertions could pass even if a bug resolved both invocations to the same wrong stack. - .claude/skills/homebrew/SKILL.md: replaced `base64 -d` (not portable to older macOS base64, which only accepts -D) with `openssl base64 -d -A` (works identically on macOS and Linux) at both occurrences, and replaced five hardcoded /opt/homebrew Apple-Silicon-only paths with tap_dir="$(brew --repository local/atmos-pr-test)". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test): bound terraform-init retry deadline, fix docs, retry github clone Addresses remaining CodeRabbit findings on PR cloudposse#3081 plus a new Windows CI failure: - tests/cli_plugin_cache_test.go: pollUntil only checks its deadline between attempts, so a single blocked terraform-init attempt could run for the full terraformInitTimeout (4m), well past the intended 90s terraformInitRetryBudget, and a late attempt could still succeed after that budget was meant to be spent. runTerraformInitCommandWithEnv now takes an explicit timeout, and each retry attempt gets only the time remaining in the overall budget. - docs/fixes/: renamed 2026-09-09-terraform-plugin-cache-... to 2026-09-08-... (used tomorrow's date by mistake) and updated the Date field to match; added a language tag to the log fence for markdownlint MD040. - pkg/describe/describe_affected_test.go: fixed a new CI failure (Acceptance Tests windows shard 7/10, job 102144896568) - the real GitHub clone in TestDescribeAffectedWithTargetRefClone failed with a transient net.OpError reaching github.com (0.18s failure, not a hang - a one-off DNS/TLS blip, not a config/allowlist issue). CI sets ATMOS_TEST_SKIP_PRECONDITION_CHECKS=true, so RequireGitHubAccess's reachability check is a no-op there. Added a bounded 30s retry around the clone call, mirroring the terraform-registry fix above. New doc: docs/fixes/2026-09-08-describe-affected-github-clone-network-flake.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test(secret): cover requireScopeComponent and componentCompletionForStack Codecov flagged patch coverage at 57.14% (target 85%) on the CodeRabbit- findings commit: the one changed line in requireScopeComponent (the switch to componentCompletionForStack) and componentCompletionForStack's error branch were both untested - a pre-existing gap the diff happened to touch. - requireScopeComponent had zero coverage: every existing test reaching a missing --component goes through "set"'s findGlobalSetContext shortcut, never requireScopeComponent itself. Added TestParseScope_MissingComponentViaGet using "get" (which always requires an explicit --component) to exercise it directly, and corrected the neighboring TestParseScope_MissingComponent's comment, which incorrectly claimed to cover requireScopeComponent. - componentCompletionForStack's enumerateScopesFn-error branch was untested. Added TestComponentCompletionForStack_EnumerateError. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test): enforce retry deadlines before each attempt, not just after Addresses 3 CodeRabbit findings on PR cloudposse#3081: - pkg/describe/describe_affected_test.go: the clone retry loop only checked its deadline after ExecuteDescribeAffectedWithTargetRefClone returned. A failure shortly before the deadline plus the fixed 500ms sleep could cross it, then start another full ~30s clone attempt anyway. Now checks the deadline before each attempt (for time.Now().Before(deadline)) and caps the retry sleep to the time actually remaining, matching tests/ floci_harness_test.go's pollUntil. - tests/cli_plugin_cache_test.go: pollUntil checks its own deadline only between attempts, so runTerraformInitWithEnv's remaining<=0 fallback (clamping to 1ms) could still launch a doomed terraform init subprocess instead of failing cleanly. Returns a new sentinel error (errTerraformInitRetryBudgetExhausted) instead. - tests/cli_plugin_cache_test.go: clarified an ambiguous comment on terraformInitRetryBudget per review feedback. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(security): remediate 8 Dependabot/CodeQL alerts Dependabot (within dependabot.yml's minor/patch-only policy): - js-yaml ^3 -> ^3.15.2, ^4 -> ^4.3.2 (cloudposse#295, cloudposse#294) - svgo ^3 -> ^3.3.5 (cloudposse#293, cloudposse#292) - joi ^17 -> ^17.13.6, covers both cloudposse#291 and cloudposse#289 - colord: new override ^2 -> ^2.9.4 (resolved to 2.10.0) (cloudposse#290) CodeQL/Scorecard: - .github/workflows/codeql.yml: pin govulncheck install to v1.8.0 instead of @latest (#6050, Scorecard Pinned-Dependencies) Not auto-fixed (reported, not attempted): - #5414 (Scorecard Vulnerabilities): govulncheck confirms 3 of the 5 listed OSVs (golang.org/x/crypto/openpgp, aws-sdk-go S3 crypto SDK) have no fixed version and aren't reachable from our code paths - nothing to bump. - #6059/#5355/#5354 (unsafe-deserialization-interface): flags interface{}-based YAML/JSON decoding central to Atmos's dynamic stack config merging; forcing concrete types would be a breaking architectural change, not a mechanical fix. - #5365 (Dockerfile DS-0002, non-root USER): this image installs docker.io and manages system packages/toolchain paths at runtime; adding USER without auditing every runtime permission need risks breaking it silently. - #5341/#5342/#5343 (secrets: inherit in build.yml/feature-release.yml/ nightlybuilds.yml): established intentional pattern for this repo's internal reusable-workflow calls, not a real cross-boundary exposure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
zack-is-cool
pushed a commit
to zack-is-cool/atmos
that referenced
this pull request
Sep 10, 2026
* docs: flag Homebrew FIPS gap in fips-140-mode PRD brew install atmos misses GOFIPS140 since the formula lives in homebrew-core, outside this repo's build wiring. Links the upstream fix PR opened to close the gap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: record Homebrew FIPS gap as fixed upstream Homebrew/homebrew-core#302953 merged, setting GOFIPS140=latest in the atmos formula. Updates the PRD's Homebrew note from "pending" to "fixed" and points at the merged PR instead of the earlier attempt that BrewTestBot auto-closed for template non-compliance. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(security): remediate 5 Dependabot/CodeQL alerts - website: bump joi/js-yaml/svgo/colord via pnpm overrides to their patched versions (Dependabot cloudposse#295, cloudposse#294, cloudposse#293, cloudposse#292, cloudposse#291, cloudposse#290, cloudposse#289 — all patch-level bumps, no major-version jump). - .github/workflows/codeql.yml: pin govulncheck install to v1.8.0 instead of @latest (CodeQL #6050, Scorecard Pinned-Dependencies). Not fixed, with reasons: - #6059/#5355/#5354 (go-unsafe-deserialization-interface): no established safe-fix pattern in this repo for this rule; needs a concrete-struct-type refactor per call site, not a mechanical fix. - #5414 (govulncheck vulnerabilities): all 3 remaining OSV entries report "Fixed in: N/A" upstream (unmaintained golang.org/x/crypto /openpgp, deprecated AWS S3 Crypto SDK) and govulncheck confirms our code doesn't call the vulnerable symbols. No fix exists to apply. - #5365 (Dockerfile DS-0002, image runs as root): existing code comment documents this as a deliberate tradeoff (setuid/setgid stripping instead of a USER directive) already considered and accepted; not a mechanical fix. - #5343/#5342/#5341 (secrets-inherit): established project pattern for these reusable workflow calls, intentionally not "fixed". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test): remove racy t.Parallel() from auth-disabled forwarding test Both subtests wrote JSON output through pkg/data's shared global writer singleton concurrently, racing under go test -race and cascading into ~150 unrelated FAIL lines in the [race] non-acceptance test suite CI job. Sibling tests exercising the same Execute() path already run sequentially for this reason. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
zack-is-cool
pushed a commit
to zack-is-cool/atmos
that referenced
this pull request
Sep 10, 2026
cloudposse#3082) * fix(ci): backfill missing JSON test-run entries so JUnit never reports tests="0" on a passing run `terraform test -json`'s authoritative test_summary event can report a passing run while one or more per-run test_run "complete" events never make it into data.Runs. Since both the JUnit report and the CI step-summary results table only ever iterate data.Runs, that gap silently produced tests="0" and an empty results table despite the run genuinely passing. backfillMissingTestJSONRuns reconciles data.Runs against the summary counts so the numbers stay truthful, mirroring the synthesizeFallbackRun convention already used on the text-output parsing path. Also appends a re-verification note to the 2026-08-19 emulator-endpoint fix doc: confirmed via git merge-base --is-ancestor and a fresh Docker repro that the prior job-container networking fix (cloudposse#2942, cloudposse#2960) is unaffected and already shipped in v1.228.0 -- no code change needed there. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): capture OpenTofu test runs and late assertion diagnostics in summary/JUnit The `test -json` parser only accepted a test_run/test_file event as final when it carried progress: "complete". OpenTofu never emits a progress field -- it emits one event per run/file with only the final status -- so under tofu every run and file was discarded. test_summary has the same shape in both tools, so badge counts stayed right while the results table was empty and the JUnit report said tests="0" on a passing run. Both tools also emit an assertion-failure diagnostic after the run's final event, but diagnostics were only attached when they arrived before it, so failing runs lost their message and file:line (and the ::error annotation) under Terraform as well. testEventComplete treats a bare terminal status as final; attachLateDiagnostics reconciles diagnostics that arrive after their run. The stop-gap backfill guard stays as a last resort and now warns when it fires. Regression tests use verbatim OpenTofu 1.12.5 streams; the fix doc is rewritten around the real root cause and renamed accordingly. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(ci): bound synthetic test-run backfill against oversized summary counts backfillMissingTestJSONRuns synthesized placeholder test runs bounded only by the untrusted test_summary passed/failed/errored/skipped counts from a terraform|tofu test -json stream. An oversized count (e.g. passed: 1000000000) drove an unbounded append loop that could exhaust memory or hang atmos terraform test --ci. Cap synthesized rows per status and mark the result as incomplete when truncation occurs, per CodeRabbit's review on PR cloudposse#3082. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(security): remediate 5 Dependabot npm advisories via pnpm overrides Bump website's transitive js-yaml, svgo, joi, and colord pins to their patched versions (Dependabot cloudposse#289, cloudposse#290, cloudposse#291, cloudposse#292, cloudposse#293, cloudposse#294, cloudposse#295), all within the major-version-bump policy in .github/dependabot.yml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs(fixes): address CodeRabbit precision nits on two fix docs - backfill-unbounded-synthetic-runs.md: the "compile fails when reverted" validation note only proves symbol dependency, not that the cap is behaviorally exercised; reworded to separate the two and point at the tests that actually run the oversized-count path and assert bounded output. - opentofu-runs-dropped.md: scope the "OpenTofu never emits progress" claim to the tested OpenTofu 1.12.5, matching the version already cited elsewhere in the same doc. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(security): bump containerd/containerd/v2 to remediate Dependabot cloudposse#296 github.com/containerd/containerd/v2 v2.3.3 is vulnerable per GHSA-7jxh-36q5-gcqv; bump to v2.3.5 (patched), pulling containerd/platforms and k8s.io/component-base along via go mod tidy. All indirect; within the major-version-bump policy in .github/dependabot.yml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
why