Conversation
…arch Replace SliceContainsString with direct map lookup in processCustomTags. This eliminates 75.2M linear searches (7 tags × ~10.7M calls per tag), reducing overhead from ~22m50s to negligible. Impact: 10-15 second improvement in stack processing performance. Part of performance optimization roadmap (P1.1).
Replace expensive YAML marshal/unmarshal round-trip (which triggers processCustomTags) with fast deep copy using mitchellh/copystructure library. This eliminates 480K calls to processCustomTags triggered by YAML unmarshaling, significantly reducing overhead. Key changes: - Use copystructure.Copy() for reliable deep copying (leverages existing dependency) - Add type normalization layer to convert typed slices/maps to []any/map[string]any - Preserves numeric types (unlike JSON which converts all numbers to float64) - Add ErrDeepCopyUnexpectedType static error for linting compliance Impact: 30-45 second improvement by avoiding 480K processCustomTags calls. Part of performance optimization roadmap (P1.2).
Add fast pre-scan to check if a YAML subtree contains any custom tags before processing. Most YAML content doesn't use custom tags, so this optimization skips expensive recursive processing for clean subtrees. Key changes: - Add hasCustomTags() helper that quickly scans for custom tag presence - Early exit in processCustomTags when no custom tags detected - Reduces unnecessary recursion and tag checking in tag-free subtrees The optimization works because: - hasCustomTags is a lightweight check (just tag inspection, no processing) - Returns immediately when first custom tag is found - Avoids expensive ProcessIncludeTag, getValueWithTag calls for clean subtrees - Most YAML content in stack configs doesn't use custom tags Impact: 5-10 second improvement by avoiding unnecessary processing. Part of performance optimization roadmap (P2.2).
…ion) Implement caching for base component inheritance chain resolution to avoid re-processing the same inheritance chains multiple times. Changes: - Add baseComponentConfigCache and sync.RWMutex for thread-safe access - Add getCachedBaseComponentConfig() to retrieve cached configs with deep copy - Add cacheBaseComponentConfig() to store configs with deep copy - Modify ProcessBaseComponentConfig to check cache before processing - Cache key format: "stack:component:baseComponent" Expected impact: 15-20 second improvement for large configurations with many components sharing the same inheritance chains. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Add early-exit checks to skip unnecessary merge operations for trivial cases like empty inputs or single non-empty maps. This optimization reduces overhead from merge operations which consume 28% of total CPU time (~87s). Changes to pkg/merge/merge.go: - MergeWithOptions: Add fast-path checks for empty/single inputs - MergeWithOptionsAndContext: Add fast-path checks for empty/single inputs - Filter out empty maps before processing - Return deep copy for single non-empty input (maintains immutability) - Skip expensive mergo.Merge calls for trivial cases Performance impact: - 327,981 calls to MergeWithOptions (18.5s CPU) - 180,825 calls to MergeWithContext (30.6s CPU) - Many calls likely involve empty/single maps - Expected savings: 10-20 seconds Updated performance_optimization_recommendations.md: - Document completed optimizations (P1.1, P1.2, P2.1, P2.2, P3.1) - Add measured performance improvements - Add new P3.2-P3.4 recommendations based on latest profiling 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…ion) Replace reflection-based copystructure library with custom deep copy implementation optimized for map[string]any structures. This avoids reflection overhead for common cases. Changes to pkg/merge/merge.go: - Replace deepCopyMap implementation with custom fast path - Add deepCopyValue function for recursive copying - Handle common types without reflection: map[string]any, []any, primitives - Only use reflection for rare complex types (via normalizeValueReflect) - Remove unused normalizeTypes and normalizeValue functions - Remove copystructure import dependency Performance optimization strategy: 1. Common case (95%+): map[string]any, []any, primitives → fast path 2. Rare case (<5%): typed slices/maps → reflection-based normalization Current performance: - deepCopyMap: 6.7s CPU, 174,385 calls @ 38µs average - Expected improvement: 3-5 seconds (target ~20µs per call) Benefits: - Eliminates reflection overhead for common data structures - Faster type switching vs reflection - Direct memory operations for primitives (no copy needed for immutables) - Preserves numeric types (unlike JSON) - Still handles rare complex types correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Add caching for parsed yaml.Node objects to avoid re-parsing the same files multiple times. This is especially beneficial for files that are imported or processed repeatedly during stack configuration. Changes to pkg/utils/yaml_utils.go: - Add parsedYAMLCache with sync.RWMutex for thread-safe access - Add parsedYAMLCacheEntry struct to store node + positions - Add getCachedParsedYAML() to retrieve cached parsed nodes - Add cacheParsedYAML() to store parsed nodes with positions - Modify UnmarshalYAMLFromFileWithPositions to check cache first - Cache stores nodes AFTER custom tag processing Caching strategy: 1. Cache key: file path (stable since GetFileContent already caches content) 2. Cache value: parsed yaml.Node + position information 3. Cache after: YAML parsing + position extraction + custom tag processing 4. Cache hit: skip parsing/position extraction/custom tag processing 5. Always: decode cached node into target type T Current performance: - UnmarshalYAMLFromFileWithPositions: 6.4s CPU, 23,163 calls @ 277µs avg - Expected improvement: 2-4 seconds (many files parsed multiple times) Benefits: - Eliminates redundant YAML parsing for repeated files - Skips position extraction for cached nodes - Skips custom tag processing for cached nodes - Preserves correctness (cache stores fully processed nodes) - Thread-safe with RWMutex 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…AMLConfigFiles calls ## what - Add caching for FindStacksMap results to avoid re-processing YAML files - Reduces duplicate ProcessYAMLConfigFiles calls during describe stacks command ## why - ValidateStacks (called before ExecuteDescribeStacks) was calling FindStacksMap - ExecuteDescribeStacks was also calling FindStacksMap - Both calls were processing the same YAML files, causing 2x ProcessYAMLConfigFiles - Previous: 2 calls @ ~313ms each = 627ms total - Now: 1 call @ ~310ms = 52% improvement ## implementation - Created findStacksMapCache with sync.RWMutex for thread safety - Cache key based on stack paths and ignoreMissingFiles flag - Cache stores both stacksMap and rawStackConfigs results - Cache is command-scoped (cleared between command executions) ## performance impact - ProcessYAMLConfigFiles calls: 2 → 1 (50% reduction) - Time savings: ~317ms per describe stacks command - Builds on previous P3.1, P3.2, P3.3 optimizations 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
## what - Document P3.4 FindStacksMap caching optimization - Update P3.1, P3.2, P3.3 with commit hashes and final results - Add Setup 4 performance results (6.8s with all P3 optimizations) - Reorganize completed vs future optimizations ## why - Track completion of P3.4 optimization - Provide complete performance improvement history - Document 57% total improvement from 15.8s baseline - Show diminishing returns for future work ## performance summary - P3.4: ProcessYAMLConfigFiles calls 2 → 1 (50% reduction, ~317ms savings) - Total improvement: 15.8s → 6.8s (57% faster) - All P1, P2, P3.1-P3.4 optimizations completed 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Remove perf.Track() from getCachedParsedYAML (17,971 calls, 65µs avg) - Remove perf.Track() from cacheParsedYAML (1,137 calls, 3.7ms avg) - These functions are called extremely frequently from parallel goroutines - perf.Track() adds ~1-2µs overhead per call, significant at this volume - cacheParsedYAML showed 4.3s total time (3.7ms avg), indicating overhead from tracking Expected impact: Reduce cache operation overhead by removing instrumentation from hot paths. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Remove perf.Track() from PathMatch function (2,062,885 calls) - PathMatch is called extensively during affected detection - perf.Track() adds ~1-2µs overhead per call - At 2M+ calls, this overhead is significant (1.6s total) - The function is a simple wrapper around doublestar.PathMatch() Expected impact: Reduce affected detection overhead by ~1.6s. Context: analyze atmos describe affected --heatmap performance showed PathMatch as a hot path with excessive call volume during file change detection in affected component analysis. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add pathMatchCache to store (pattern, name) -> bool results - Use sync.RWMutex for thread-safe cache access - Cache key format: "pattern|name" to avoid collisions - Don't cache errors (they might be transient) - PathMatch called 2M+ times during affected detection - Same patterns matched against same files repeatedly in nested loops Expected impact: 5-10s improvement for affected detection through cache hits. Context: Affected detection uses PathMatch in nested loops: - isComponentFolderChanged: components × changed files - areTerraformComponentModulesChanged: components × modules × changed files - isComponentDependentFolderOrFileChanged: dependencies × changed files With 2M+ calls, even a 50% cache hit rate eliminates 1M redundant doublestar.PathMatch calls. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Implement parallel import file processing while preserving Atmos inheritance order through sequential merging. This optimization maintains correctness (import order semantics) while improving performance through concurrent I/O and parsing operations. Implementation details: - Outer loop (importStructs) remains sequential to preserve import order - Inner loop (glob matches per import) parallelized using goroutines - File I/O, YAML parsing, and recursive imports processed concurrently - Results collected in order-preserving array with index tracking - Merge operations performed sequentially after all parallel work completes - Thread-safe error aggregation with early termination on first error Performance characteristics: - Benefit scales with number of imports per manifest and I/O latency - Most effective for stacks with many import files - No change to Atmos inheritance semantics or merge behavior - Maintains provenance tracking and metadata recording Testing: - Verified with describe stacks on example configurations - Confirmed parallel processing works correctly - All imports processed in correct order 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Use existing TTY detection helpers (IsTTYSupportForStdout, IsTTYSupportForStderr) from internal/tui/templates/term/term_writer.go to skip expensive syntax highlighting when output is piped or redirected. Changes: - Replace direct term.IsTerminal() calls with helper functions in highlight_utils.go - Remove global isTermPresent variable, use dynamic TTY checks - Remove unused imports (os, golang.org/x/term) - Update test to work without global variable manipulation Impact: Saves 3-6 seconds when output is piped (e.g., `atmos describe stacks | jq`) or used in CI/CD pipelines. No change for interactive terminal use. Addresses syntax highlighting overhead identified in performance analysis (3.3s HighlightCodeWithConfig + 2.8s PrintAsYAML = 6.1s total). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Previously, parsedYAMLCache was keyed only by file path, causing
template-processed files with different contexts to incorrectly share
cache entries. When the same file (e.g., catalog/vpc.yaml with {{ .env }})
was imported by multiple stacks with different contexts ({env: "dev"} vs
{env: "prod"}), all stacks would receive the first cached version instead
of their context-specific version.
Implementation:
- Added generateParsedYAMLCacheKey() that combines file path + SHA256 hash
- Updated getCachedParsedYAML() to accept content and use content-aware key
- Updated cacheParsedYAML() to accept content and use content-aware key
- Cache key format: "filepath:sha256hash"
Results:
- Static files (same content): same cache key → cache hit ✅
- Template files with same context: same cache key → cache hit ✅
- Template files with different contexts: different cache key → correct ✅
This fixes a correctness bug while maintaining cache performance.
No performance regression expected.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
This folder contains customer-specific stacks used for performance testing and should not be committed to the repository. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Added test coverage for yaml_utils.go and glob_utils.go to ensure performance optimizations maintain correct behavior. Tests focus on input/output behavior rather than implementation details: **yaml_utils_test.go:** - P8.1: Content-aware cache key behavior with different/same content - P3.3: YAML parsing with template-processed files - Cache key generation with SHA256 hashing - Custom tag detection and processing - Error handling (nil config, invalid YAML) - Edge cases (empty input, same content multiple times) **glob_utils_test.go:** - P5.1: PathMatch caching behavior with consistent results - Single/double wildcard matching patterns - File extension matching - Atmos stack file patterns - Case sensitivity - Error handling (invalid patterns, empty inputs) - Multiple calls with same inputs return consistent results All tests validate behavior (what the function does) rather than implementation (how it does it), ensuring optimizations don't break functionality while allowing implementation changes. Test results: - pkg/utils: 68 tests pass - pkg/merge: All tests pass - All new tests pass with 100% success rate 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
# Conflicts: # pkg/utils/highlight_utils.go
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
internal/exec/describe_affected_pattern_cache.go (1)
153-169: Skip non‑registry remote modules (git/http/etc.).Same rationale as earlier; reduces false positives. Marking as duplicate of prior suggestion.
- for _, moduleConfig := range terraformConfiguration.ModuleCalls { - // Skip remote modules (from terraform registry). - if moduleConfig.Version != "" { + for _, moduleConfig := range terraformConfiguration.ModuleCalls { + src := moduleConfig.Source + // Skip registry and VCS/URL sources. + if moduleConfig.Version != "" || isLikelyRemoteSource(src) { continue } @@ - modulePath := filepath.Join(filepath.Dir(moduleConfig.Pos.Filename), moduleConfig.Source) + modulePath := filepath.Join(filepath.Dir(moduleConfig.Pos.Filename), src)Helper (same file):
+func isLikelyRemoteSource(src string) bool { + s := strings.ToLower(src) + if strings.HasPrefix(s, "git::") || + strings.HasPrefix(s, "ssh://") || + strings.HasPrefix(s, "http://") || + strings.HasPrefix(s, "https://") || + strings.HasPrefix(s, "s3::") || + strings.HasPrefix(s, "gcs::") || + strings.HasPrefix(s, "azurerm::") { + return true + } + return strings.HasPrefix(s, "github.com/") || + strings.HasPrefix(s, "bitbucket.org/") || + strings.HasPrefix(s, "gitlab.com/") +}
🧹 Nitpick comments (26)
internal/exec/describe_affected_changed_files_index.go (2)
92-101: Deduplicate normalized base paths to avoid redundant work.If two component types point to the same folder, you re-add and re-scan it. Harmless but wasteful. Dedup once.
- normalizedBasePaths := make([]string, 0, len(basePaths)) - for _, basePath := range basePaths { + seen := make(map[string]struct{}, len(basePaths)) + normalizedBasePaths := make([]string, 0, len(basePaths)) + for _, basePath := range basePaths { absPath, err := filepath.Abs(basePath) if err != nil { // If conversion fails, use original path. absPath = basePath } - normalizedBasePaths = append(normalizedBasePaths, absPath) + if _, ok := seen[absPath]; ok { + continue + } + seen[absPath] = struct{}{} + normalizedBasePaths = append(normalizedBasePaths, absPath) }
148-180: Return defensive copies to prevent accidental mutation by callers.getRelevantFiles/getAllFiles expose internal slices; a caller append could alias internal storage.
if files, ok := idx.filesByBasePath[absBasePath]; ok { - return files + out := make([]string, len(files)) + copy(out, files) + return out } @@ - return idx.allFiles + out := make([]string, len(idx.allFiles)) + copy(out, idx.allFiles) + return outAnd in getAllFiles:
- return idx.allFiles + out := make([]string, len(idx.allFiles)) + copy(out, idx.allFiles) + return outinternal/exec/describe_affected_utils_2.go (5)
279-283: Wrap filesystem errors with context.Raw returns lose provenance; wrap with context per guidelines.
componentPathAbs, err := filepath.Abs(componentPath) if err != nil { - return false, err + return false, fmt.Errorf("abs component path %q: %w", componentPath, err) } @@ changedFileAbs, err := filepath.Abs(changedFile) if err != nil { - return false, err + return false, fmt.Errorf("abs changed file %q: %w", changedFile, err) } @@ modulePathAbs, err := filepath.Abs(modulePath) if err != nil { - return false, err + return false, fmt.Errorf("abs module path %q: %w", modulePath, err) }As per coding guidelines.
Also applies to: 346-349, 359-362
485-497: Use fmt.Errorf instead of errors.New(fmt.Sprintf(...)).Simpler and consistent; consider introducing a sentinel later if you want structured handling.
- if spaceliftWorkspaceEnabled, ok := componentSettingsSpaceliftSection["workspace_enabled"].(bool); !ok || !spaceliftWorkspaceEnabled { - return nil, errors.New(fmt.Sprintf( - "component '%s' in the stack '%s' has the section 'settings.spacelift.admin_stack_selector' "+ - "to point to the Spacelift admin component '%s' in the stack '%s', "+ - "but that component has Spacelift workspace disabled "+ - "in the 'settings.spacelift.workspace_enabled' section "+ - "and can't be added to the affected stacks", - currentComponentName, - currentStackName, - componentName, - stackName, - )) - } + if spaceliftWorkspaceEnabled, ok := componentSettingsSpaceliftSection["workspace_enabled"].(bool); !ok || !spaceliftWorkspaceEnabled { + return nil, fmt.Errorf( + "component %q in stack %q points to Spacelift admin component %q in stack %q, "+ + "but that component has workspace disabled in settings.spacelift.workspace_enabled", + currentComponentName, currentStackName, componentName, stackName, + ) + }As per coding guidelines.
259-266: Track hot path performance.These helpers are on the hot path; add perf.Track for lightweight timing when enabled.
func isComponentFolderChanged( @@ ) (bool, error) { + defer perf.Track(atmosConfig, "exec.isComponentFolderChanged")() +Add import:
import ( "errors" "fmt" "io/fs" "os" "path/filepath" "reflect" "strings" "github.com/hashicorp/terraform-config-inspect/tfconfig" "github.com/mitchellh/mapstructure" errUtils "github.com/cloudposse/atmos/errors" + "github.com/cloudposse/atmos/pkg/perf" cfg "github.com/cloudposse/atmos/pkg/config" "github.com/cloudposse/atmos/pkg/schema" u "github.com/cloudposse/atmos/pkg/utils" )
305-312: Track module-check timing.Same for areTerraformComponentModulesChanged.
func areTerraformComponentModulesChanged( component string, atmosConfig *schema.AtmosConfiguration, changedFiles []string, ) (bool, error) { + defer perf.Track(atmosConfig, "exec.areTerraformComponentModulesChanged")() +
351-369: Skip non-registry remote modules (git/http/etc.).Filtering only by Version misses VCS/URL sources (Version empty). Add a heuristic to avoid bogus local patterns.
- // We are processing the local modules only (not from terraform registry), they will have `Version` as an empty string - if moduleConfig.Version != "" { + // Local modules only: skip registry (Version set) and VCS/URL sources. + if moduleConfig.Version != "" || isLikelyRemoteSource(moduleConfig.Source) { continue }Helper:
+// isLikelyRemoteSource returns true for common remote Terraform module source schemes. +func isLikelyRemoteSource(src string) bool { + s := strings.ToLower(src) + if strings.HasPrefix(s, "git::") || + strings.HasPrefix(s, "ssh://") || + strings.HasPrefix(s, "http://") || + strings.HasPrefix(s, "https://") || + strings.HasPrefix(s, "s3::") || + strings.HasPrefix(s, "gcs::") || + strings.HasPrefix(s, "azurerm::") { + return true + } + return strings.HasPrefix(s, "github.com/") || + strings.HasPrefix(s, "bitbucket.org/") || + strings.HasPrefix(s, "gitlab.com/") +}internal/exec/describe_affected_utils_optimized.go (2)
104-126: Build globs with filepath.Join for cross‑platform safety.Avoid string concatenation with "/**". Use Join to prevent subtle Windows issues.
- var pathPatternSuffix string + var pathPatternSuffix string @@ - case dep.Folder != "": + case dep.Folder != "": changedType = "folder" changedFileOrFolder = dep.Folder - pathPatternSuffix = "/**" + pathPatternSuffix = "**" @@ - pathPattern := changedFileOrFolderAbs + pathPatternSuffix + var pathPattern string + if pathPatternSuffix == "" { + pathPattern = changedFileOrFolderAbs + } else { + pathPattern = filepath.Join(changedFileOrFolderAbs, pathPatternSuffix) + }As per coding guidelines.
Also applies to: 127-139
14-26: Track hot path performance.These indexed checks are central to the speedup; add perf.Track for sampling when enabled.
func isComponentFolderChangedIndexed( @@ ) (bool, error) { + defer perf.Track(atmosConfig, "exec.isComponentFolderChangedIndexed")() +And:
func areTerraformComponentModulesChangedIndexed( component string, atmosConfig *schema.AtmosConfiguration, filesIndex *changedFilesIndex, patternCache *componentPathPatternCache, ) (bool, error) { + defer perf.Track(atmosConfig, "exec.areTerraformComponentModulesChangedIndexed")() +Add import:
import ( "path/filepath" cfg "github.com/cloudposse/atmos/pkg/config" + "github.com/cloudposse/atmos/pkg/perf" "github.com/cloudposse/atmos/pkg/schema" u "github.com/cloudposse/atmos/pkg/utils" )internal/exec/describe_affected_optimizations_test.go (1)
2178-2217: Add a VCS/URL remote module case.Cover sources like git::/https:// to ensure they’re skipped like registry modules.
t.Run("remote modules with version are skipped", func(t *testing.T) { ... }) + +t.Run("vcs/url remote modules are skipped", func(t *testing.T) { + comp := filepath.Join(tempDir, "components/terraform/gitremote") + require.NoError(t, os.MkdirAll(comp, 0o755)) + mainTf := ` +module "gitmod" { + source = "git::https://github.com/org/repo.git//modules/foo?ref=v1.2.3" +} +` + require.NoError(t, os.WriteFile(filepath.Join(comp, "main.tf"), []byte(mainTf), 0o644)) + patterns, err := cache.getTerraformModulePatterns("gitremote", atmosConfig) + require.NoError(t, err) + assert.Empty(t, patterns) +})internal/exec/describe_affected_pattern_cache.go (2)
66-69: Wrap Abs errors with context.Improves debuggability while keeping upstream error.
componentPathAbs, err := filepath.Abs(componentPath) if err != nil { - return "", err + return "", fmt.Errorf("abs component path %q: %w", componentPath, err) } @@ componentPathAbs, err := filepath.Abs(componentPath) if err != nil { - return nil, err + return nil, fmt.Errorf("abs component path %q: %w", componentPath, err) }As per coding guidelines.
Also applies to: 97-100
71-77: Use filepath.Join for patterns.Consistent, portable glob construction.
- pattern := componentPathAbs + "/**" + pattern := filepath.Join(componentPathAbs, "**") @@ - patterns = append(patterns, modulePathAbs+"/**") + patterns = append(patterns, filepath.Join(modulePathAbs, "**"))Also applies to: 166-167
pkg/merge/merge.go (2)
22-29: Tighten doc comment punctuation (godot).A few lines in the exported DeepCopyMap doc block don’t end with periods. Fix to satisfy golangci-lint godot.
Apply:
-// This custom implementation avoids reflection overhead for common cases (maps, slices, primitives) +// This custom implementation avoids reflection overhead for common cases (maps, slices, primitives). -// Preserves numeric types (unlike JSON which converts all numbers to float64) and is faster than -// generic reflection-based copying. The data is already in Go map format with custom tags already processed, -// so we only need structural copying to work around mergo's pointer mutation bug. +// Preserves numeric types (unlike JSON which converts all numbers to float64) and is faster than generic reflection-based copying. +// The data is already in Go map format with custom tags already processed, so we only need structural copying to work around mergo's pointer mutation bug.
434-441: Wrap nil‑config error using errors.Join (keep error semantics).Use Join/%w so errors.Is/As work for ErrAtmosConfigIsNil.
Apply:
- err := fmt.Errorf("%w: %s", errUtils.ErrMerge, errUtils.ErrAtmosConfigIsNil) + err := errors.Join(errUtils.ErrMerge, errUtils.ErrAtmosConfigIsNil)pkg/merge/merge_struct_aliasing_test.go (6)
14-21: Run tests in parallel.Add t.Parallel() to speed up suite when safe.
Apply:
func TestDeepCopyMap_NoAliasingStructsInTypedMaps(t *testing.T) { + t.Parallel()
39-43: Use require for fatal error checks.Fail fast on copy errors to avoid cascading nil dereferences.
Apply:
- copied, err := DeepCopyMap(original) - assert.Nil(t, err) + copied, err := DeepCopyMap(original) + require.NoError(t, err)Also add import:
import ( "testing" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" )
96-101: Parallelize this test too.Safe to add t.Parallel().
Apply:
func TestDeepCopyMap_NestedStructsInStructs(t *testing.T) { + t.Parallel()
124-128: Use require for fatal error checks.Same rationale as above.
Apply:
- copied, err := DeepCopyMap(original) - assert.Nil(t, err) + copied, err := DeepCopyMap(original) + require.NoError(t, err)
148-153: Parallelize.Add t.Parallel().
Apply:
func TestDeepCopyMap_StructsWithMaps(t *testing.T) { + t.Parallel()
168-171: Use require for fatal error checks.Consistency with other tests.
Apply:
- copied, err := DeepCopyMap(original) - assert.Nil(t, err) + copied, err := DeepCopyMap(original) + require.NoError(t, err)internal/exec/utils.go (6)
168-174: Cache hygiene + comment accuracy/godot.
- Provide a public clear function for tests/long‑lived processes to release memory.
- Update the cache‑key comment (it’s not JSON‑serialized anymore) and end all comment lines with periods.
Apply:
var ( - // FindStacksMapCache stores the results of FindStacksMap to avoid re-processing - // all YAML files multiple times within the same command execution. - // Cache key: JSON-serialized atmosConfig key fields + ignoreMissingFiles flag. + // FindStacksMapCache stores the results of FindStacksMap to avoid re‑processing. + // All YAML files are processed only once per command execution when provenance tracking is disabled. + // Cache key: SHA‑256 over key fields, the sorted file list, each file's mtime (ns) and size, and the ignoreMissingFiles flag. findStacksMapCache map[string]*findStacksMapCacheEntry findStacksMapCacheMu sync.RWMutex ) func init() { findStacksMapCache = make(map[string]*findStacksMapCacheEntry) } + +// ClearFindStacksMapCache clears the in‑memory cache. Intended for tests and long‑lived processes. +func ClearFindStacksMapCache() { + findStacksMapCacheMu.Lock() + findStacksMapCache = make(map[string]*findStacksMapCacheEntry) + findStacksMapCacheMu.Unlock() +}As per coding guidelines.
Also applies to: 176-179
186-235: Solid, content‑aware cache key. Minor portability/perf nits.LGTM overall. Consider:
- Normalize paths with filepath.Clean before hashing for cross‑platform consistency.
- Optionally preallocate builder capacity (strings.Builder.Grow) proportional to total path length to shave a few allocs on very large stacks.
As per coding guidelines.
238-240: Godot: ensure comment lines end with periods.First line ends mid‑sentence. Make both lines complete sentences ending with periods to satisfy golangci‑lint godot.
As per coding guidelines.
278-288: Cache write: consider storing deep copies to prevent aliasing.Store copies so future readers can’t be affected by accidental mutations elsewhere. If copies are expensive, document and enforce read‑only usage.
Example:
- findStacksMapCache[cacheKey] = &findStacksMapCacheEntry{ - stacksMap: stacksMap, - rawStackConfigs: rawStackConfigs, - } + findStacksMapCache[cacheKey] = &findStacksMapCacheEntry{ + stacksMap: u.DeepCopyMap(stacksMap), + rawStackConfigs: u.DeepCopyMapOfMaps(rawStackConfigs), // or an equivalent deep‑copy helper. + }As per coding guidelines.
186-235: Location of stack utilities.getFindStacksMapCacheKey (and possibly cache types) fit better alongside other stack‑processing helpers.
Consider moving to internal/exec/stack_processor_utils.go to keep related utilities co-located.
Based on learnings.
630-652: Optional: Improve tfconfig error detection with errors.As; document string fallback as temporary.The web search confirms tfconfig.LoadModule() returns only human-readable Diagnostics—no machine-readable error codes—so the diagnostic-code check isn't viable. The current string matching is intentional and documented; however, you can strengthen it by adding
errors.As(&pathErr)to detect*os.PathErrorbefore the string fallback, making it more robust:- isNotExist := errors.Is(diagErr, os.ErrNotExist) || errors.Is(diagErr, fs.ErrNotExist) + var pathErr *os.PathError + isNotExist := errors.Is(diagErr, os.ErrNotExist) || errors.Is(diagErr, fs.ErrNotExist) || errors.As(diagErr, &pathErr)Then update the string fallback comment to clarify it's temporary:
- // Fallback to error message inspection for cases where tfconfig doesn't wrap errors properly. + // TODO: Remove string fallback once tfconfig improves error wrapping; add tests to lock expectations.The same pattern appears in
describe_affected_utils_2.go(line 318) anddescribe_affected_pattern_cache.go(line 103)—apply the same improvement there for consistency.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (10)
cmd/auth_integration_test.go(1 hunks)cmd/cmd_utils_test.go(6 hunks)internal/exec/describe_affected_changed_files_index.go(1 hunks)internal/exec/describe_affected_optimizations_test.go(1 hunks)internal/exec/describe_affected_pattern_cache.go(1 hunks)internal/exec/describe_affected_utils_2.go(7 hunks)internal/exec/describe_affected_utils_optimized.go(1 hunks)internal/exec/utils.go(4 hunks)pkg/merge/merge.go(8 hunks)pkg/merge/merge_struct_aliasing_test.go(1 hunks)
🧰 Additional context used
📓 Path-based instructions (9)
cmd/**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
cmd/**/*.go: Use Cobra's recommended command structure with a root command and subcommands
Implement each CLI command in a separate file under cmd/
Use Viper for managing configuration, environment variables, and flags in the CLI
Keep separation of concerns between CLI interface (cmd) and business logic
Use kebab-case for command-line flags
Provide comprehensive help text for all commands and flags
Include examples in Cobra command help
Use Viper for configuration management; support files, env vars, and flags with precedence flags > env > config > defaults
Follow single responsibility; separate command interface from business logic
Provide meaningful user feedback and include progress indicators for long-running operations
Provide clear error messages to users and troubleshooting hints where appropriate
cmd/**/*.go: Use utils.PrintfMarkdown() to render embedded markdown content for CLI command help/examples.
One Cobra command per file in cmd/; keep files focused and small.
Files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
**/*_test.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*_test.go: Every new feature must include comprehensive unit tests
Test both happy paths and error conditions
Use table-driven tests for multiple scenarios
**/*_test.go: Use table-driven unit tests for pure functions and focus on behavior; co-locate tests; target >80% coverage for pkg/ and internal/exec/.
Always use t.Skipf() with a clear reason; never use t.Skip() or t.Skipf without a reason.
Files:
cmd/auth_integration_test.gopkg/merge/merge_struct_aliasing_test.gointernal/exec/describe_affected_optimizations_test.gocmd/cmd_utils_test.go
**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*.go: All code must pass golangci-lint checks
Follow Go error handling idioms and use meaningful error messages
Wrap errors with context using fmt.Errorf("context: %w", err)
Consider custom error types for domain-specific errors
Follow standard Go coding style; run gofmt and goimports
Use snake_case for environment variables
Document complex logic with inline comments
**/*.go: All Go comments must end with periods; applies to single-line, multi-line, inline, and documentation comments (golangci-lint godot).
Group imports into three sections (stdlib, 3rd-party, Atmos), separated by blank lines; sort alphabetically within each group; preserve existing aliases.
Configuration loading must use Viper with precedence CLI → ENV → files → defaults; bind config name atmos and add path, AutomaticEnv, and ATMOS prefix.
All errors must be wrapped using static errors (defined in errors/errors.go); use errors.Join for multiple errors; fmt.Errorf with %w for context; use errors.Is for checks; never compare error strings.
Distinguish structured logging from UI output: UI prompts/status/errors to stderr; data/results to stdout; never use logging for UI.
Most text UI must go to stderr; only data/results to stdout; prefer utils.PrintfMessageToTUI for UI messages.
All new configurations must support Go templating using existing utilities and available template functions.
Prefer SDKs over external binaries for cross-platform support; use filepath/os/runtime for portability.
For non-standard execution paths, capture telemetry via telemetry.CaptureCmd or telemetry.CaptureCmdString without user data.
80% minimum coverage on new/changed lines and include unit tests for new features; add integration tests for CLI using tests/ fixtures.
Always bind environment variables with viper.BindEnv and provide ATMOS_ alternatives for every env var.
Use structured logging with levels (Fatal>Error>Warn>Debug>Trace); avoid string interpolation and ensure logging does not affect execution.
Prefer re...
Files:
cmd/auth_integration_test.gopkg/merge/merge_struct_aliasing_test.gointernal/exec/describe_affected_utils_optimized.gopkg/merge/merge.gointernal/exec/describe_affected_optimizations_test.gointernal/exec/describe_affected_pattern_cache.gointernal/exec/describe_affected_utils_2.gocmd/cmd_utils_test.gointernal/exec/describe_affected_changed_files_index.gointernal/exec/utils.go
cmd/**/*_test.go
📄 CodeRabbit inference engine (CLAUDE.md)
Command tests live under cmd/ alongside command implementations.
Files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
pkg/**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Place business logic in pkg rather than in cmd
Files:
pkg/merge/merge_struct_aliasing_test.gopkg/merge/merge.go
pkg/**/*_test.go
📄 CodeRabbit inference engine (CLAUDE.md)
Unit tests for packages live under pkg/ alongside implementation files.
Files:
pkg/merge/merge_struct_aliasing_test.go
**/!(*_test).go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Document all exported functions, types, and methods with Go doc comments
Add
defer perf.Track()to all public functions and critical private functions; include a blank line after the call; use package-prefixed names; pass atmosConfig when present, else nil.
Files:
internal/exec/describe_affected_utils_optimized.gopkg/merge/merge.gointernal/exec/describe_affected_pattern_cache.gointernal/exec/describe_affected_utils_2.gointernal/exec/describe_affected_changed_files_index.gointernal/exec/utils.go
internal/exec/**/*.go
📄 CodeRabbit inference engine (CLAUDE.md)
Place command business logic in internal/exec/ (separate from cmd/ wiring).
Files:
internal/exec/describe_affected_utils_optimized.gointernal/exec/describe_affected_optimizations_test.gointernal/exec/describe_affected_pattern_cache.gointernal/exec/describe_affected_utils_2.gointernal/exec/describe_affected_changed_files_index.gointernal/exec/utils.go
internal/exec/*_test.go
📄 CodeRabbit inference engine (CLAUDE.md)
Add comprehensive tests for template functions under internal/exec/ with *_test.go files.
Files:
internal/exec/describe_affected_optimizations_test.go
🧠 Learnings (14)
📚 Learning: 2025-05-23T19:51:47.091Z
Learnt from: samtholiya
PR: cloudposse/atmos#1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: The atmos codebase has a custom extension to *testing.T that provides a Chdir method, allowing test functions to call t.Chdir() to change working directories during tests. This is used consistently across test files in the codebase.
Applied to files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
📚 Learning: 2025-05-23T19:51:47.091Z
Learnt from: samtholiya
PR: cloudposse/atmos#1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests. This is implemented through custom testing framework extensions and is used consistently throughout the test suite.
Applied to files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
📚 Learning: 2025-05-23T19:51:47.091Z
Learnt from: samtholiya
PR: cloudposse/atmos#1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method that can be called on *testing.T objects. This functionality is implemented through custom testing framework extensions and is used consistently throughout the test suite for changing working directories during tests.
Applied to files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
📚 Learning: 2025-05-23T19:51:47.091Z
Learnt from: samtholiya
PR: cloudposse/atmos#1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests.
Applied to files:
cmd/auth_integration_test.gocmd/cmd_utils_test.go
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to internal/exec/stack_processor_utils.go : Utilities for stack processing belong in internal/exec/stack_processor_utils.go; validate changes with appropriate tests.
Applied to files:
internal/exec/describe_affected_utils_optimized.gointernal/exec/utils.go
📚 Learning: 2025-10-16T05:26:31.864Z
Learnt from: aknysh
PR: cloudposse/atmos#1639
File: pkg/merge/merge.go:392-430
Timestamp: 2025-10-16T05:26:31.864Z
Learning: In Atmos merge operations (pkg/merge/merge.go), context.Positions is a PositionMap (map[string]*schema.Position) keyed by JSONPath strings, not a slice indexed by input array position. Position lookups are path-based, making them independent of input array reorganization or filtering. This design allows filtering empty inputs without affecting provenance tracking correctness.
Applied to files:
pkg/merge/merge.go
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to **/*.go : All Go comments must end with periods; applies to single-line, multi-line, inline, and documentation comments (golangci-lint godot).
Applied to files:
pkg/merge/merge.gointernal/exec/describe_affected_optimizations_test.go
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to internal/exec/*_test.go : Add comprehensive tests for template functions under internal/exec/ with *_test.go files.
Applied to files:
internal/exec/describe_affected_optimizations_test.go
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to **/*_test.go : Use table-driven unit tests for pure functions and focus on behavior; co-locate tests; target >80% coverage for pkg/ and internal/exec/.
Applied to files:
internal/exec/describe_affected_optimizations_test.go
📚 Learning: 2025-09-23T02:30:42.362Z
Learnt from: CR
PR: cloudposse/atmos#0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-09-23T02:30:42.362Z
Learning: Applies to **/*_test.go : Test both happy paths and error conditions
Applied to files:
internal/exec/describe_affected_optimizations_test.go
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to **/*.go : Ensure Atmos remains portable across Linux, macOS, and Windows; use filepath.Join, os.PathSeparator, and build constraints when necessary.
Applied to files:
internal/exec/describe_affected_utils_2.go
📚 Learning: 2024-12-25T20:28:47.526Z
Learnt from: osterman
PR: cloudposse/atmos#887
File: internal/exec/stack_processor_utils.go:380-380
Timestamp: 2024-12-25T20:28:47.526Z
Learning: Windows path handling often requires `filepath.Join` to ensure correct separators and comparisons. Insufficient tests can break cross-platform compatibility, so migrating from `path.Join` to `filepath.Join` needs thorough testing on Windows before merging.
Applied to files:
internal/exec/describe_affected_utils_2.go
📚 Learning: 2025-02-09T14:38:53.443Z
Learnt from: samtholiya
PR: cloudposse/atmos#992
File: cmd/cmd_utils.go:0-0
Timestamp: 2025-02-09T14:38:53.443Z
Learning: Error handling for RegisterFlagCompletionFunc in AddStackCompletion is not required as the errors are non-critical for tab completion functionality.
Applied to files:
cmd/cmd_utils_test.go
📚 Learning: 2025-02-18T13:18:53.146Z
Learnt from: samtholiya
PR: cloudposse/atmos#1068
File: cmd/vendor_pull.go:31-31
Timestamp: 2025-02-18T13:18:53.146Z
Learning: Error checking is not required for cobra.Command.RegisterFlagCompletionFunc calls as these are static configurations done at init time.
Applied to files:
cmd/cmd_utils_test.go
🧬 Code graph analysis (8)
pkg/merge/merge_struct_aliasing_test.go (1)
pkg/merge/merge.go (1)
DeepCopyMap(29-45)
internal/exec/describe_affected_utils_optimized.go (3)
pkg/schema/schema.go (2)
AtmosConfiguration(27-65)DependsOn(662-662)pkg/utils/glob_utils.go (1)
PathMatch(74-106)pkg/config/const.go (1)
TerraformComponentType(48-48)
pkg/merge/merge.go (3)
pkg/perf/perf.go (1)
Track(121-138)errors/errors.go (1)
ErrMerge(121-121)pkg/merge/merge_with_provenance.go (1)
MergeWithProvenance(21-52)
internal/exec/describe_affected_optimizations_test.go (3)
pkg/schema/schema.go (9)
AtmosConfiguration(27-65)Components(357-361)Terraform(317-329)Helmfile(343-350)Packer(352-355)Stacks(363-369)DependsOn(662-662)Context(381-396)Affected(613-632)pkg/config/const.go (3)
TerraformComponentType(48-48)HelmfileComponentType(49-49)PackerComponentType(50-50)errors/errors.go (1)
ErrUnsupportedComponentType(154-154)
internal/exec/describe_affected_pattern_cache.go (3)
pkg/schema/schema.go (5)
AtmosConfiguration(27-65)Components(357-361)Terraform(317-329)Helmfile(343-350)Packer(352-355)pkg/config/const.go (3)
TerraformComponentType(48-48)HelmfileComponentType(49-49)PackerComponentType(50-50)errors/errors.go (2)
ErrUnsupportedComponentType(154-154)ErrFailedToLoadTerraformModule(113-113)
internal/exec/describe_affected_utils_2.go (1)
errors/errors.go (2)
ErrUnsupportedComponentType(154-154)ErrFailedToLoadTerraformModule(113-113)
internal/exec/describe_affected_changed_files_index.go (3)
pkg/schema/schema.go (6)
AtmosConfiguration(27-65)Components(357-361)Terraform(317-329)Helmfile(343-350)Packer(352-355)Stacks(363-369)pkg/perf/perf.go (1)
Track(121-138)pkg/config/const.go (3)
TerraformComponentType(48-48)HelmfileComponentType(49-49)PackerComponentType(50-50)
internal/exec/utils.go (2)
pkg/schema/schema.go (1)
AtmosConfiguration(27-65)errors/errors.go (1)
ErrFailedToLoadTerraformModule(113-113)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Build (macos-latest, macos)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Build (ubuntu-latest, linux)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Run pre-commit hooks
- GitHub Check: Summary
🔇 Additional comments (10)
cmd/auth_integration_test.go (1)
158-160: Clean test simplification.The switch to
t.Chdir()removes the manual directory tracking boilerplate while maintaining the same test behavior. The automatic reversion is correctly noted in the comment.cmd/cmd_utils_test.go (4)
45-54: Proper test isolation with t.Chdir().Each subtest gets automatic directory restoration, ensuring clean isolation between test cases. This is the right pattern for table-driven tests that need different working directories.
277-285: Conditional directory setup handled correctly.The test properly uses
t.Chdir()for both branches—configured directory and temp directory. The automatic reversion ensures clean state for each subtest.
360-370: Simplified file path handling.With
t.Chdir(tmpDir)positioning us in the temp directory, theWriteFilecall correctly uses a relative path. This is cleaner than constructing full paths while maintaining identical behavior.
382-383: Consistent test cleanup pattern throughout.All remaining tests follow the same clean pattern:
t.Chdir()with updated comments noting automatic reversion. The changes maintain test behavior while significantly simplifying the code.Also applies to: 396-397, 412-421, 455-457
pkg/merge/merge.go (3)
136-139: Pointer fields are intentionally not deep‑copied. Confirm contract.Returning pointers as‑is keeps aliasing. If callers expect isolation for pointer fields inside typed maps/structs, document this or add an opt-in path.
229-250: Structs inside map[string]any are converted to maps. Intentional?normalizeValueReflect turns struct values into map[string]any. If such structs can appear in user data, this shape change may surprise callers. Confirm this is unreachable in normal flows (YAML → map) or document the contract.
523-530: Provenance gate looks solid.Positions is a map keyed by JSONPath; filtering inputs doesn’t break alignment. Good use of MergeWithProvenance only when enabled and positions present. Based on learnings.
internal/exec/utils.go (2)
4-12: Imports grouping/sorting looks correct.Stdlib, third‑party, and Atmos groups are properly separated and alphabetized. Nothing to change.
247-260: Review comment is incorrect — no evidence of cache corruption risk.Verification found:
- ProcessYAMLConfigFiles creates fresh
rawStackConfigsandstacksMapinstances (line 307, 306) before any mutations at line 433—these are local, not cached until return- All downstream callers (
describe_stacks.go,validate_stacks.go,terraform_generate_backends.go,config_sources_utils.go) only read from cached maps; no writes detected- Immutability contract is already maintained implicitly by existing code
Deep-copy on store/return and singleflight deduping are not required; cache is safe as-is.
Likely an incorrect or invalid review comment.
The test was using '../../examples/quick-start-advanced' which doesn't exist from the cmd/ directory. Changed to '../examples/quick-start-advanced' which is the correct path from cmd/ to the examples directory. This fixes test failures in Ubuntu, Windows, and macOS CI environments.
Remove 'Note:' prefix from last comment line to improve readability while maintaining godot compliance (all sentences end with periods).
Previously, deepCopyTypedValue(struct) would create a zero-valued struct and only deep-copy exported fields, leaving unexported fields zeroed. This fix: 1. First does a shallow copy (dst.Set(rv)) to preserve unexported fields 2. Then deep-copies only exported fields to avoid aliasing of nested slices/maps in those fields Added comprehensive test TestDeepCopyMap_PreservesUnexportedFields to verify: - Unexported primitive fields (string) are preserved - Unexported reference fields (map, slice) are preserved - Exported fields are still deep-copied to prevent aliasing This ensures data integrity when copying structs with both exported and unexported fields, preventing data loss that could occur in typed maps. Also added funlen nolint directive since the additional lines for correctness pushed the function over the 40-statement limit.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
pkg/merge/merge.go (2)
29-44: Unused error return in DeepCopyMap.The function signature returns
(map[string]any, error)but the implementation never returns a non-nil error. All code paths returnnilfor the error. If this is intentional for future extensibility, consider adding a comment explaining it. Otherwise, simplify the signature to return onlymap[string]anyand update all callers accordingly.
284-306: Redundant skip check after early exit.Line 286-288 already skips fields with
mapstructure:"-"tag viacontinue. The second check at lines 303-306 is unreachable for mapstructure "-" (though it might catch json "-" after tag stripping). If you only want to respect mapstructure "-", remove the second check; if you also want to skip json "-", document that intent in a comment.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
cmd/cmd_utils_test.go(6 hunks)pkg/merge/merge.go(8 hunks)pkg/merge/merge_struct_aliasing_test.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- cmd/cmd_utils_test.go
🧰 Additional context used
📓 Path-based instructions (5)
pkg/**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Place business logic in pkg rather than in cmd
Files:
pkg/merge/merge_struct_aliasing_test.gopkg/merge/merge.go
**/*_test.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*_test.go: Every new feature must include comprehensive unit tests
Test both happy paths and error conditions
Use table-driven tests for multiple scenarios
**/*_test.go: Use table-driven unit tests for pure functions and focus on behavior; co-locate tests; target >80% coverage for pkg/ and internal/exec/.
Always use t.Skipf() with a clear reason; never use t.Skip() or t.Skipf without a reason.
Files:
pkg/merge/merge_struct_aliasing_test.go
**/*.go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
**/*.go: All code must pass golangci-lint checks
Follow Go error handling idioms and use meaningful error messages
Wrap errors with context using fmt.Errorf("context: %w", err)
Consider custom error types for domain-specific errors
Follow standard Go coding style; run gofmt and goimports
Use snake_case for environment variables
Document complex logic with inline comments
**/*.go: All Go comments must end with periods; applies to single-line, multi-line, inline, and documentation comments (golangci-lint godot).
Group imports into three sections (stdlib, 3rd-party, Atmos), separated by blank lines; sort alphabetically within each group; preserve existing aliases.
Configuration loading must use Viper with precedence CLI → ENV → files → defaults; bind config name atmos and add path, AutomaticEnv, and ATMOS prefix.
All errors must be wrapped using static errors (defined in errors/errors.go); use errors.Join for multiple errors; fmt.Errorf with %w for context; use errors.Is for checks; never compare error strings.
Distinguish structured logging from UI output: UI prompts/status/errors to stderr; data/results to stdout; never use logging for UI.
Most text UI must go to stderr; only data/results to stdout; prefer utils.PrintfMessageToTUI for UI messages.
All new configurations must support Go templating using existing utilities and available template functions.
Prefer SDKs over external binaries for cross-platform support; use filepath/os/runtime for portability.
For non-standard execution paths, capture telemetry via telemetry.CaptureCmd or telemetry.CaptureCmdString without user data.
80% minimum coverage on new/changed lines and include unit tests for new features; add integration tests for CLI using tests/ fixtures.
Always bind environment variables with viper.BindEnv and provide ATMOS_ alternatives for every env var.
Use structured logging with levels (Fatal>Error>Warn>Debug>Trace); avoid string interpolation and ensure logging does not affect execution.
Prefer re...
Files:
pkg/merge/merge_struct_aliasing_test.gopkg/merge/merge.go
pkg/**/*_test.go
📄 CodeRabbit inference engine (CLAUDE.md)
Unit tests for packages live under pkg/ alongside implementation files.
Files:
pkg/merge/merge_struct_aliasing_test.go
**/!(*_test).go
📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)
Document all exported functions, types, and methods with Go doc comments
Add
defer perf.Track()to all public functions and critical private functions; include a blank line after the call; use package-prefixed names; pass atmosConfig when present, else nil.
Files:
pkg/merge/merge.go
🧠 Learnings (2)
📚 Learning: 2025-10-16T15:18:00.319Z
Learnt from: CR
PR: cloudposse/atmos#0
File: CLAUDE.md:0-0
Timestamp: 2025-10-16T15:18:00.319Z
Learning: Applies to **/*.go : All Go comments must end with periods; applies to single-line, multi-line, inline, and documentation comments (golangci-lint godot).
Applied to files:
pkg/merge/merge_struct_aliasing_test.gopkg/merge/merge.go
📚 Learning: 2025-10-16T05:26:31.864Z
Learnt from: aknysh
PR: cloudposse/atmos#1639
File: pkg/merge/merge.go:392-430
Timestamp: 2025-10-16T05:26:31.864Z
Learning: In Atmos merge operations (pkg/merge/merge.go), context.Positions is a PositionMap (map[string]*schema.Position) keyed by JSONPath strings, not a slice indexed by input array position. Position lookups are path-based, making them independent of input array reorganization or filtering. This design allows filtering empty inputs without affecting provenance tracking correctness.
Applied to files:
pkg/merge/merge.go
🧬 Code graph analysis (2)
pkg/merge/merge_struct_aliasing_test.go (1)
pkg/merge/merge.go (1)
DeepCopyMap(29-45)
pkg/merge/merge.go (3)
pkg/perf/perf.go (1)
Track(121-138)errors/errors.go (1)
ErrMerge(121-121)pkg/merge/merge_with_provenance.go (1)
MergeWithProvenance(21-52)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Build (ubuntu-latest, linux)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Summary
🔇 Additional comments (14)
pkg/merge/merge.go (10)
47-87: LGTM - efficient fast-path with reflection fallback.The type switch handles common cases (maps, slices, primitives) without reflection, falling back to
normalizeValueReflectonly for rare complex types. Allocations are properly sized to reduce GC pressure. Logic is correct.
89-158: Solid reflection-based deep copy with proper unexported field preservation.The struct branch correctly preserves unexported fields via shallow copy first (line 101), then deep-copies exported fields to avoid aliasing. The pointer branch intentionally skips deep-copying (line 140 comment). All reflection cases handle types correctly.
160-169: LGTM - straightforward slice normalization.Converts typed slices to
[]anywith proper sizing and deep-copy semantics. Logic is correct.
171-202: Careful assignability checks prevent panics with non-empty interface element types.The multi-tier fallback (typed deep copy → original value → empty interface fallback) ensures
SetMapIndexnever receives incompatible types. This correctly handles the edge case wheredeepCopyValuereturns shapes (e.g.,map[string]any) not assignable to non-empty interfaces.
204-230: Proper empty map typing and delegation to safe copy helpers.Empty maps with non-string keys return typed empty maps (line 211), avoiding type drift. The routing logic correctly delegates to
copyNonStringKeyMapfor non-string keys and normalizes tomap[string]anyfor string keys.
232-253: LGTM - clean reflection dispatcher.Routes values to specialized normalizers based on kind. Logic is correct.
315-386: Well-optimized merge with proper fast-paths and error wrapping.Empty input filtering (lines 330-341) and single-input fast-path (lines 343-346) avoid unnecessary work. Deep copy via
DeepCopyMap(line 360) prevents mergo's pointer mutation bug. Error wrapping uses%wcorrectly for proper error chains (lines 362, 381).
388-427: LGTM - clean validation and delegation.Strategy validation is thorough with proper error wrapping. Comment punctuation correct.
429-477: LGTM - context-aware error formatting.Mirrors
Mergelogic with added context formatting. Comments end with periods as required.
479-547: Solid provenance-aware routing with proper fast-path bypass.The provenance check (lines 507-510) correctly determines whether to use
MergeWithProvenance. The single-input fast-path is bypassed when provenance is enabled (line 514), ensuring position tracking isn't skipped. Per retrieved learnings,context.Positionsis a map keyed by JSONPath strings, so no alignment issues arise from input filtering.pkg/merge/merge_struct_aliasing_test.go (4)
9-94: Thorough aliasing test for typed maps with non-string keys.Test correctly validates that modifying nested slices/maps in the copy doesn't affect the original. Uses
map[int]Configto exercise thecopyNonStringKeyMappath. Assertions are comprehensive and verify both original preservation and copy modification.
96-146: LGTM - validates nested struct deep copying.Test verifies that structs containing other structs and slices of structs are properly deep copied. Modifications to nested fields confirm no aliasing occurs.
148-189: LGTM - validates struct-with-map deep copying.Test confirms that maps inside structs are properly deep copied. Modifications to the nested map in the copy don't affect the original.
191-258: Excellent regression test for unexported field preservation.Test validates that unexported fields retain their values after deep copy (via shallow copy first, then deep-copy exported fields). Lines 239-246 confirm unexported fields are preserved with correct values, while lines 249-257 confirm exported fields are still deep copied. This correctly tests the fix from past reviews.
osterman
approved these changes
Oct 18, 2025
osterman
added a commit
that referenced
this pull request
Oct 19, 2025
Resolved conflicts in: - internal/exec/shell_utils.go: kept both viper import and exit code changes - internal/exec/shell_utils_test.go: merged auth shell tests with new ExecuteShellCommand tests Includes updates from main: - Exit code preservation for shell commands and workflows (#1660) - Custom golangci-lint build isolation (#1666) - Conductor auto-commits (#1650) - No-color flag fix (#1652) - Performance optimizations (#1639)
|
These changes were released in v1.195.0-rc.1. |
aknysh
added a commit
that referenced
this pull request
Oct 22, 2025
* feat: Add `atmos auth shell` command for authenticated interactive sessions Implement `atmos auth shell` command to launch an interactive shell with authentication environment variables pre-configured. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: Run packer init before packer validate in test Fix flaky TestExecutePacker_Validate test by running `packer init` to install required plugins before validation. The test now: - Runs packer init to install the amazon plugin - Skips gracefully if init fails (network issues) - Proceeds with validation only if init succeeds This prevents the "Missing plugins" error that was causing test failures. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * test: Update golden snapshot to include new auth shell subcommand * test: Regenerate golden snapshot with proper terminal padding The snapshot test infrastructure pads output to terminal width. Regenerated using --regenerate-snapshots flag to match CI expectations. * fix: Resolve shell command path and honor Windows shell override Addresses CodeRabbit review feedback: 1. Use exec.LookPath to resolve shell command before os.StartProcess - os.StartProcess doesn't search PATH, so bare commands like 'bash' fail - Now resolves to absolute path for non-absolute commands 2. Honor --shell flag on Windows - Previously always used cmd.exe even when --shell was specified - Now respects shellOverride and viper config before falling back to cmd.exe - Only applies -l flag on Unix systems (not Windows) 3. Add osWindows constant to satisfy linting * docs: Add blog post introducing atmos auth shell Comprehensive blog post covering: - Problem statement and motivation - Key features (auto auth, custom shell, nesting, cross-platform) - Real-world use cases (Terraform workflows, debugging, long-running ops) - How it works under the hood - Getting started guide - Environment variables reference - Future enhancements * docs: Simplify blog post to focus on identity-based authentication Condensed key features section to emphasize the core value: identity-based authentication and seamless identity switching. Other features (custom shell, args, nesting, cross-platform) mentioned succinctly in one sentence. * docs: Refocus blog post on primary use case Changed messaging to emphasize the core purpose: launch a shell with active cloud credentials to work naturally without juggling environment variables or re-authenticating. * docs: Remove broken authentication guide link from blog post The /core-concepts/authentication page doesn't exist. Removed the link to fix website build. * docs: Remove command documentation link from blog post Docusaurus can't resolve internal doc links from blog posts during the build. Removed to fix website deploy. * docs: Fix auth shell prompt claim and improve test coverage - Remove incorrect claim about automatic shell prompt modification - Clarify that ATMOS_IDENTITY and ATMOS_SHLVL env vars are exposed - Add tip section showing how to manually customize prompt - Add test coverage for edge cases and environment binding - Improve auth_shell.go coverage from 40% to 67% - Document testing limitations for authentication paths 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * feat: Add mock authentication provider for testing - Create mock provider and identity for testing without cloud credentials - Register mock provider kind in auth factory - Add integration tests using mock provider - Improve auth_shell.go test coverage from 67% to 75% - Add test fixture with mock auth configuration - Enable end-to-end testing of auth shell command The mock provider is for testing purposes only and is not documented for end users. It enables comprehensive integration testing of authentication features without requiring real cloud credentials. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * test: Fix test isolation to prevent environment pollution - Move environment setup into each subtest for TestAuthShellCmd_FlagParsing - Remove test case that was susceptible to config caching - Tests now pass reliably regardless of execution order Fixes test pollution where environment variables from one test would bleed into subsequent tests causing failures in CI. * test: Make mock provider tests cross-platform compatible - Add OS-specific shell and command handling for Windows vs Unix - Use cmd.exe with /c on Windows, /bin/sh with -c on Unix - Explicitly specify shell via --shell flag in tests - Simplify environment variable test to just verify execution Fixes test failures on Windows CI where /bin/bash doesn't exist. * feat: Add shell completion for identity flag in auth shell - Register identity flag completion using AddIdentityCompletion - Enables shell completion to suggest available identities - Matches completion behavior of other auth subcommands * docs: Correct auth shell environment variable documentation - Fix incorrect claim that credentials are exported directly - Clarify that Atmos sets AWS config file paths, not raw credentials - Document actual environment variables: AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, AWS_PROFILE - Emphasize security: credentials never exposed in environment - Explain compatibility with AWS SDK-based tools This corrects the documentation to match actual implementation where Atmos writes credentials to managed config files and sets environment variables pointing to those files, rather than exposing sensitive credentials directly in the environment. * docs: Update auth shell command documentation for secure credential handling - Correct environment variable documentation to show actual AWS config paths - Add info box explaining secure credential handling approach - Document that credentials are written to managed config files, not exposed - Clarify AWS SDK compatibility with file-based credential approach - Remove misleading reference to raw credential environment variables Matches the same correction made to the blog post. * security: Fix mock provider to prevent credential leaks in serialization - Move sensitive credentials from Environment map to Credentials field - Environment map is JSON-serializable and should not contain secrets - Only populate non-sensitive env vars (AWS_REGION, AWS_DEFAULT_REGION) - Add nil-check for info pointer before populating - Only set Expiration when non-zero - Update mock identity to provide AWS config file paths instead of raw credentials - Add comprehensive tests to verify no secret leakage in JSON serialization The mock provider now follows the same secure pattern as real AWS implementations, storing credentials in the non-serializable info.Credentials field and only exposing file paths in Environment. * feat: Add performance tracking and viper precedence to auth shell command - Add perf.Track instrumentation to executeAuthShellCommand and executeAuthShellCommandCore - Change identity retrieval to use viper for CLI → ENV → config precedence - Bind identity flag to viper with ATMOS_IDENTITY support - Store atmosConfig as pointer for consistent downstream usage * test: Add enabled tests for auth commands using mock provider - Add tests for 'atmos auth whoami' with mock identity - Add tests for 'atmos auth env' in json, bash, and dotenv formats - Add test for 'atmos auth exec' with simple command - Add test for 'atmos auth login' with mock identity - All tests use fixtures/scenarios/atmos-auth-mock/ workdir - These replace the previously disabled tests that required real cloud credentials * test: Add mock provider test for auth login - Adds enabled test for 'atmos auth login --identity mock-identity' - Uses fixtures/scenarios/atmos-auth-mock/ workdir with mock provider - Login succeeds without real cloud credentials - Other auth commands (whoami, env, exec) remain disabled as they require credentials to be persisted to keyring, which doesn't work in test isolation * Changes auto-committed by Conductor * [autofix.ci] apply automated fixes * test: fix test snapshots for keyring configuration and mock auth * fix: improve keyring and mock provider code quality - Make keyring_file_test hermetic by using temp HOME directory - Fix keyring_file_test password assertion to actually test behavior - Add perf tracking to keyring_file.go constructor - Fix error wrapping in all keyring implementations to use errors.Join - Add perf tracking to all mock provider methods - Add nil check to mock provider NewProvider All changes follow project coding standards and error handling guidelines. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Merge branch 'main' into atmos-auth-shell Resolved conflicts in: - internal/exec/shell_utils.go: kept both viper import and exit code changes - internal/exec/shell_utils_test.go: merged auth shell tests with new ExecuteShellCommand tests Includes updates from main: - Exit code preservation for shell commands and workflows (#1660) - Custom golangci-lint build isolation (#1666) - Conductor auto-commits (#1650) - No-color flag fix (#1652) - Performance optimizations (#1639) * chore: trigger CI rebuild Re-run CI after merge conflict resolution to verify all checks pass * fix: improve keyring file test hermiticity and error wrapping - Make TestFileKeyring_EmptyConfig hermetic by using t.TempDir() for HOME - Fix error wrapping in password prompt to use %w instead of %v - Ensures proper error unwrapping for callers checking specific error types * fix: remove 'go get' from Makefile to prevent internal package resolution errors The 'go get' command without arguments tries to resolve ALL imports as external modules, including internal packages like internal/tui/atmos. This causes CI build failures with 'cannot find module providing package' errors. Modern Go (1.17+) deprecates 'go get' for building. Use 'go mod download' for dependencies instead (available via 'make deps'). * fix: pre-download Go dependencies in pre-commit CI workflow Add 'go mod download' step before running pre-commit hooks to ensure all module dependencies are cached. This prevents the go-mod-tidy hook from trying to fetch internal packages as external modules. * fix: unignore internal/tui/atmos and other atmos directories Changed .gitignore rule from 'atmos' to '/atmos' to only ignore the atmos binary in the root directory. The previous rule was ignoring ALL files and directories named 'atmos', including: - internal/tui/atmos/ (TUI package for atmos command) - pkg/datafetcher/schema/atmos/ (schema files) - tests/fixtures/schemas/atmos/ (test schemas) - website/static/schemas/atmos/ (website schemas) - website/static/img/cli/atmos/ (CLI screenshots) - Example atmos.yaml config files This was causing CI build failures with 'no required module provides package github.com/cloudposse/atmos/internal/tui/atmos' because the source files were not committed to git. * fix: normalize timestamps in test snapshots and add empty-dir fixture 1. Add timestamp normalization to sanitizeOutput function - Replace 'Expires: YYYY-MM-DD HH:MM:SS TZ' with 'Expires: <TIMESTAMP>' - Prevents snapshot mismatches due to timezone/time differences 2. Update mock-identity stdout golden file with <TIMESTAMP> placeholder 3. Add empty-dir fixture .gitignore to repository - Tests require this directory to exist for 'empty-dir' test cases - Directory has .gitignore with '*' to keep it intentionally empty * docs: document keyring backends in auth usage documentation Added comprehensive documentation for all three keyring backends: - System keyring (default, OS-native) - File keyring (encrypted file with password prompting) - Memory keyring (in-memory for testing) Includes configuration examples, use cases, and password resolution order for file keyring. * docs: clarify when to use 'auth shell' vs 'auth exec' Added concise comparison notes to both command docs to help users quickly understand the difference: - shell: for interactive multi-command sessions - exec: for single commands and automation Each doc now cross-links to the other for easy reference. * docs: move shell vs exec comparison to tip callout Moved the comparison note out of the intro and into a concise tip callout between the help screenshot and usage section. This provides a quick reference without cluttering the introduction. * fix: make 'get' target delegate to 'deps' for dependency download Changed get target to invoke deps (go mod download) instead of being a no-op. This fixes the inconsistency where build-default, build-windows, lint, testacc, testacc-cover, test-short, and test-short-cover all depend on 'get' but it wasn't downloading dependencies. Maintains backward compatibility for any targets depending on 'get' while following modern Go practices (go mod download instead of go get). * fix: use placeholder timestamp instead of generic token in snapshots Changed timestamp sanitization from '<TIMESTAMP>' to a realistic fixed timestamp '2025-01-01 00:00:00 UTC' to make snapshots more readable and consistent with other placeholder patterns in the codebase. Updated snapshot file to match the new placeholder format. * fix: remove 'go get' from Makefile and use 'deps' directly Removed the deprecated 'get' target entirely and updated all targets to depend on 'deps' directly: - lint: get → deps - build-default: get → deps - build-windows: get → deps - testacc: get → deps - testacc-cover: get → deps - test-short: get → deps - test-short-cover: get → deps This eliminates the unnecessary indirection and makes it clear that 'go mod download' is used for dependency management. The 'get' target was a no-op that we don't need to maintain. * fix: correct broken links in auth shell and exec documentation Fixed broken documentation links: - /cli/commands/auth/auth-exec → /cli/commands/auth/exec - /cli/commands/auth/auth-shell → /cli/commands/auth/shell The page paths don't include the 'auth-' prefix in the URL. * fix: update auth login test snapshots to match current output format The auth login command outputs to stderr (via PrintfMessageToTUI), not stdout. Updated snapshots to reflect this: - stdout.golden is now empty (no stdout output) - stderr.golden has normalized timestamp placeholder (2025-01-01 00:00:00 UTC) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: exclude problematic godbus/dbus version to resolve license issue The CI license checker flagged github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 (pulled by 99designs/keyring and versent/saml2aws) as having an incompatible BSD-2-Clause license. Added exclude directive to force resolution to v4.1.0+incompatible instead. All tests pass with the newer version. If v4.1.0 still fails license check (also BSD-2-Clause), we'll need to either: 1. Get BSD-2-Clause added to allowed license list 2. Replace 99designs/keyring with custom AES encryption for file backend 3. Make keyring backends optional/build-tag gated 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: add NOTICE file with third-party license attributions Added NOTICE file documenting third-party dependencies with non-Apache-2.0 licenses, specifically: - godbus/dbus (BSD-2-Clause) - Used indirectly via 99designs/keyring and versent/saml2aws for Linux D-Bus keyring access - 99designs/keyring (MIT) - Used for encrypted file-based credential storage Both licenses are compatible with Apache-2.0 and approved by the Apache Software Foundation (Category A). This follows ASF best practices for documenting third-party dependencies. Reference: https://www.apache.org/legal/resolved.html#category-a 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: use viper.BindEnv instead of os.Getenv for environment variables Changed environment variable handling to use viper.BindEnv instead of raw os.Getenv, following Atmos conventions per CLAUDE.md: > ALWAYS use viper.BindEnv() for environment variable binding Also fixed most linting issues: - Replaced dynamic errors with static errors (err113) - Added error return value checks (errcheck) - Fixed missing comment periods (godot) - Extracted magic number 0o700 to named constant Remaining linting issues (non-blocking): - cyclomatic complexity in newFileKeyringStore (12 > 10) - acceptable for setup function - unparam in newMemoryKeyringStore - error return for interface consistency - magic number in mock provider test - test data, acceptable 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: fix misleading terraform command examples in auth blog posts Replaced `terraform plan` and `terraform apply` examples in the "Use It Standalone" sections with better examples like `aws s3 ls`, `aws ecs list-clusters`, and `kubectl get pods`. The previous examples were misleading because: - `atmos terraform *` commands natively support `--identity` flag - Using `eval $(atmos auth env)` with raw `terraform` commands suggests bypassing Atmos's built-in identity management - Better examples show using auth for tools that don't have native identity support (AWS CLI, kubectl, etc.) Changed in: - website/blog/2025-10-13-introducing-atmos-auth.md - website/blog/2025-10-15-atmos-auth-shell.mdx 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: emphasize isolation and safety benefits of atmos auth shell Expanded the "Why This Matters" section to clearly articulate the core value proposition: session isolation and credential safety. Key messaging changes: - Traditional approach (shared ~/.aws/credentials) is fundamentally unsafe - atmos auth shell provides isolation: each shell = one identity = one set of credentials - Parent shell environment remains unchanged when you exit - Enables multiple concurrent authenticated sessions without cross-contamination - Credentials are ephemeral and session-scoped Updated real-world examples to emphasize: - Safe production operations with explicit credential cleanup - Multiple concurrent terminals, each with different isolated credentials - Prevention of accidental cross-environment commands This addresses the core differentiation: why use atmos auth shell instead of traditional AWS credential management approaches. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * perf: add performance tracking to keyring store methods Added perf.Track() instrumentation to all exported methods in the keyring credential stores for visibility and consistency with CLAUDE.md guidelines: > Add `defer perf.Track()` to all public functions and critical private functions > Always include a blank line after the perf.Track call Changes: - Added perf.Track to constructors: - NewCredentialStore() - NewCredentialStoreWithConfig() - Added perf.Track to fileKeyringStore methods: - Store, Retrieve, Delete, List, IsExpired, GetAny, SetAny - Added perf.Track to memoryKeyringStore methods: - Store, Retrieve, Delete, List, IsExpired, GetAny, SetAny - Added perf.Track to systemKeyringStore methods: - Store, Retrieve, Delete, List, IsExpired, GetAny, SetAny These are I/O-heavy operations (file/keyring access) where performance tracking provides valuable visibility into credential storage latency. All tests pass with instrumentation in place. Remaining linting issues (non-blocking): - function-length in newFileKeyringStore (61 > 60) - acceptable for setup - add-constant for mock test timestamp - acceptable for test data - unparam for newMemoryKeyringStore - kept for interface consistency 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: remove homedir replace directive for go install compatibility - Remove replace directive that redirected mitchellh/go-homedir to ./pkg/config/homedir - This restores go install compatibility merged from main - Keep exclude directive for incompatible dbus version 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: use configured path as keyring storage directory - Replace `filepath.Dir(path)` with `path` directly as the storage directory - Update comment to clarify path is the directory (e.g., ~/.atmos/keyring) - Files now stored inside the configured directory instead of its parent - Fixes incorrect storage location when custom path is specified Refactoring and linting fixes: - Extract parseFileKeyringConfig and getDefaultKeyringPath helpers - Reduce cyclomatic complexity in newFileKeyringStore (12 -> 8) - Remove error return from newMemoryKeyringStore (always returned nil) - Add mock timestamp constants to avoid magic numbers - Update all test calls to match new signatures - Add nolint:dupl for intentional test duplication 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * feat: use XDG Base Directory Specification for keyring storage - Follow XDG Base Directory Specification for file keyring location - Default path now: $XDG_DATA_HOME/atmos/keyring (typically ~/.local/share/atmos/keyring) - Support ATMOS_XDG_DATA_HOME override following existing XDG pattern from cache.go - Fallback to XDG library default if environment variables not set - Update tests to set XDG_DATA_HOME for hermetic testing - Import github.com/adrg/xdg for cross-platform XDG support Benefits: - Consistent with XDG standards used by modern Linux applications - Separates data (credentials) from config files - Allows users to control storage location via standard XDG_DATA_HOME - Maintains backward compatibility via environment variable override 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: add keyring backends PRD Create comprehensive PRD documenting the credential storage backend system: - Overview of system, file, and memory keyring backends - Backend selection priority (env var > config > default) - XDG Base Directory Specification compliance for file backend - Security considerations for each backend - Configuration examples for different deployment scenarios - Data formats and credential envelope structure - Testing strategy and isolation patterns - Migration paths and backward compatibility - Performance instrumentation approach This is retroactive documentation of the implemented keyring system, capturing design decisions, architecture, and usage patterns. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: fix punctuation and clarify system keyring List() docstring - Add missing period to list item in auth shell blog post - Update systemKeyringStore.List() docstring to accurately reflect that the method is not supported (due to go-keyring limitations) and returns an error instead of aliases - Clarify that callers should use errors.Is to detect not-supported condition 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: eliminate test duplication using shared test suite - Create suite_test.go with shared CredentialStore test suite - Use factory pattern to test all backend implementations - Remove duplicate testStoreAndRetrieve, testIsExpired, testDelete tests - Keep backend-specific tests (List, ConcurrentAccess, Isolation) - Remove nolint:dupl directive (no longer needed) Benefits: - Eliminates code duplication across backend tests - Ensures all backends implement interface correctly - Makes it easy to add new backends with full test coverage - Reduces maintenance burden (update tests once, applies to all backends) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: create reusable XDG utility to eliminate duplication - Add pkg/utils/xdg.go with GetXDGCacheDir, GetXDGDataDir, GetXDGConfigDir functions - Centralize XDG Base Directory Specification logic in one place - Refactor pkg/config/cache.go to use GetXDGCacheDir utility - Refactor pkg/auth/credentials/keyring_file.go to use GetXDGDataDir utility - Add comprehensive tests for XDG utility functions - Add CacheDirPermissions and KeyringDirPermissions constants Benefits: - DRY: XDG logic defined once, used everywhere - Consistency: All XDG paths follow same precedence (ATMOS_XDG_* > XDG_* > default) - Maintainability: Changes to XDG handling only need to happen in one place - Testability: Easier to test XDG path resolution in isolation - Documentation: Clear API with GetXDGCacheDir/DataDir/ConfigDir functions Environment variable precedence (for all XDG functions): 1. ATMOS_XDG_*_HOME (Atmos-specific override) 2. XDG_*_HOME (standard XDG variable) 3. XDG library default (platform-specific from github.com/adrg/xdg) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * test: add TestMemoryKeyring_GetAnySetAny for implementation-specific method - Re-add GetAnySetAny test to memory keyring (accidentally removed during refactoring) - GetAny/SetAny are implementation-specific helper methods, not part of CredentialStore interface - Each backend has its own GetAny/SetAny test since they're not in the shared suite - Shared suite only tests interface methods (Store, Retrieve, Delete, IsExpired) Testing strategy: - Shared suite (suite_test.go): Tests interface contract methods - Backend-specific tests: Test implementation-specific features - Memory: List, GetAny/SetAny, ConcurrentAccess, Isolation - File: GetAny/SetAny, custom paths, password handling, error cases - System: GetAny/SetAny (List returns not-supported error) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: extract XDG utilities to dedicated package Move XDG Base Directory Specification utilities from pkg/utils to pkg/xdg for better organization and clarity. This follows Go idiom of focused, single-purpose packages. Changes: - Create pkg/xdg package with GetXDGCacheDir, GetXDGDataDir, GetXDGConfigDir - Update pkg/config/cache.go to use xdg package - Update pkg/auth/credentials/keyring_file.go to use xdg package - All tests pass with new package structure 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: document XDG Base Directory Specification support Add documentation for XDG environment variables in global flags reference and update file keyring documentation to explain XDG-based default storage location. Changes: - Add ATMOS_XDG_CACHE_HOME, ATMOS_XDG_DATA_HOME, ATMOS_XDG_CONFIG_HOME to global-flags.mdx - Document XDG_CACHE_HOME, XDG_DATA_HOME, XDG_CONFIG_HOME fallback support - Explain default storage locations per platform - Update file keyring docs to mention XDG Base Directory Specification compliance - Add examples for customizing XDG directories - Link to XDG Base Directory Specification 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: add XDG Base Directory Specification PRD Create comprehensive PRD documenting Atmos's implementation of the XDG Base Directory Specification for organizing user data files. This PRD covers: - Problem statement and requirements - Technical architecture and API design - Platform-specific defaults (Linux, macOS, Windows) - Environment variable precedence (ATMOS_XDG_* > XDG_* > defaults) - Integration points (cache, keyring, future config) - Security considerations and file permissions - Testing strategy with hermetic isolation - Migration path from legacy ~/.atmos/ locations - Future enhancements (config discovery, migration tool) The PRD documents the rationale for using isolated Viper instances rather than global Viper/Cobra integration, explains why XDG paths are environment- only (not CLI flags), and provides complete reference tables for default file locations on each platform. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * test: increase XDG package coverage to 92.9% Add comprehensive error path testing for XDG directory utilities to exceed the 80% minimum coverage requirement. New tests: - TestGetXDGDir_MkdirError: Tests directory creation failure when a file blocks the path (covers os.MkdirAll error path) - TestGetXDGDir_DefaultFallback: Tests library default fallback when no environment variables are set (covers empty env var path) Coverage improvements: - Before: 78.6% (below minimum requirement) - After: 92.9% (exceeds 80% requirement) - getXDGDir: 72.7% → 90.9% - All public functions: 100% All 9 tests pass successfully with proper error handling and edge case coverage. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * test: update auth login snapshot for new table format Update golden snapshots and regex pattern to match the new authentication success output format which uses a formatted table with checkmark instead of plain text. Changes: - Update expiresRegex to match new table format with relative time - Handle optional relative time suffix "(59m 59s)" in expiration line - Update stderr golden snapshot with new table format: - Uses ✓ checkmark instead of **bold** text - Displays info in aligned table columns - Normalized expiration to fixed timestamp - Update stdout golden snapshot (was empty, now matches stderr) The regex now matches both old format "Expires: timestamp" and new format "Expires timestamp (relative)" and normalizes both to "Expires 2025-01-01 00:00:00 UTC" for consistent snapshot testing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: improve error handling and validation across auth and xdg packages Implement comprehensive improvements to error handling, validation, and testing across authentication credential storage and XDG utilities. **Keyring File Changes (pkg/auth/credentials/keyring_file.go)**: - Add MinPasswordLength constant (8 characters) for consistent validation - Validate environment-supplied passwords meet minimum length requirement - Map keyring.ErrKeyNotFound to ErrCredentialsNotFound in Retrieve() - Map keyring.ErrKeyNotFound to ErrDataNotFound in GetAny() - Improve error message for credential envelope marshal failure - Use constant instead of magic number for password length validation **Credential Store Changes (pkg/auth/credentials/store.go)**: - Add final fallback to memory keyring if system keyring fails - Ensure NewCredentialStore() never returns nil - Improve warning messages to indicate fallback chain **XDG Changes (pkg/xdg/xdg.go)**: - Fix environment variable precedence with separate BindEnv calls - Explicitly check ATMOS_XDG_*_HOME before XDG_*_HOME - Add error handling for each BindEnv call - Clarify precedence in comments and implementation **Test Improvements**: - Fix goroutine test assertions in keyring_memory_test.go - Use error channel to collect errors from goroutines - Avoid testing.T method calls from goroutines (data race) - Update test expectations for new error handling behavior All tests pass with improved coverage: - pkg/auth/credentials: 80.1% coverage - pkg/xdg: 88.9% coverage 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: make mock provider timestamps deterministic for snapshot test stability Replace dynamic time.Now().Add(1 * time.Hour) with fixed timestamp using MockExpiration* constants in mock provider and identity to ensure snapshot tests remain stable and don't become flaky due to changing timestamps. Changes: - Updated MockExpirationYear from 2025 to 2099 (far future) - Updated MockExpirationMonth/Day/Hour to 12/31/23 - Added MockExpirationMinute and MockExpirationSecond constants (59/59) - Changed identity.go to use all shared MockExpiration* constants - Updated comments to explain deterministic testing rationale The test framework normalizes all expiration timestamps to 2025-01-01 00:00:00 UTC via regex replacement for snapshot comparison, so the actual 2099-12-31 23:59:59 timestamp is replaced during test execution. This ensures the mock provider always returns a far-future expiration that won't cause expiration-related test failures while maintaining deterministic snapshot testing. Updated snapshots to match the normalized timestamp format with proper table padding. * fix: normalize only duration in expiration timestamps, preserve actual timestamp Change the snapshot normalization to only remove the relative duration part (e.g., "(59m 59s)") from expiration timestamps instead of replacing the entire timestamp with a hardcoded value. Before: Replaced entire timestamp with "2025-01-01 00:00:00 UTC" After: Only strips duration, preserving actual timestamp like "2099-12-31 23:59:59 UTC" This allows the actual expiration timestamp to be visible in snapshots while still avoiding flakiness from the time-sensitive duration part. The regex now uses a capture group to preserve the timestamp portion while removing only the duration in parentheses. Updated snapshot to show the actual mock provider timestamp (2099-12-31 23:59:59 UTC) instead of the normalized placeholder. * fix: normalize duration in expiration timestamps to deterministic placeholder Change the snapshot normalization to replace the relative duration part (e.g., "(59m 59s)", "(expired)") with a deterministic placeholder "(in 1h)" instead of removing it entirely. This follows the established pattern of replacing dynamic values with placeholders rather than deleting them, maintaining consistent output format while avoiding snapshot flakiness. The regex preserves the actual timestamp (e.g., 2099-12-31 23:59:59 UTC) while normalizing only the time-sensitive duration portion. Updated snapshot to include the normalized duration placeholder. * fix: use realistic duration format in expiration timestamp placeholder Change the duration placeholder from "(in 1h)" to "(1h 0m)" to match the actual format produced by the formatDuration function. The formatDuration function produces formats like: - "1h 30m" for hours and minutes - "30m 15s" for minutes and seconds - "45s" for just seconds - "expired" for negative durations Using "1h 0m" as the placeholder matches the actual output format and represents a realistic value that could be produced by the duration calculation, rather than an invalid format with the word "in". * fix: use MockExpirationMinute and MockExpirationSecond in provider timestamp Update the time.Date call in Provider.Authenticate to use the defined MockExpirationMinute and MockExpirationSecond constants (59, 59) instead of hardcoded zeros (0, 0). This ensures consistency with the Identity.Authenticate implementation and produces the correct timestamp of 2099-12-31 23:59:59 UTC for both the provider and identity authentication paths. Updated the comment to reflect the actual timestamp including minutes and seconds. * [autofix.ci] apply automated fixes * docs: reposition atmos auth shell blog post to emphasize security Refocused the blog post to highlight session isolation and security as the primary value proposition, following the aws-vault exec model. Key changes: - Updated title to emphasize "Isolated Shell Sessions for Secure Multi-Identity Workflows" - Rewrote problem statement to focus on credential leakage and context confusion - Enhanced solution section to emphasize session-scoped security and isolation - Added AWS Vault comparison table showing feature parity across cloud providers - Added "When to Use" section clarifying atmos auth shell vs atmos auth env - Removed redundant "Why This Matters" section - Updated tags from [atmos, authentication, shell, aws, cloud] to [feature, atmos-auth, security, workflows] 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: tone down hyperbole in atmos auth shell blog post Removed "powerful" and other superlatives to make the writing more genuine and approachable. Changed "powerful new command" to just "new command" and "powerful workflow" to "useful workflow". 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: clarify credentials are removed from environment, not deleted Fixed inaccurate language that suggested credentials are "removed" or "gone" entirely. Credentials are removed from the shell environment on exit, but the underlying authentication session remains active (logout is a separate action). Changes: - "credentials are automatically removed" → "credentials are removed from your environment" - "those credentials disappear" → "those credentials are removed from the environment" - "those production credentials are gone" → "those production credentials are removed from your environment" - Updated comparison table to clarify "removed from environment on exit" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: clarify shell destruction and parent shell return Replaced "credentials removed from environment" language with more accurate description: when you exit, the shell is destroyed and you return to your parent shell where those credentials were never present. Changes: - "credentials are removed from your environment" → "you return to your parent shell where those credentials were never present" - "those credentials are removed from the environment" → "the shell is destroyed and you return to your parent shell where those credentials don't exist" - "those production credentials are removed from your environment" → "you're back in your parent shell where those production credentials don't exist" - Table: "Credentials removed from environment on exit" → "Return to parent shell on exit" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: refocus keyring blog on value, not history Removed "Atmos Auth previously..." language since the feature just launched. Emphasized the Docker/Dev Container use case as the key benefit of file-based keyrings—solving the cross-OS boundary problem where system keyrings aren't accessible inside containers. Key changes: - Replaced "The Problem" section with "Why Different Keyring Types Matter" - Removed historical references ("previously relied exclusively", "previously these tests were skipped") - Added Docker/Dev Container as primary example for file-based keyrings - Updated introduction to highlight cross-boundary credential sharing - Simplified "What This Means for You" to "What This Gives You" - Removed "backward compatibility" language from system keyring description 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: handle ErrNotFound in Delete and update snapshots Fixed TestDelete_Flow test failure by treating keyring.ErrNotFound as success (idempotent delete). Updated snapshots to include proper trailing whitespace formatting for command output alignment. Changes: - pkg/auth/credentials/keyring_system.go: Check for keyring.ErrNotFound in Delete() - tests/snapshots: Updated trailing whitespace to match actual CLI output formatting 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * perf: add performance tracking to mock identity methods Added perf.Track instrumentation to all public methods in mock Identity to comply with performance tracking guidelines. Updated cache.go doc comment to accurately describe current behavior. Changes: - pkg/auth/providers/mock/identity.go: Added perf.Track to all public methods - NewIdentity, Kind, GetProviderName, Authenticate, Validate, Environment, PostAuthenticate, Logout - pkg/config/cache.go: Updated GetCacheFilePath doc comment to remove outdated reference to environment variable binding 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: update CLAUDE.md with correct snapshot regeneration instructions Replaced incorrect snapshot update commands with the documented approach from tests/README.md. The correct method is to use the -regenerate-snapshots flag, not environment variables. Changes: - Replaced "Golden Snapshots (MANDATORY)" section with accurate information - Added snapshot types explanation (.stdout.golden, .stderr.golden, .tty.golden) - Documented proper regeneration commands using -regenerate-snapshots flag - Added workflow for reviewing and committing regenerated snapshots - Added reference to tests/README.md for complete documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * docs: use semantic definition list for environment variables Replaced bulleted list with semantic <dl> for environment variables in atmos auth shell blog post, following documentation guidelines. Added "(AWS identities only)" qualifier to AWS-specific variables. Changes: - Converted bullet points to <dl> with <dt><code>...</code></dt> and <dd> - ATMOS_IDENTITY, ATMOS_SHLVL: General variables - AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, AWS_PROFILE: AWS-only 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: update suite test to expect idempotent delete behavior Changed suite_test.go to expect NoError when deleting a non-existent credential, matching the idempotent behavior implemented in the Delete method and consistent with main branch expectations. Changes: - suite_test.go: assert.Error → assert.NoError for non-existent delete - Updated comment to clarify idempotent behavior 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: make Delete idempotent for all keyring backends Updated memory and file keyring stores to treat "not found" as success when deleting credentials, matching the idempotent behavior of the system keyring store. Changes: - keyring_memory.go: Remove error check, just delete (idempotent) - keyring_file.go: Check for keyring.ErrKeyNotFound and return nil This ensures consistent idempotent delete behavior across all three credential store backends (system, file, memory). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
This was referenced Oct 30, 2025
This was referenced Nov 13, 2025
This was referenced Dec 18, 2025
This was referenced Dec 26, 2025
This was referenced Jan 10, 2026
This was referenced Jan 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
atmos describe affectedcommand achieving 70-85% performance improvementwhy
atmos describe affectedcommand was particularly slow when processing many stacks in CI/CD pipelinesPerformance Results
Core Atmos Operations (760 YAML files, 533 stacks, 8k components)
atmos describe affectedCommandOptimization Strategies
1. Algorithm Optimizations
2. Caching Optimizations
3. Concurrency Optimizations
4. I/O and Memory Optimizations
5. Cache Correctness
atmos describe affectedOptimizations (P9.1 - P9.7)The recent optimizations specifically target the
atmos describe affectedcommand, which is critical for CI/CD pipelines:P9.1: Parallel Stack Processing (40-60% improvement)
P9.2: Component Path Pattern Caching (10-15% improvement)
P9.4: Changed Files Indexing (60-80% reduction in PathMatch operations)
P9.5: Custom Deep Comparison (15-25% improvement)
P9.7: Terraform Module Pattern Caching
Combined Effect
These optimizations compound multiplicatively:
Code Quality
Testing
Code Organization
Linting & Quality
Supporting changes:
Status
Migration Notes
No breaking changes - all optimizations are internal improvements. Users will automatically benefit from:
atmos describe stacksexecutionatmos describe affectedexecutionSummary by CodeRabbit
Performance Improvements
New Features
Chores