feat: add !aws.organization_id YAML function (#2117)

* feat: add !aws.organization_id YAML function (#2073)

Add a new `!aws.organization_id` YAML function that retrieves the AWS
Organization ID by calling the AWS Organizations DescribeOrganization API.
This complements the existing AWS context functions and is equivalent to
Terragrunt's `get_aws_org_id()`.

- Create `pkg/aws/organization/` package with Getter interface, caching,
  and mock support (parallel to `pkg/aws/identity/`)
- Register tag constants in both modern (`pkg/function/tags.go`) and
  legacy (`pkg/utils/yaml_utils.go`) layers
- Implement modern layer function in `pkg/function/aws.go`
- Implement legacy layer handler in `internal/exec/yaml_func_aws.go`
- Add routing in `internal/exec/yaml_func_utils.go`
- Add comprehensive unit tests across all three layers
- Add documentation, blog post, PRD, and roadmap update
- Update Go version references from 1.24/1.25 to 1.26

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: add Atmos Auth integration details to !aws.organization_id

Document how the function integrates with Atmos Authentication,
including auth context flow, credential resolution, stack-level
configuration, and per-auth-context caching.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* fix: add AtmosYamlFuncAwsOrganizationID to yaml_utils_test.go expected tags

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address PR review - generated mocks, nil guard, error tests, pr number

- Replace manual mocks with generated MockGetter (go.uber.org/mock) in
  organization_test.go and aws_test.go per repo conventions
- Add defensive nil/empty guard before dereferencing orgInfo in
  processTagAwsOrganizationID (legacy layer)
- Add subprocess-based error path tests for processTagAwsOrganizationID
  (getter error, nil info, empty ID all cause os.Exit)
- Wrap config-loading error with ErrAwsDescribeOrganization using
  standard ErrWrapFormat pattern
- Add pr: 2117 to roadmap milestone

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* fix: address remaining PR review comments

- Replace manual mockAWSOrganizationGetter and countingAWSOrgGetter with
  generated awsOrg.NewMockGetter(ctrl) in internal/exec tests
- Anchor -test.run regex with ^...$ in subprocess error tests
- Return wrapped error instead of empty info when Organization payload is nil
- Guard SetGetter against nil injection (falls back to defaultGetter)
- Revert golden snapshots to main (remove env-specific gh auth debug line)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: address PR review comments and improve test coverage to 95%

- Replace manual mocks with gomock-generated mocks across all test files
- Tighten mock expectations from AnyTimes() to Times(1)
- Add specific exit code assertion in subprocess error tests
- Add organizationsAPI interface + injectable factory variables for
  testable defaultGetter.GetOrganization (was 0%, now 100%)
- Add TestSetGetter_NilFallback for nil guard branch coverage
- Add 7 defaultGetter unit tests: success, nil fields, config error,
  describe error, not-in-org error, nil payload, auth context passthrough
- Regenerate mock_organization.go with both Getter and organizationsAPI
- Overall organization package coverage: 47.88% → 95.3%

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: guard nil output, collision-safe cache keys, revert snapshots

- Guard nil DescribeOrganization output before dereferencing Organization
- Add TestDefaultGetter_GetOrganization_NilOutput for the new guard
- Make cache keys collision-safe using %q with | delimiter
- Revert golden snapshots to remove env-specific gh auth debug line

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: 3 people

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.6 AS confetty
+FROM golang:1.26.0 AS confetty
 
 # Set the working directory
 WORKDIR /app

.github/actions/go-version-check/README.md

@@ -38,15 +38,15 @@ Detects and comments on Go version changes in pull requests.
 🚀 Go Version Change Detected
 
 This PR changes the Go version:
-- Base branch (main): 1.24.8
-- This PR: 1.25.0
+- Base branch (main): 1.25.0
+- This PR: 1.26.0
 - Change: ⬆️ Upgrade
 
 > [!TIP]
 > ### Upgrade Checklist
 > - [ ] Verify all CI workflows pass with new Go version
 > - [ ] Check for new language features that could be leveraged
-> - [ ] Review release notes: https://go.dev/doc/go1.25
+> - [ ] Review release notes: https://go.dev/doc/go1.26
 > - [ ] Update .tool-versions if using asdf
 > - [ ] Update Dockerfile Go version if applicable
 ```
@@ -56,8 +56,8 @@ This PR changes the Go version:
 ⚠️ Go Version Change Detected
 
 This PR changes the Go version:
-- Base branch (main): 1.25.0
-- This PR: 1.24.8
+- Base branch (main): 1.26.0
+- This PR: 1.25.0
 - Change: ⬇️ Downgrade
 
 > [!WARNING]

.golangci.yml

@@ -68,6 +68,7 @@ linters:
             - "!**/pkg/auth/types/github_oidc_credentials.go"
             - "!**/internal/aws_utils/**"
             - "!**/pkg/aws/identity/**"
+            - "!**/pkg/aws/organization/**"
             - "!**/pkg/provisioner/backend/**"
             - "!**/pkg/github/**"
             - "$test"

.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
         name: Tidy go.mod
         description: Ensure go.mod and go.sum are clean
 
-  # Run golangci-lint using system binary to avoid Go 1.25 compatibility issues
+  # Run golangci-lint using system binary to avoid Go version compatibility issues
   - repo: local
     hooks:
       - id: golangci-lint-config-verify

CLAUDE.md

@@ -400,7 +400,7 @@ Auto-enabled via `RootCmd.ExecuteC()`. Non-standard paths use `telemetry.Capture
 
 ## Development Environment
 
-**Prerequisites**: Go 1.24+, golangci-lint, Make. See `.cursor/rules/atmos-rules.mdc`.
+**Prerequisites**: Go 1.26+, golangci-lint, Make. See `.cursor/rules/atmos-rules.mdc`.
 
 **Build**: CGO disabled, cross-platform, version via ldflags, output to `./build/`
 

NOTICE

@@ -99,95 +99,99 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/aws/aws-sdk-go-v2
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/v1.41.1/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/v1.41.2/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/aws/protocol/eventstream/v1.7.4/aws/protocol/eventstream/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/aws/protocol/eventstream/v1.7.5/aws/protocol/eventstream/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/config
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/config/v1.32.7/config/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/config/v1.32.10/config/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/credentials
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.19.7/credentials/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/credentials/v1.19.10/credentials/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/feature/ec2/imds
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.18.17/feature/ec2/imds/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/ec2/imds/v1.18.18/feature/ec2/imds/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/feature/s3/manager
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/s3/manager/v1.22.0/feature/s3/manager/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/s3/manager/v1.22.4/feature/s3/manager/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/internal/configsources
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.17/internal/configsources/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/configsources/v1.4.18/internal/configsources/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.17/internal/endpoints/v2/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/endpoints/v2.7.18/internal/endpoints/v2/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/internal/ini
     License: Apache-2.0
     URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/ini/v1.8.4/internal/ini/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/internal/v4a
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/v4a/v1.4.17/internal/v4a/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/internal/v4a/v1.4.18/internal/v4a/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/ecr
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/ecr/v1.55.2/service/ecr/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/ecr/v1.55.3/service/ecr/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.4/service/internal/accept-encoding/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/accept-encoding/v1.13.5/service/internal/accept-encoding/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/internal/checksum
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/checksum/v1.9.8/service/internal/checksum/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/checksum/v1.9.10/service/internal/checksum/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.17/service/internal/presigned-url/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/presigned-url/v1.13.18/service/internal/presigned-url/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/internal/s3shared
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/s3shared/v1.19.17/service/internal/s3shared/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/internal/s3shared/v1.19.18/service/internal/s3shared/LICENSE.txt
+
+  - github.com/aws/aws-sdk-go-v2/service/organizations
+    License: Apache-2.0
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/organizations/v1.50.3/service/organizations/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/s3
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.96.0/service/s3/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.96.2/service/s3/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/secretsmanager
     License: Apache-2.0
     URL: https://github.com/aws/aws-sdk-go-v2/blob/service/secretsmanager/v1.41.1/service/secretsmanager/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/signin
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/signin/v1.0.5/service/signin/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/signin/v1.0.6/service/signin/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/ssm
     License: Apache-2.0
     URL: https://github.com/aws/aws-sdk-go-v2/blob/service/ssm/v1.67.8/service/ssm/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/sso
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.30.9/service/sso/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/sso/v1.30.11/service/sso/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/ssooidc
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.35.13/service/ssooidc/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/ssooidc/v1.35.15/service/ssooidc/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/sts
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.41.6/service/sts/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/sts/v1.41.7/service/sts/LICENSE.txt
 
   - github.com/aws/smithy-go
     License: Apache-2.0
-    URL: https://github.com/aws/smithy-go/blob/v1.24.0/LICENSE
+    URL: https://github.com/aws/smithy-go/blob/v1.24.1/LICENSE
 
   - github.com/cloudposse/atmos
     License: Apache-2.0
@@ -231,7 +235,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/containerd/stargz-snapshotter/estargz
     License: Apache-2.0
-    URL: https://github.com/containerd/stargz-snapshotter/blob/estargz/v0.18.1/estargz/LICENSE
+    URL: https://github.com/containerd/stargz-snapshotter/blob/estargz/v0.18.2/estargz/LICENSE
 
   - github.com/containerd/typeurl/v2
     License: Apache-2.0
@@ -243,7 +247,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/docker/cli/cli/config
     License: Apache-2.0
-    URL: https://github.com/docker/cli/blob/v29.0.3/LICENSE
+    URL: https://github.com/docker/cli/blob/v29.2.1/LICENSE
 
   - github.com/docker/distribution/registry/client/auth/challenge
     License: Apache-2.0
@@ -263,11 +267,11 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/go-git/go-billy/v5
     License: Apache-2.0
-    URL: https://github.com/go-git/go-billy/blob/v5.7.0/LICENSE
+    URL: https://github.com/go-git/go-billy/blob/v5.8.0/LICENSE
 
   - github.com/go-git/go-git/v5
     License: Apache-2.0
-    URL: https://github.com/go-git/go-git/blob/v5.16.5/LICENSE
+    URL: https://github.com/go-git/go-git/blob/v5.17.0/LICENSE
 
   - github.com/go-ini/ini
     License: Apache-2.0
@@ -291,7 +295,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/google/go-containerregistry
     License: Apache-2.0
-    URL: https://github.com/google/go-containerregistry/blob/v0.20.7/LICENSE
+    URL: https://github.com/google/go-containerregistry/blob/v0.21.1/LICENSE
 
   - github.com/google/renameio/v2
     License: Apache-2.0
@@ -363,15 +367,15 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/open-policy-agent/opa
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.13.1/LICENSE
+    URL: https://github.com/open-policy-agent/opa/blob/v1.14.0/LICENSE
 
   - github.com/open-policy-agent/opa/internal/gojsonschema
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.13.1/internal/gojsonschema/LICENSE-APACHE-2.0.txt
+    URL: https://github.com/open-policy-agent/opa/blob/v1.14.0/internal/gojsonschema/LICENSE-APACHE-2.0.txt
 
   - github.com/open-policy-agent/opa/internal/semver
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.13.1/internal/semver/LICENSE
+    URL: https://github.com/open-policy-agent/opa/blob/v1.14.0/internal/semver/LICENSE
 
   - github.com/opencontainers/go-digest
     License: Apache-2.0
@@ -511,7 +515,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - google.golang.org/genproto/googleapis/rpc
     License: Apache-2.0
-    URL: https://github.com/googleapis/go-genproto/blob/4cfbd4190f57/googleapis/rpc/LICENSE
+    URL: https://github.com/googleapis/go-genproto/blob/42d3e9bedb6d/googleapis/rpc/LICENSE
 
   - google.golang.org/grpc
     License: Apache-2.0
@@ -568,15 +572,15 @@ BSD LICENSED DEPENDENCIES
 
   - github.com/aws/aws-sdk-go-v2/internal/sync/singleflight
     License: BSD-3-Clause
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/v1.41.1/internal/sync/singleflight/LICENSE
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/v1.41.2/internal/sync/singleflight/LICENSE
 
   - github.com/aws/aws-sdk-go/internal/sync/singleflight
     License: BSD-3-Clause
     URL: https://github.com/aws/aws-sdk-go/blob/v1.55.8/internal/sync/singleflight/LICENSE
 
   - github.com/aws/smithy-go/internal/sync/singleflight
     License: BSD-3-Clause
-    URL: https://github.com/aws/smithy-go/blob/v1.24.0/internal/sync/singleflight/LICENSE
+    URL: https://github.com/aws/smithy-go/blob/v1.24.1/internal/sync/singleflight/LICENSE
 
   - github.com/bearsh/hid/hidapi
     License: BSD-3-Clause
@@ -688,7 +692,7 @@ BSD LICENSED DEPENDENCIES
 
   - github.com/open-policy-agent/opa/internal/edittree/bitvector
     License: BSD-3-Clause
-    URL: https://github.com/open-policy-agent/opa/blob/v1.13.1/internal/edittree/bitvector/license.txt
+    URL: https://github.com/open-policy-agent/opa/blob/v1.14.0/internal/edittree/bitvector/license.txt
 
   - github.com/pierrec/lz4/v4
     License: BSD-3-Clause
@@ -788,11 +792,11 @@ BSD LICENSED DEPENDENCIES
 
   - google.golang.org/api
     License: BSD-3-Clause
-    URL: https://github.com/googleapis/google-api-go-client/blob/v0.266.0/LICENSE
+    URL: https://github.com/googleapis/google-api-go-client/blob/v0.269.0/LICENSE
 
   - google.golang.org/api/internal/third_party/uritemplates
     License: BSD-3-Clause
-    URL: https://github.com/googleapis/google-api-go-client/blob/v0.266.0/internal/third_party/uritemplates/LICENSE
+    URL: https://github.com/googleapis/google-api-go-client/blob/v0.269.0/internal/third_party/uritemplates/LICENSE
 
   - google.golang.org/protobuf
     License: BSD-3-Clause
@@ -917,7 +921,7 @@ MOZILLA PUBLIC LICENSE (MPL) 2.0 DEPENDENCIES
 
   - github.com/hashicorp/terraform-config-inspect/tfconfig
     License: MPL-2.0
-    URL: https://github.com/hashicorp/terraform-config-inspect/blob/f4be3ba97d94/LICENSE
+    URL: https://github.com/hashicorp/terraform-config-inspect/blob/813a97530220/LICENSE
 
   - github.com/hashicorp/terraform-exec
     License: MPL-2.0
@@ -1242,7 +1246,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/getsentry/sentry-go
     License: MIT
-    URL: https://github.com/getsentry/sentry-go/blob/v0.42.0/LICENSE
+    URL: https://github.com/getsentry/sentry-go/blob/v0.43.0/LICENSE
 
   - github.com/go-logfmt/logfmt
     License: MIT
@@ -1442,7 +1446,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/mattn/go-runewidth
     License: MIT
-    URL: https://github.com/mattn/go-runewidth/blob/v0.0.19/LICENSE
+    URL: https://github.com/mattn/go-runewidth/blob/v0.0.20/LICENSE
 
   - github.com/mgutz/ansi
     License: MIT
@@ -1630,7 +1634,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/zclconf/go-cty/cty
     License: MIT
-    URL: https://github.com/zclconf/go-cty/blob/v1.17.0/LICENSE
+    URL: https://github.com/zclconf/go-cty/blob/v1.18.0/LICENSE
 
   - github.com/zealic/xignore
     License: MIT

demo/screengrabs/Makefile

@@ -28,10 +28,10 @@ docker-build:
 		set -e && \
 		apt-get update -qq && \
 		DEBIAN_FRONTEND=noninteractive apt-get install -y -qq aha make wget tar tree && \
-		echo "Installing Go 1.25..." && \
+		echo "Installing Go 1.26..." && \
 		ARCH=$$(uname -m | sed "s/x86_64/amd64/; s/aarch64/arm64/") && \
-		wget -q https://go.dev/dl/go1.25.0.linux-$$ARCH.tar.gz && \
-		tar -C /usr/local -xzf go1.25.0.linux-$$ARCH.tar.gz && \
+		wget -q https://go.dev/dl/go1.26.0.linux-$$ARCH.tar.gz && \
+		tar -C /usr/local -xzf go1.26.0.linux-$$ARCH.tar.gz && \
 		export PATH=/usr/local/go/bin:$$PATH && \
 		go version && \
 		echo "Building atmos from source..." && \

docs/development.md

@@ -4,7 +4,7 @@ This guide covers the development workflow for contributing to Atmos.
 
 ## Prerequisites
 
-- Go 1.24+ (see go.mod for exact version)
+- Go 1.26+ (see go.mod for exact version)
 - Make
 - Git