* Use atmos instead of makefile

* Update readme

* Update readme

* Update readme

* Added atmos readme

* Bump actions/checkout from 4 to 5

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Add CodeQL workflow for code analysis

* Delete PR Semver and Size Labeler workflows

Removed PR Semver Labels and PR Size Labeler workflows from CodeQL configuration.

* Add autofix CI workflow configuration

* Add pre-commit workflow for pull requests

* Create .pre-commit-config.yaml

* Add GolangCI-Lint configuration file

This configuration file sets up GolangCI-Lint with various linters and rules to enforce coding standards and best practices.

* Add Codecov configuration for coverage tracking

* Fix linting

* Added aqua

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Igor Rodionov <goruha@gmail.com>

…gs (#522)

* Update Atmos to 1.206.2

* Update Atmos to 1.206.2

* Update Atmos to 1.206.2

* Update docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update Atmos to v1.207.0 and fix API compatibility

- Bump github.com/cloudposse/atmos from v1.206.3 to v1.207.0
- Add nil AtmosConfiguration as first arg to MergeWithOptions calls
  (deep_merge_json and deep_merge_yaml data sources)
- Add empty ansibleComponentsBasePath param to CreateSpaceliftStacks
  and ProcessYAMLConfigFiles calls (new param in v1.207.0)
- Fix SliceOfInterfacesToSliceOfStrings call to accept single return value
- Update component_processor_test.go to import from pkg/describe
  (pkg/component was deleted in Atmos v1.201.0)
- Add 19 new tests covering MergeWithOptions with nil config,
  component processor consistency, spacelift multi-tenant/prod stacks,
  and provider utils edge cases

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* Install libudev-dev in CI for bearsh/hid cgo dependency

Atmos v1.207.0 transitively depends on github.com/bearsh/hid (via
versent/saml2aws/v2) which requires libudev-dev for cgo compilation
on Linux.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use CGO_ENABLED=0 in CI instead of installing libudev-dev

Neither the provider nor Atmos require CGO. The bearsh/hid transitive
dependency (via saml2aws) only needs libudev for USB HID access which
is not used by the provider. Disabling CGO is cleaner and produces
a static binary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Address PR review comments

- Add MergeWithOptions test with deepCopyList=true and nil config
- Fix SliceOfInterfacesToSliceOfStrings to use comma-ok idiom instead
  of bare type assertion, returning an error for non-string elements
- Add test for non-string element error handling
- Use local SliceOfInterfacesToSliceOfStrings (with error handling) in
  data_source_stack_config_yaml.go instead of atmos pkg/utils version,
  consistent with all other data sources
- Update fix doc to reflect actual API changes (ProcessComponentFromContext
  params struct, v1.207.0 target, additional signature changes)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Address CodeRabbitAI review: fix copy-paste bug, use require for guards, strengthen test assertions

- Fix pre-existing bug: backend extracted from wrong variable in test-1 stage test
- Add missing vars["environment"] assertion in TestComponentProcessorFromContextProdStack
- Switch from assert to require for guard checks before type assertions to prevent panics
- Simplify deps comparison using assert.Equal on slices directly
- Strengthen TestMergeWithOptionsDeepCopyList to verify element-wise merge semantics
- Add TestSliceOfInterfacesToSliceOfStringsNilElement for nil element coverage
- Extract buildSpaceliftStacks shared helper to avoid rebuilding 47-stack corpus 3 times

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

…ash (#523)

* Add local goreleaser config to exclude unsupported windows/arm target

Go 1.24+ dropped support for the windows/arm (32-bit) GOOS/GOARCH pair.
The shared org-wide goreleaser config includes it, causing release builds
to fail after the Go 1.23 -> 1.26 upgrade in #522.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update fix doc to reflect org-wide goreleaser fix

Document the broader scope: the windows/arm ignore rule is applied in
the shared config (cloudposse/.github), the provider's local override
(temporary), and needs to be added to atmos's local config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Serialize Atmos library calls to fix concurrent ReadDataSource crash

The Atmos library uses package-level mutable state (mergedConfigFiles in
pkg/config/load.go) that is explicitly not safe for concurrent use. When
Terraform executes multiple ReadDataSource calls in parallel (e.g., 5
concurrent utils_component_config reads), they race on the shared state,
corrupt it, and trigger CheckErrorPrintAndExit → os.Exit(1), killing the
gRPC plugin process ("Plugin did not respond").

Add a sync.Mutex to serialize all Atmos library calls across the five
data sources that use it: component_config, describe_stacks,
stack_config_yaml, spacelift_stack_config, and aws_eks_update_kubeconfig.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update fix doc: remove consumer-specific references

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Address PR review: use defer for mutex unlock, update goreleaser for v2

- Refactor describe_stacks and stack_config_yaml to use anonymous functions
  with defer atmosMu.Unlock() instead of manual unlock on each error path
- Add version: 2 header to .goreleaser.yml for GoReleaser v2 compliance
- Replace deprecated .Commit with .FullCommit in goreleaser ldflags

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

The shared release workflow (cloudposse/.github) uses GoReleaser v1,
which rejects `version: 2` configs. Revert the two v2-specific changes
introduced in #523: remove `version: 2` header and use `.Commit` instead
of `.FullCommit` in ldflags.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Update Atmos to 1.208.0

* Update Atmos to 1.208.0

* Update Atmos to 1.209.0

* Update Atmos to 1.209.0

* Update Atmos to 1.209.0

* Disable template and YAML function processing in provider

Update Atmos to v1.209.0 and pass WithProcessTemplates(false) and
WithProcessYamlFunctions(false) to both ProcessComponentInStack and
ProcessComponentFromContext. This restores the v1.31.0 behavior where
templates and YAML functions were not resolved, preventing the ETXTBSY
crash caused by child terraform init processes inside the provider plugin.

Add 4 new tests verifying the provider works correctly with processing
disabled. Update fix doc with v1 backward compatibility analysis.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* address comments

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Add manual release workflow for arbitrary tags

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix script injection risks and partial tag match in manual release workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Explicitly set --latest=false to prevent auto-promotion of backport releases

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…#529)

* Fix manual release workflow: patch goreleaser config and bump timeout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Align GoReleaser timeout with job timeout (45m)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…HEAD (#531)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Update Atmos to v1.210.1 with base path resolution fix

Upgrade Atmos from v1.209.0 to v1.210.1 which fixes base path resolution
for ATMOS_BASE_PATH and --base-path with relative paths. Add tests to
verify the new path resolution does not break provider behavior.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Use stable function references in fix doc, add runtime base path test

Replace raw line numbers with function-name references in the fix doc
so they don't drift as Atmos evolves. Add runtime-source relative base
path test to cover the core fix path from Atmos v1.210.1.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix runtime base path test to prove CWD-relative resolution

Change CWD to repo root and pass "examples/tests" as AtmosBasePath with
an explicit AtmosCliConfigPath. This ensures the test discriminates
between CWD-relative and config-dir-relative resolution: if AtmosBasePath
resolved relative to the config dir, "internal/component/examples/tests"
would not exist and the test would fail.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Ensure backend config matches for stack and context

Add assertion to verify backend config consistency.

* [autofix.ci] apply automated fixes

* Fix typo in test comment for infra/vpc component

* Delete .github/workflows/manual-release.yml

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

…ls_component_config (#535)

* feat: add process_templates and process_yaml_functions options to utils_component_config

Add two new optional boolean attributes to the utils_component_config
data source schema:

- process_templates (default: false) - enables Go template processing
- process_yaml_functions (default: false) - enables YAML function processing

These attributes replace the hardcoded false values introduced in v2.1.0
to fix the ETXTBSY crash, giving users a way to opt into template
processing when their backend configs use Go templates like
{{ .component }} or {{ getenv "..." }}.

Both default to false for backwards compatibility, preserving the
crash fix for users who don't need template processing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: support ATMOS_PROCESS_TEMPLATES and ATMOS_PROCESS_FUNCTIONS env var defaults

Allow test environments and CI pipelines to enable template/function
processing globally via environment variables without changing Terraform
code. The schema attributes still take precedence when explicitly set,
preserving per-data-source override capability.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: enable template processing by default, keep YAML functions disabled

- `process_templates` now defaults to `true` (was `false`)
- `process_yaml_functions` remains `false` to avoid ETXTBSY crashes
- Both support env var overrides (ATMOS_PROCESS_TEMPLATES, ATMOS_PROCESS_FUNCTIONS)
- Schema attributes take precedence over env vars

This restores the template processing behavior from v2.0.0 while keeping
the YAML function safety fix from v2.1.0. Component backend configs using
Go templates ({{ .component }}, {{ getenv }}) will work again without
any changes to the remote-state module or individual components.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…git (#538)

* Update Atmos to v1.211.0 with base path fallback fix for CI without .git

Atmos v1.211.0 fixes base path resolution when ATMOS_BASE_PATH is a relative path
on CI workers (e.g., Spacelift) that lack a .git directory. The tryResolveWithConfigPath
function now has os.Stat validation and source-aware CWD fallback, matching the fix
previously applied to tryResolveWithGitRoot in v1.210.1.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* address comments

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>