v1.223.0-rc.6

feat: format-preserving YAML edits + Atmos Version Tracker Erik Osterman (Cloud Posse) (@osterman) (#2664)

## what

Format-preserving YAML editing — a shared, format-preserving YAML editing engine in pkg/yaml (built on the yqlib library Atmos already vendors, fed raw bytes) with Get / Set / Delete / Eval / Query / Format plus atomic file wrappers:

• Edits preserve comments, anchors/aliases, Atmos YAML functions (!terraform.output, !env, !store, …), and Go/Gomplate templates ({{ … }}); a strict guard rejects edits that would alter or expand a YAML anchor.
• Three dot-notation command groups on top of the engine, each with a canonical get|set|delete|format|list interface and shorthand aliases for the common case:
  • atmos config get|set|delete|format|list <path> — edits the active atmos.yaml. (No separate config sub-namespace — this domain's flat form is the canonical form.)
  • atmos stack config get|set|delete|format|list <path> -s <stack> -c <component> (canonical) / atmos stack get|set|delete|format (alias) — uses provenance to resolve the manifest that actually defines the effective (post-merge) value. list only exists under config: a flat atmos stack list would collide with the existing atmos list stacks.
  • atmos vendor config get|set|delete|format|list <path> (canonical) / atmos vendor get|set <component> [version] (alias) — the alias resolves the component name to its spec.sources[N].version path and delegates to the same engine; the canonical form addresses any path in the manifest.
• atmos vendor update / atmos vendor diff on the same engine (check Git sources for newer versions, honoring semver constraints; diff two versions without a local checkout).
• --type flag coerces values (string/int/bool/float/null/yaml).
• New PRD (docs/prd/yaml-editing-get-set.md), Docusaurus docs, changelog blog post, and roadmap milestone.

Atmos Version Tracker (#2688) — one catalog of software versions (local tools, GitHub Actions, OCI images, release tags, and other packages), declared under named tracks in atmos.yaml, resolved into a deterministic versions.lock.yaml:

• atmos version track add|set|get|list|show|status|update|verify|remove|apply|render commands.
• Policy-driven updates: strategy caps, cooldown windows, include/exclude rules, prerelease policy.
• SHA/digest pinning writes round-trippable @<sha> # <version> references.
• File managers rewrite GitHub Actions workflows, marker-annotated files, and templates in place; atmos version track apply --check acts as a CI drift gate.
• New PRD (docs/prd/atmos-version-management.md), Docusaurus docs, changelog blog post, and roadmap milestone.

Supporting work merged onto this branch:

• Raised unit test coverage across cmd/stack (46.8%→85.7%), cmd/config (61.7%→87.2%), cmd/vendor (62.1%→86.3%), pkg/yaml (94.4%→96.0%), and pkg/list/renderer (88.7%→92.7%) to close the gaps Codecov flagged on this PR's patch coverage.
• Fixed a Windows-only CI test failure (TestRelativePathForStackDisplay used synthetic paths that aren't recognized as absolute by Go's Windows filepath.IsAbs).
• Fixed a CodeQL go/allocation-size-overflow finding in internal/exec/utils.go and dismissed the associated alert.
• Fixed the "Check Markdown Links" CI job (excluded a known-flaky-but-valid GitHub release URL).
• Fixed the "Version Tracker E2E" CI job's bootstrap: .atmos.d/build.yaml and .atmos.d/dev.yaml used the new !repo-root YAML tag, which doesn't exist in the pinned older atmos bootstrap binary CI uses to self-build from source — any occurrence anywhere in .atmos.d/ was silently dropping the whole custom-command set. Moved repo-root resolution into the shell layer (git rev-parse --show-toplevel) instead.
• Resolved all 13 outstanding CodeRabbit review threads on #2688 (verified each fix against the merged code before resolving).
• atmos vendor get|set refactored from a separate yq-expression implementation into a literal thin wrapper over atmos vendor config get|set (matching how atmos stack get|set|delete|format already alias atmos stack config), and documented the previously-undocumented atmos stack config * / atmos vendor config * command groups (13 new Docusaurus pages) that had been added to the branch after the original docs were written.

why

• Editing Atmos YAML with sed/yq strips comments and reformats files; a naive "parse → re-serialize" approach destroys comments, anchors, functions, and templates that carry real meaning and behavior. These commands let users and automation script configuration changes safely, at the YAML-node level, without losing fidelity. The shared pkg/yaml engine generalizes (and supersedes) the hardcoded sources[].version writer from the older feat/vendor-diff-and-update branch.
• Every tool/action/image version an Atmos project depends on is currently either hand-pinned with no drift detection, or left floating. Version Tracker gives teams one declarative, lockfile-backed source of truth with policy-driven, reviewable updates and a CI gate against drift.
• Version Tracker's PR (#2688) was opened against this branch (rather than main) and merged in directly, so its full history and diff are part of this PR.

references

• PRD (YAML editing): docs/prd/yaml-editing-get-set.md
• PRD (Version Tracker): docs/prd/atmos-version-management.md
• Supersedes the YAML-write approach from the feat/vendor-diff-and-update branch (the broader vendor diff/vendor update feature port is tracked as follow-up).
• Known limitation: blank lines between entries are not preserved (inherent to the gopkg.in/yaml.v3 node model that yqlib builds on).

Summary by CodeRabbit

• New Features
  • Added config, stack, and vendor CLI commands for reading, updating, deleting, formatting, and listing YAML settings.
  • Added version track commands to inspect, update, verify, apply, diff, and manage version locks.
  • Added typed value support for writes, plus format-preserving edits that keep comments, templates, and anchors safe.
• Bug Fixes
  • Improved file discovery and error messages when the target manifest or config file can’t be found.
  • Help output now shows the new command groups and subcommands.