v1.225.0-rc.3

fix(test): stop Windows toolchain-vanishing flake in acceptance tests Erik Osterman (Cloud Posse) (@osterman) (#2834)

## what

• Stops TestPrintTelemetryDisclosureOnlyOnce (and its three sibling telemetry disclosure
  tests) from deleting the shared <cache>/atmos root; they now isolate via a per-test
  ATMOS_XDG_CACHE_HOME/XDG_CACHE_HOME redirect instead.
• Closes a TOCTOU race in internal/exec terraform/tofu version tests: RequireTerraformPath/
  RequireTofuPath now resolve the binary path once and hand it back directly, instead of a
  second independent exec.LookPath call at each call site.
• Makes requireExecutablePath fail loudly (t.Fatalf) instead of silently returning an empty
  path when ATMOS_TEST_SKIP_PRECONDITION_CHECKS=true and the binary isn't found.
• Isolates several pkg/toolchain install/uninstall/list tests from the real shared XDG
  toolchain cache directory (Toolchain.InstallPath now points at each test's own t.TempDir()).
• Widens requireExecutablePath's retry window (2s → 15s) as a defensive backstop, and adds
  permanent forensic instrumentation (executableLookupForensics) that dumps per-PATH-entry
  toolchain directory state on a lookup failure.
• Adds a docs/fixes/ entry recording the root cause and investigation.

why

• The Windows "Acceptance Tests" CI job had been flaky for weeks with a recurring
  executable file not found in %PATH% failure for tofu/terraform, always on a different
  victim test in internal/exec each run.
• Root cause (confirmed via the forensic instrumentation added here): TestPrintTelemetryDisclosureOnlyOnce
  was calling os.RemoveAll on the shared <cache>/atmos root — the same root the toolchain
  install path lives under since #2579 — twice per run (setup + defer), deleting every
  CI-provisioned tool (terraform, opentofu, helm, helmfile) out from under the other
  concurrently-running go test package binaries.
• The other fixes in this PR are the real-but-secondary hazards found and closed during the same
  investigation, kept together because each one was ruled in/out as a contributing cause before
  the actual root cause was found.
• Extracted out of #2812 (which bundles an unrelated CI git-clone-bootstrap feature) so this
  CI-reliability fix can ship and be reviewed independently.

references

• Extracted from #2812

🚀 Enhancements

fix(config): stop silently dropping malformed atmos.d/.atmos.d files Erik Osterman (Cloud Posse) (@osterman) (#2837)

## what

• atmos.d/ and .atmos.d/ config files that fail to parse now hard-fail LoadConfig with the offending file path and YAML line number, instead of being silently swallowed at debug log level.
• Applies uniformly to both the normal path (an atmos.yaml was found, its co-located atmos.d/.atmos.d is checked) and the zero-config fallback path (no atmos.yaml anywhere, opportunistic git-root .atmos.d check).
• atmos version/--version, --help, atmos config validate/atmos validate config/atmos validate schema config, and CI git-clone bootstrap are unaffected — those commands already continue past config-init errors by design.
• Added unit tests covering malformed YAML in atmos.d/ and .atmos.d/, the exact sort-order repro from the issue (good/broken/good files), and full LoadConfig integration tests for both call paths.
• Added docs/fixes/2026-07-30-atmos-d-malformed-yaml-silent-drop.md documenting the fix.

why

• Before this change, a YAML syntax error in atmos.d//.atmos.d/ caused Atmos to exit 0 with no visible error, and because the merge loop bails on the first bad file, every file sorting after the broken one silently never loaded either — whether a setting applied depended on its filename's sort position relative to an unrelated broken file.
• This is inconsistent with every sibling config source: a malformed root atmos.yaml and malformed profile configs (#2825) already hard-fail. This closes the one remaining silent source, reusing the exact error already produced by the existing merge code (only the swallow points needed to change).

references

• Closes #2836

Speed up container discovery and harden emulator listings Erik Osterman (Cloud Posse) (@osterman) (#2828)

## what

• Cache automatic Docker/Podman selection, eliminate duplicate probes, and show progress during uncached discovery.
• Fetch container statuses in one bulk runtime query and recover from stale cached runtimes.
• Return an empty emulator status list when invoked outside an Atmos stack project.

why

• Repeated container commands avoid unnecessary runtime checks while still recovering when a runtime changes.
• List commands now respond predictably when no stack manifests are present.

references

• None.

Summary by CodeRabbit

• New Features

  • Added support for deleting cached entries to keep container/runtime selection up to date.
  • Container listings now compute instance status using a single bulk query for improved responsiveness.

• Bug Fixes

  • Container runtime auto-selection is more resilient: corrupted cache data triggers fresh discovery, and failed runtime operations invalidate cached selections.
  • Emulator listing now returns an empty result (no error) when no stacks/manifests are found.
  • Improved runtime environment propagation when supported, and more reliable auto-start recovery between Docker and Podman.

fix: don't process Go templates in Terraform source code thejrose1984 (#2830)

## what

• Exclude the component_info section from Go template rendering in both the
  ProcessStacks and describe stacks pipelines
• component_info stays in the template context, so {{ .component_info.component_path }}
  and friends keep working in stack manifests
• Add a regression test plus a terraform-source-go-templates fixture whose Terraform
  description contains {{project}}
• Document the exclusion on the Templates page

why

• Atmos parses a component's Terraform/OpenTofu source with terraform-config-inspect and
  stores the result — including every variable and output description — in
  component_info.terraform_config. That section is part of the component section Atmos
  serializes and renders as a Go template.
• A description that legitimately contains double curly braces, such as the GCP resource
  name format projects/{{project}}/locations/{{location}}/services/{{name}}, aborted every
  Atmos command with template: templates-all-atmos-sections:156: function "project" not defined.
• Terraform code is not Atmos configuration. Atmos templating belongs to the abstraction
  above Terraform modules, so this needs no new config knob — the section is simply never
  rendered.

references

• closes #2145

Summary by CodeRabbit

• Bug Fixes

  • Terraform-derived component_info content is no longer incorrectly processed as Go templates.
  • Terraform strings containing {{...}} and }} are preserved while other stack templates continue to render normally.

• Documentation

  • Clarified that component_info is protected from template rendering but remains available for use in other templates.

fix(auth): never cache ambient provider credentials in the keyring thejrose1984 (#2819)

## what

Stops the auth manager persisting credentials to the keyring for providers
that re-resolve their principal from the environment on every authentication
(gcp/adc, gcp/workload-identity-federation, azure/cli, azure/oidc, github/oidc).
Such chains are never served from, nor written to, the keyring, and stale
entries are purged so poisoned keyrings self-heal.

why

gcp/adc is documented as stateless, but its short-lived token was cached and
replayed, so after gcloud auth application-default login switched accounts
Atmos kept authenticating as the previous principal. atmos/pro is deliberately
excluded: it mints a single-use token, so cached reuse is load-bearing.

references

Closes #2695
Suggested release label: patch

Summary by CodeRabbit

• New Features
  • Ambient authentication providers now explicitly declare non-persisted credentials for fresh resolution from current environment on each login.
• Bug Fixes
  • Prevented stale ambient credentials from being replayed from cache or written to the keychain.
  • auth logout, auth logout provider, and auth logout --all now clear ambient-related keyring entries even without --keychain.
  • Improved ambient-aware --dry-run logout previews to match real cleanup behavior.
• Documentation
  • Updated ambient provider docs describing token/credential rotation and non-caching behavior.
• Tests
  • Added expanded ambient-aware coverage across caching and identity/provider/logout-all flows.