v1.228.0

• ci: install syft for GoReleaser SBOM generation Andriy Knysh (@aknysh) (#3061)
• ci: restore-only toolchain cache on the acceptance shards Erik Osterman (Cloud Posse) (@osterman) (#3038)
• ci: one step for the CI toolchain - atmos toolchain install from .tool-versions, cached by atmos ci cache Erik Osterman (Cloud Posse) (@osterman) (#3041)
• ci: put Windows Go caches on the fast work disk via a setup-go-cache action Erik Osterman (Cloud Posse) (@osterman) (#3049)
• ci: summarize drafted release notes with AI, split release out of test.yml Erik Osterman (Cloud Posse) (@osterman) (#3045)
• fix(test): widen Windows tofu.exe temp-dir cleanup retry budget Erik Osterman (Cloud Posse) (@osterman) (#3057)
• ci: let the per-OS acceptance check wait for shard conclusions to settle Erik Osterman (Cloud Posse) (@osterman) (#3052)
• ci: allow setup-go's download hosts in rerun-infra-failures Erik Osterman (Cloud Posse) (@osterman) (#3050)
• ci: auto-rerun Tests runs whose only failures are infra zombies Erik Osterman (Cloud Posse) (@osterman) (#3040)
• Derive NOTICE copyright year and tagline dynamically Erik Osterman (Cloud Posse) (@osterman) (#3035)
• ci: guard Windows DNS against harden-runner post-step race; allowlist OS endpoints Erik Osterman (Cloud Posse) (@osterman) (#3037)
• docs: add Terragrunt migration skill and fix stale PRD statuses Erik Osterman (Cloud Posse) (@osterman) (#2878)
• docs: add Secure Software Development Lifecycle policy Erik Osterman (Cloud Posse) (@osterman) (#3033)
• Whitelist and activate harden-runner block mode across CI workflows Erik Osterman (Cloud Posse) (@osterman) (#3027)
• Rewrite NOTICE generator as a Go tool + mage target Erik Osterman (Cloud Posse) (@osterman) (#3026)
• feat(skills): add Terramate migration reference to atmos-migration Erik Osterman (Cloud Posse) (@osterman) (#2871)
• Harden supply-chain security: Scorecard, signing, SBOM, secret scanning Erik Osterman (Cloud Posse) (@osterman) (#2958)
• fix: close CodeQL High backlog, dedupe recurring alert patterns Erik Osterman (Cloud Posse) (@osterman) (#3008)

✨ Features

• feat(pro): automatic command-execution metadata upload to Atmos Pro Igor Rodionov (@goruha) (#2926)
• feat: Add Terraform streaming UI with real-time visualization Erik Osterman (Cloud Posse) (@osterman) (#1908)
• Add create_namespace setting to native Helm components Andriy Knysh (@aknysh) (#3034)
• feat: stack-level retry defaults + registry-retry docs + CI flakes Erik Osterman (Cloud Posse) (@osterman) (#2987)
• Fix toolchain set, markdown text loss, and mise/aqua migration doc bugs Erik Osterman (Cloud Posse) (@osterman) (#2899)
• feat(scaffold): OCI registry sources for scaffold and init templates Jorrit Elfferich (@jorrite) (#3019)
• Expose flags/arguments/component to custom command when: CEL facts Erik Osterman (Cloud Posse) (@osterman) (#2978)
• feat(scaffold): dynamic and label/value select options Jorrit Elfferich (@jorrite) (#3009)
• feat(terraform): declarative defaults for lock/concurrency CLI flags Erik Osterman (Cloud Posse) (@osterman) (#2992)
• feat(ci): startup banner for CI/Pro status and legacy-action detection Erik Osterman (Cloud Posse) (@osterman) (#3004)
• Add json file manager, fix empty version.files, fix lock YAML indent Erik Osterman (Cloud Posse) (@osterman) (#2966)
• feat: FIPS 140-3 crypto by default; build via native mage target Erik Osterman (Cloud Posse) (@osterman) (#2993)

🐛 Bug Fixes

• fix(terraform-state): honor S3 backend profile attribute DaveElston (#3056)
• ci: add race-detector job; fix real races, flakes, and CI setup bugs Erik Osterman (Cloud Posse) (@osterman) (#3022)
• fix(store): don't fail the whole registry build on one bad store Erik Osterman (Cloud Posse) (@osterman) (#3010)
• Add Make/Just/Task migration guides; fix two Atmos config bugs Erik Osterman (Cloud Posse) (@osterman) (#2896)
• fix: remove stale provider override files when sections are removed Mohamed Elsayed (@elsayedmt) (#3011)
• fix(security): remediate Dependabot, CodeQL, and Semgrep alerts Erik Osterman (Cloud Posse) (@osterman) (#3025)
• fix(release): install cosign before GoReleaser signs release checksums Erik Osterman (Cloud Posse) (@osterman) (#3018)
• fix(commands): rename semantic_type to provides for custom command args/flags Erik Osterman (Cloud Posse) (@osterman) (#2964)
• fix: correct CI base resolution for merged PRs and symlinked repos Erik Osterman (Cloud Posse) (@osterman) (#3005)
• fix: implement MarshalYAML on Condition to make sure it survives marshalling roundtrip Jorrit Elfferich (@jorrite) (#3006)

🤖 Automatic Updates

• chore(deps): update runs-on/action action to v2.3.1 @renovate[bot] (#3043)
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.42.1 to 1.45.4 @dependabot[bot] (#2983)
• chore(deps): update github/codeql-action action to v4.37.9 @renovate[bot] (#3030)
• chore(deps): update step-security/harden-runner action to v2.21.1 @renovate[bot] (#3032)
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in the go_modules group across 1 directory @dependabot[bot] (#3028)
• chore(deps): update anchore/sbom-action action to v0.24.2 @renovate[bot] (#3021)
• build(deps): bump debian from 3a39a05 to d7e1218 @dependabot[bot] (#3013)
• build(deps): bump the cicd group across 1 directory with 6 updates @dependabot[bot] (#3017)
• build(deps): bump golang.org/x/tools from 0.32.0 to 0.49.0 in /tools/lintroller @dependabot[bot] (#3016)
• build(deps): bump vscode/devcontainers/base from 025b74b to b8c3669 in /.devcontainer @dependabot[bot] (#3014)
• build(deps): bump golang from 1.26.2 to 1.27.0 in /.devcontainer @dependabot[bot] (#3015)