v1.228.0-rc.2

Add json file manager, fix empty version.files, fix lock YAML indent Erik Osterman (Cloud Posse) (@osterman) (#2966)

## what

• Add a json file manager to the Version Tracker (manager: json), configured via options.set: [{path, from}], that writes locked values into JSON files using sjson/gjson — patching only the targeted field and leaving the rest of the document's formatting, key order, and whitespace untouched.
• Fix atmos version track apply to treat an explicit version.files: [] as "manage zero files" instead of silently falling back to each manager's default paths — previously there was no way to configure zero managed files.
• Fix toolchain.lock.yaml, vendor.lock.yaml, and versions.lock.yaml to write with the repo's 2-space YAML indent standard instead of yaml.v3's bare-Marshal 4-space default.
• Add a changelog post and link a roadmap milestone for the new json manager.

why

• Neither the marker manager (needs an adjacent comment annotation, which JSON has no syntax for) nor the template manager (requires hand-maintaining a separate *.tmpl source in sync with the generated file) could cleanly keep a version field in a plain JSON file — such as a package.json or a Claude Code plugin manifest — up to date. This gap was found while wiring Atmos's own agent-skills/.claude-plugin/plugin.json / .claude-plugin/marketplace.json to track Atmos's release version.
• fileRules() used len(Version.Files) > 0, which can't distinguish an omitted version.files key (should fall back to manager defaults) from an explicitly configured empty list (should manage nothing) — both took the same fallback path.
• The three lock-file writers used a bare yaml.Marshal, which drifted their indentation away from every other Atmos-generated YAML file.

references

• Related to the Claude Code plugin version-pinning work (#2895).

Summary by CodeRabbit

• New Features

  • Added a JSON version-file manager for updating configured fields while preserving formatting, key order, whitespace, and unrelated content.
  • Supports multiple fields and files, missing simple paths, and explicitly empty configurations.
  • Planning now reports errors from all selected rules.

• Documentation

  • Added configuration guidance, examples, and blog documentation.

• Improvements

  • Lockfiles now use consistent two-space YAML indentation.
  • Clarified import precedence and default file behavior.
  • Added validation for unsupported paths, mismatches, duplicates, and missing targets.

feat: FIPS 140-3 crypto by default; build via native mage target Erik Osterman (Cloud Posse) (@osterman) (#2993)

## what

• Every atmos binary — dev builds, official releases, CI test binaries, and the sharded acceptance-test suite — now builds with GOFIPS140=latest, linking Go's native FIPS 140-3 validated cryptographic module and defaulting the binary to FIPS-enforcing mode (GODEBUG=fips140=on) at runtime. No flag or config change is required.
• Documents the one known gap in docs/prd/fips-140-mode.md: the age/NaCl-based encryption used by declarative secrets management (atmos secret keygen, the SOPS/age backend, and sealed GitHub Actions secret values) sits outside Go's FIPS module boundary and isn't covered by this change.
• Converts scripts/build-atmos.sh to a native Go mage target (magefiles/build.go, Build.Binary), matching the repo's existing mage-based tooling for lint and acceptance-test orchestration, and updates every CI workflow and doc comment that referenced the old script.
• Adds a changelog post and links a shipped milestone on the roadmap.

why

• Operators in regulated environments (federal, financial services, healthcare) are often required to run only FIPS 140-validated cryptography, and Atmos had no way to make that claim for any official binary.
• Verification (build + binary smoke tests, including a real outbound TLS call, plus short-test-suite runs compared against a non-FIPS baseline) found no incompatibility in Atmos's own code — its TLS config, EC curve choice, and randomness usage were already FIPS-compatible patterns; this just makes that enforced by default instead of incidental.
• scripts/build-atmos.sh was the last shell-script build entrypoint in a repo that otherwise self-hosts its build/lint/test tooling through Atmos custom commands and mage targets; converting it removes the shell/Go split and adds proper unit test coverage the shell script never had.

references

• docs/prd/fips-140-mode.md

Summary by CodeRabbit

• New Features

  • Official releases and build outputs now use Go’s FIPS 140-3 cryptographic module by default.
  • atmos version reports the current runtime FIPS status, including structured output.
  • Unified build support now covers standard and cross-platform targets.

• Bug Fixes

  • Builds retry dependency downloads after temporary failures.
  • Unsupported FIPS targets are rejected with clear errors.

• Documentation

  • Added guidance on FIPS mode, runtime overrides, verification, limitations, and platform exclusions.
  • Added an announcement describing the updated cryptographic defaults.

• Tests

  • Expanded coverage for builds, retries, environment settings, and FIPS-enabled binaries.

🚀 Enhancements

fix: correct CI base resolution for merged PRs and symlinked repos Erik Osterman (Cloud Posse) (@osterman) (#3005)

## what

• Fix describe affected CI base auto-detection resolving a wrong base commit for merged pull requests: merged PRs now classify what the workflow actually checked out (PR head, merge commit, or synthetic refs/pull/<n>/merge) and anchor the base on event-payload facts (merge_commit_sha^1, or base.sha for fast-forward merges where merge_commit_sha == head.sha), instead of the old merge-base(HEAD, origin/<target>) → HEAD~1 chain that degenerates after the merge.
• Fix describe affected mis-computing BASE worktree paths when the repository lives under a symlinked path (e.g. macOS /tmp): symlink-normalize both sides of the path re-basing, and hard-error (instead of silently guessing) when a config path cannot be represented inside the BASE checkout.
• Add the checkout classification to the Auto-detected CI base log line (checkout=head.sha|merge-commit|synthetic-merge|unknown) so wrong-base reports are diagnosable from a single line.
• New pkg/git helpers (CommitParents, MergeBaseSHAs, FetchCommit), red-first regression tests for every checkout × merge-strategy combination (merge, squash, fast-forward, queue-merged, synthetic, unknown, closed-unmerged), and a new end-to-end test covering base auto-detection through the full affected computation.
• Update the describe affected CLI docs and the native-CI base-resolution PRD to match; add fix-log entries under docs/fixes/.

why

• On a pull_request closed (merged) event with the PR head checked out (the documented workflow), merge-base(HEAD, origin/<target>) collapses to HEAD (the head is now an ancestor of the target) and the HEAD~1 fallback diffs only the PR's final commit. A multi-commit PR whose last commit reverts an earlier org-wide change then reports every component as affected and dispatches a wall of post-merge plan/apply runs; conversely, changes in earlier commits could be silently missed. Observed in production with the zero-config setup.
• Fast-forward/externally-merged PRs (merge_commit_sha == head.sha) would hit the same last-commit-only failure through the new anchor, so they get a dedicated payload-base.sha anchor — caught in an adversarial field-test pass before release.
• Under a symlinked repo path, filepath.Rel mixed git's symlink-resolved repo root with logical CWD-derived config paths, producing an escaping path that — depending on filesystem depth — either scanned a nonexistent BASE (greenfield fallback → everything affected) or clamped back onto the HEAD repo (BASE == HEAD → nothing affected). Both failure modes were silent.
• Every strategy in the old fallback chain was only correct under an assumed checkout that nothing verified; classifying the actual checkout makes the strategy selection provably correct per case and loud when it can't be.

references

• docs/fixes/2026-08-27-describe-affected-merged-pr-base-resolution.md
• docs/fixes/2026-08-27-describe-affected-symlink-base-path-mangling.md
• docs/prd/native-ci/framework/base-resolution.md (updated resolution matrix)
• Builds on the base-resolution self-healing from #2380 and zero-config CI detection from #2241

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved atmos describe affected accuracy for merged pull requests and varied checkout strategies.
  • Fixed affected-component detection for repositories accessed through symlinked paths.
  • Added safeguards for configuration paths outside the repository worktree.
  • Improved CI base-resolution diagnostics by identifying the detected checkout type.

• Documentation

  • Updated CI auto-detection guidance for merged pull requests and merge groups.

• Tests

  • Added end-to-end and regression coverage for merged-PR base resolution and symlinked repositories.