Tests

chore(deps): update floci/floci docker digest to d2ecc80 #22782

Workflow file for this run

	name: Tests
	on:
	pull_request:
	types: [opened, synchronize, reopened]
	paths-ignore:
	- "README.md"

	push:
	branches:
	- main
	- release/v*
	paths-ignore:
	- ".github/**"
	- "docs/**"
	- "examples/**"
	- "test/**"

	workflow_dispatch:

	# Grant `packages: read` so jobs that pull OCI images from ghcr.io
	# (e.g. vendor pulls in mock/acceptance tests) can authenticate with
	# the auto-generated GITHUB_TOKEN. The default PR-event scope is
	# `contents: read` only, which causes ghcr.io to reject the token with
	# `DENIED: denied` whenever credentials are sent (as happens on Windows
	# runners that have no usable Docker keychain entry for ghcr.io). Reviewdog
	# gets job-level checks write access for tflint annotations.
	permissions:
	checks: read
	contents: read
	packages: read
	pull-requests: read

	env:
	TERRAFORM_VERSION: "1.15.6"
	OPEN_TOFU_VERSION: "1.12.2"
	HELM_VERSION: "v3.19.2"
	HELMFILE_VERSION: "v1.1.0"
	PACKER_VERSION: "1.14.2"

	jobs:
	# ensure the code builds...
	build:
	name: Build (${{ matrix.target }})
	# windows-latest is the slowest target: it compiles this large dependency
	# tree far slower than the Linux (self-hosted, s3-cache) and macOS runners,
	# and on top of that the post-job Go cache save (tar + zstd of
	# GOMODCACHE/GOCACHE) takes several minutes. A cold cache after dependency
	# changes plus that save pushes the job past a tight limit and the run gets
	# cancelled. Give the slowest target enough headroom for build + cache save.
	timeout-minutes: 30
	strategy:
	fail-fast: false
	matrix:
	include:
	- os: "runs-on=${{github.run_id}}/runner=terraform/tag=atmos/extras=s3-cache/private=false"
	target: linux
	- os: "windows-latest"
	target: windows
	- os: "macos-latest"
	target: macos
	runs-on: ${{ matrix.os }}
	steps:
	- uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
	if: matrix.target == 'linux'

	- name: Build
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	run: echo "Building on ${{ matrix.os }}"

	- name: Add GNU tar to PATH (significantly faster than windows tar)
	if: matrix.target == 'windows' && ! github.event.pull_request.draft
	run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

	- name: Check out code into the Go module directory
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Set up Go
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	# setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
	with:
	go-version-file: "go.mod"
	id: go

	- name: Get dependencies
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	make deps

	- name: Build
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	make build-${{ matrix.target }}

	- name: Version
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	make version-${{ matrix.target }}

	- name: Upload build artifacts
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
	if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	name: build-artifacts-${{ matrix.target }}
	path: \|
	./build/

	# run acceptance tests
	test:
	name: Acceptance Tests (${{ matrix.flavor.target }})
	needs: [build]
	strategy:
	fail-fast: false
	matrix:
	flavor:
	- { os: "runs-on=${{github.run_id}}/runner=terraform/tag=atmos/extras=s3-cache/private=false", target: linux }
	- { os: "windows-latest", target: windows }
	- { os: "macos-latest", target: macos }
	timeout-minutes: 60
	runs-on: ${{ matrix.flavor.os }}
	steps:
	- uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
	if: matrix.flavor.target == 'linux'

	- name: Check out code into the Go module directory
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Add GNU tar to PATH (significantly faster than windows tar)
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

	- name: Download build artifacts for ${{ matrix.flavor.target }}
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	name: build-artifacts-${{ matrix.flavor.target }}
	path: ${{ github.workspace }}

	- name: Add build artifacts directory to PATH for linux or macos
	if: matrix.flavor.target == 'linux' \|\| matrix.flavor.target == 'macos'
	run: \|
	echo "${{ github.workspace }}" >> $GITHUB_PATH
	chmod +x "${{ github.workspace }}/atmos"

	- name: Add build artifacts directory to PATH for windows
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	shell: pwsh
	run: \|
	$atmosPath = Join-Path ${{ github.workspace }} "atmos.exe"
	if (-not (Test-Path $atmosPath)) {
	throw "atmos.exe not found at: $atmosPath"
	}
	echo "${{ github.workspace }}" >> $Env:GITHUB_PATH

	- name: Install Terraform
	uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	terraform_version: ${{ env.TERRAFORM_VERSION }}
	terraform_wrapper: false

	- name: Install OpenTofu
	uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	tofu_version: ${{ env.OPEN_TOFU_VERSION }}
	tofu_wrapper: false

	# https://github.com/hashicorp/setup-packer
	- name: Install Packer
	uses: hashicorp/setup-packer@3286471d6cc6756d056a0b199fea5e0becdbc189 # main
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	version: ${{ env.PACKER_VERSION }}

	# Dogfood `atmos ci cache`: cache the configured Atmos cache root via the
	# recommended composite action. Do not export ATMOS_XDG_CACHE_HOME or
	# TF_PLUGIN_CACHE_DIR for the full acceptance job: many tests assert XDG
	# defaults and Terraform's plugin cache is not safe for shared concurrent
	# use. This cache step restores/saves toolchain bits only; it must stay a
	# pure accelerator.
	- name: Cache Atmos toolchain
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	continue-on-error: true
	uses: ./actions/cache

	- name: Install Helm and Helmfile
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	atmos toolchain install --default helm/helm@${{ env.HELM_VERSION }}
	atmos toolchain install --default helmfile/helmfile@${{ env.HELMFILE_VERSION }}
	atmos toolchain env --format=github

	- name: Verify Helm and Helmfile
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	helm version --short
	helmfile version

	- name: Install helm-diff plugin
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	run: helm plugin install https://github.com/databus23/helm-diff

	- name: Check atmos.exe integrity
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	shell: pwsh
	run: \|
	Write-Output "PATH=$Env:PATH"
	Write-Output "PATHEXT=$Env:PATHEXT"
	Get-ChildItem "${{ github.workspace }}"
	Get-Command "${{ github.workspace }}\atmos.exe"
	atmos version

	- name: Set up Go
	# setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	with:
	go-version-file: "go.mod"
	id: go

	- name: Get dependencies
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	run: \|
	make deps

	- name: Terraform registry cache acceptance test
	timeout-minutes: 10
	if: matrix.flavor.target == 'linux' \|\| matrix.flavor.target == 'macos' \|\| (matrix.flavor.target == 'windows' && ! github.event.pull_request.draft)
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
	ATMOS_TEST_TERRAFORM_REGISTRY_CACHE: 1
	CGO_ENABLED: 0
	run: go test ./tests -run '^TestTerraformRegistryCache$' -count=1 -timeout 10m -v

	# Enable this after merging test-cases
	# Only seems to work with remote schema files
	#- name: Validate YAML Schema for Test Cases
	# uses: InoUno/yaml-ls-check@v1.4.0
	# with:
	# root: "tests/test-cases"
	# schemaMapping: \|
	# {
	# "schema.json": [
	# "*/.yaml"
	# ]
	# }

	- name: Acceptance tests with coverage
	timeout-minutes: 45
	if: matrix.flavor.target == 'linux'
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Use the GitHub token for downloading the Packer plugins
	PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Skip precondition checks in CI to ensure tests run and maintain coverage
	ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
	# Enable Playwright integration tests to validate browser driver download
	RUN_PLAYWRIGHT_INTEGRATION: 1
	run: make testacc-cover

	- name: Acceptance tests
	timeout-minutes: 45
	if: matrix.flavor.target == 'macos' \|\| (matrix.flavor.target == 'windows' && ! github.event.pull_request.draft)
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Use the GitHub token for downloading the Packer plugins
	PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Skip precondition checks in CI to ensure tests run and maintain coverage
	ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
	# Enable Playwright integration tests to validate browser driver download
	RUN_PLAYWRIGHT_INTEGRATION: 1
	run: make testacc

	- name: Upload coverage report to Codecov
	if: matrix.flavor.target == 'linux' && hashFiles('coverage.out') != ''
	uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	slug: ${{ github.repository }}
	files: coverage.out
	# Codecov's uploader downloads its CLI and verifies the binary's GPG
	# signature. Transient Codecov-side issues (e.g. an empty public-key
	# import: "gpg: no valid OpenPGP data found" / "Can't check signature:
	# No public key") make verification exit 1, which would hard-fail this
	# job even when every test passed. Don't let a coverage-upload/infra
	# flake fail a green test run — the 80% coverage gate is still enforced
	# by Codecov's own PR status check, independent of this step's exit code.
	fail_ci_if_error: false
	flags: unittests
	verbose: true
	# Install the Codecov CLI from PyPI instead of cli.codecov.io. The
	# default path fetches Codecov's GPG public key from Keybase
	# (https://keybase.io/codecovsecurity/pgp_keys.asc) to verify the CLI
	# binary; that URL is currently returning 404 ("SELF-SIGNED PUBLIC KEY
	# NOT FOUND"), so the import yields "no valid OpenPGP data found" and
	# the run fails with "Could not verify signature". The PyPI path avoids
	# the broken keyserver fetch. See codecov/codecov-action#1955. Safe to
	# remove once Codecov restores the Keybase key.
	use_pypi: true

	docker:
	name: "[lint] Dockerfile"
	needs: build
	runs-on: ubuntu-latest
	# The workflow-level `permissions:` block above (added in #2487 for
	# `packages: read` on ghcr.io pulls) REPLACES — not extends — the default
	# token scope for every job. That stripped the implicit
	# `security-events: write` this job relied on for SARIF upload, breaking
	# the post-merge run on main. Job-level `permissions:` also fully
	# overrides the workflow-level set, so `contents: read` is re-listed here
	# for actions/checkout.
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Check out code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
	id: hadolint
	with:
	dockerfile: Dockerfile
	failure-threshold: warning
	format: sarif
	output-file: hadolint.sarif
	# https://github.com/hadolint/hadolint?tab=readme-ov-file#rules
	# DL3008 Pin versions in apt-get install
	ignore: DL3008

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	if: always()
	with:
	# Path to SARIF file relative to the root of the repository
	sarif_file: hadolint.sarif
	# Optional category for the results (used to differentiate multiple results for one commit)
	category: hadolint
	wait-for-processing: true

	# Run the AWS-emulator demo tests against Floci (a free, LocalStack-compatible emulator;
	# LocalStack Community Edition was EOL'd in March 2026).
	# NOTE: "[floci] demo-floci" must be kept in sync with the required status checks in
	# branch protection on main (previously "[localstack] demo-localstack").
	floci:
	name: "[floci] ${{ matrix.demo-folder }}"
	needs: build
	runs-on: ubuntu-latest

	services:
	floci:
	# Pin by immutable digest for reproducibility/supply-chain safety (matches our SHA-pinned actions). Comment tracks the human-readable tag.
	image: floci/floci@sha256:18c54f4a774a6e2c038c63b5c738ebe68cf4688c9e199e9b9fa8445bcff8bd01 # 1.5.23
	ports:
	- 4566:4566

	strategy:
	fail-fast: false
	matrix:
	demo-folder:
	- demo-floci

	timeout-minutes: 30
	steps:

	- name: Download build artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	name: build-artifacts-linux
	path: /usr/local/bin

	- name: Set execute permissions on atmos
	run: chmod +x /usr/local/bin/atmos

	- name: Check out code into the Go module directory
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Install Terraform
	uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
	with:
	terraform_version: ${{ env.TERRAFORM_VERSION }}
	terraform_wrapper: false

	- name: Install OpenTofu
	uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
	with:
	tofu_version: ${{ env.OPEN_TOFU_VERSION }}
	tofu_wrapper: false

	- name: Run tests for ${{ matrix.demo-folder }}
	run: \|
	cd examples/${{ matrix.demo-folder }}
	timeout 25m atmos test \|\| {
	status=$?
	echo "atmos test failed or timed out with status ${status}"
	exit "${status}"
	}

	# Run Go E2E tests against Floci. These cover store/secrets workflows that are
	# easier to assert directly from Go than through the demo `atmos test` runner.
	floci-go:
	name: "[floci] go e2e"
	needs: build
	runs-on: ubuntu-latest

	services:
	floci:
	# Pin by immutable digest for reproducibility/supply-chain safety (matches our SHA-pinned actions). Comment tracks the human-readable tag.
	image: floci/floci@sha256:18c54f4a774a6e2c038c63b5c738ebe68cf4688c9e199e9b9fa8445bcff8bd01 # 1.5.23
	ports:
	- 4566:4566
	floci-gcp:
	# Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
	image: floci/floci-gcp@sha256:a6420f308ad721fa4a203b70658563eab9c8fbc8d091feca2d95016239f5854a # latest
	ports:
	- 4588:4588
	floci-az:
	# Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
	image: floci/floci-az@sha256:1e514c57db14dc41938f7925bbc1aca0293aa4da272c7014d98f1fba378cedb2 # latest
	ports:
	- 4577:4577

	timeout-minutes: 30
	steps:
	- name: Download build artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	name: build-artifacts-linux
	path: /usr/local/bin

	- name: Set execute permissions on atmos
	run: chmod +x /usr/local/bin/atmos

	- name: Check out code into the Go module directory
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Set up Go
	# setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
	with:
	go-version-file: "go.mod"
	cache: false

	- name: Install OpenTofu with Atmos toolchain
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	atmos toolchain install --default opentofu/opentofu@${{ env.OPEN_TOFU_VERSION }}
	atmos toolchain env --format=github

	- name: Verify OpenTofu
	run: tofu version

	- name: Install Linux build dependencies
	run: \|
	sudo apt-get update
	sudo apt-get install -y --no-install-recommends libudev-dev pkg-config

	- name: Run Floci Go E2E tests
	env:
	ATMOS_TEST_FLOCI: "true"
	FLOCI_ENDPOINT_URL: "http://localhost:4566"
	FLOCI_GCP_ENDPOINT: "http://localhost:4588"
	FLOCI_AZURE_ENDPOINT: "http://localhost:4577"
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: go test ./tests -run 'Test(AWS(StoreHooks\|Secrets)\|GCPSecrets\|AzureSecrets)FlociE2E' -count=1 -timeout 15m -v

	# run k3s demo tests
	k3s:
	name: "[k3s] ${{ matrix.demo-folder }}"
	needs: build
	runs-on: ubuntu-latest
	env:
	KUBECONFIG: ${{github.workspace}}/examples/${{ matrix.demo-folder }}/kubeconfig.yaml
	ATMOS_LOGS_LEVEL: Debug
	strategy:
	matrix:
	demo-folder:
	- demo-helmfile

	timeout-minutes: 20
	steps:
	- name: Check out code into the Go module directory
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Start Docker Compose
	working-directory: examples/${{ matrix.demo-folder }}
	run: docker compose up -d --wait

	- name: Wait for k3s to start
	working-directory: examples/${{ matrix.demo-folder }}
	run: \|
	until kubectl get pods --all-namespaces >/dev/null 2>&1; do
	echo "Retrying..."
	sleep 1
	done
	kubectl get pods --all-namespaces

	- name: Download build artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	name: build-artifacts-linux
	path: /usr/local/bin

	- name: Set execute permissions on atmos
	run: chmod +x /usr/local/bin/atmos

	- name: Install the Cloud Posse package repository
	run: curl -1sLf 'https://dl.cloudsmith.io/public/cloudposse/packages/cfg/setup/bash.deb.sh' \| sudo bash

	- name: Install kubectl and helmfile
	run: sudo apt-get -y install kubectl helmfile

	- name: Install Helm
	uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
	with:
	version: ${{ env.HELM_VERSION }}

	- name: Install helm-diff plugin
	run: helm plugin install https://github.com/databus23/helm-diff

	- name: Write a default AWS profile to the AWS config file
	run: \|
	mkdir -p ~/.aws
	echo '[default]' > ~/.aws/config

	- name: Run tests for ${{ matrix.demo-folder }}
	run: \|
	cd examples/${{ matrix.demo-folder }}
	atmos test

	# run other demo tests
	mock:
	name: "[mock-${{ matrix.flavor.target}}] ${{ matrix.demo-folder }}"
	needs: build
	runs-on: ${{ matrix.flavor.os }}
	strategy:
	fail-fast: false
	matrix:
	flavor:
	- { os: ubuntu-latest, target: linux }
	- { os: windows-latest, target: windows }
	- { os: macos-latest, target: macos }
	demo-folder:
	- examples/demo-atlantis
	# - examples/demo-component-manifest
	- examples/demo-component-versions
	- examples/demo-context
	# - examples/demo-custom-command
	# - examples/demo-json-validation
	# - examples/demo-opa-validation
	# - examples/demo-opentofu
	# - examples/demo-project
	# - examples/demo-stacks
	# - examples/demo-terraform
	# - examples/demo-terraform-overrides
	# - examples/demo-workflows
	# - examples/demo-yaml-anchors
	# - examples/demo-mock-architecture
	# - examples/demo-stack-templating
	# - examples/demo-multi-cloud
	- examples/demo-vendoring
	- examples/config-profiles
	- tests/fixtures/scenarios/complete

	timeout-minutes: 20
	steps:
	- name: Check out code into the Go module directory
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Add GNU tar to flavor.target (significantly faster than windows tar)
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

	- name: Download build artifacts for ${{ matrix.flavor.target }}
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	name: build-artifacts-${{ matrix.flavor.target }}
	path: ${{ github.workspace }}

	- name: Add build artifacts directory to PATH for linux or macos
	if: matrix.flavor.target == 'linux' \|\| matrix.flavor.target == 'macos'
	run: \|
	echo "${{ github.workspace }}" >> $GITHUB_PATH
	chmod +x "${{ github.workspace }}/atmos"

	- name: Add build artifacts directory to PATH for windows
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	shell: pwsh
	run: \|
	echo "${{ github.workspace }}" >> $Env:GITHUB_PATH

	- name: Install Terraform
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
	with:
	terraform_version: ${{ env.TERRAFORM_VERSION }}
	terraform_wrapper: false

	- name: Install OpenTofu
	if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft ) }}
	uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
	with:
	tofu_version: ${{ env.OPEN_TOFU_VERSION }}
	tofu_wrapper: false

	- name: Run tests in ${{ matrix.demo-folder }} for ${{ matrix.flavor.target }}
	working-directory: ${{ matrix.demo-folder }}
	if: matrix.flavor.target == 'linux' \|\| matrix.flavor.target == 'macos'
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	atmos test

	- name: Check atmos.exe integrity
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	shell: pwsh
	run: \|
	Write-Output "PATH=$Env:PATH"
	Write-Output "PATHEXT=$Env:PATHEXT"
	Get-ChildItem "${{ github.workspace }}"
	Get-Command "${{ github.workspace }}\atmos.exe"
	atmos version

	- name: Run tests in ${{ matrix.demo-folder }} for ${{ matrix.flavor.target }}
	working-directory: ${{ matrix.demo-folder }}
	if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
	shell: pwsh
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	atmos test

	# run other demo tests
	lint:
	name: "[lint] ${{ matrix.demo-folder }}"
	needs: build
	runs-on: ubuntu-latest
	permissions:
	contents: read
	checks: write
	pull-requests: read
	strategy:
	fail-fast: false
	matrix:
	demo-folder:
	# - demo-component-manifest
	- demo-context
	# - demo-custom-command
	# - demo-json-validation
	# - demo-library
	# - demo-floci
	# - demo-opa-validation
	# - demo-opentofu
	# - demo-project
	# - demo-stacks
	# - demo-terraform
	# - demo-terraform-overrides
	# - demo-workflows
	# - demo-yaml-anchors
	# - demo-mock-architecture
	# - demo-stack-templating
	# - demo-multi-cloud
	- quick-start-advanced
	#- quick-start-simple

	timeout-minutes: 20
	steps:
	- name: Check out code into the Go module directory
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Install Terraform
	uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
	with:
	terraform_version: ${{ env.TERRAFORM_VERSION }}
	terraform_wrapper: false

	- name: Install OpenTofu
	uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
	with:
	tofu_version: ${{ env.OPEN_TOFU_VERSION }}
	tofu_wrapper: false

	- name: Lint examples/${{ matrix.demo-folder }}/components/terraform
	uses: reviewdog/action-tflint@54a5e5aed57dcfbb4662ec548de876df33d6288d # v1
	with:
	github_token: ${{ github.token }}
	working_directory: examples/${{ matrix.demo-folder }}/components/terraform
	flags: >-
	--enable-rule=terraform_unused_declarations
	--disable-rule=terraform_typed_variables
	--minimum-failure-severity=warning
	--recursive
	--config=${{ github.workspace }}/examples/.tflint.hcl
	fail_level: error

	# run other demo tests
	validate:
	name: "[validate] ${{ matrix.demo-folder }}"
	needs: build
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	demo-folder:
	- demo-context
	- demo-floci
	- demo-stacks
	- demo-helmfile
	- quick-start-advanced
	- quick-start-simple

	timeout-minutes: 20
	steps:
	- name: Check out code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	# The example stacks pin their `# yaml-language-server: $schema` modeline to the
	# published schema at atmos.tools, which only updates after a PR merges and the site
	# deploys. yaml-language-server gives the inline modeline absolute precedence over the
	# `schemaMapping` below, so without this step the examples would always validate against
	# the live (stale) schema — and a PR could never add a schema field and use it in an
	# example at the same time. Rewrite the modeline URL to the in-repo schema (ephemeral,
	# CI checkout only) so examples are validated against the schema this PR actually ships.
	# The committed files keep the public URL for users who copy them.
	- name: Use in-repo schema for validation
	run: \|
	find "examples/${{ matrix.demo-folder }}/stacks" -type f $ -name '.yaml' -o -name '.yml' $ -print0 \
	\| xargs -0 --no-run-if-empty sed -i \
	"s#https://atmos.tools/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json#file://${GITHUB_WORKSPACE}/website/static/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json#g"

	- name: Validate YAML Schema for Stacks
	uses: InoUno/yaml-ls-check@2c229b85b877b2853b40bd0fbdcfccff5ff735c7 # v1.4.0
	with:
	root: "examples/${{ matrix.demo-folder }}/stacks"
	schemaMapping: \|
	{
	"file://${{ github.workspace }}/website/static/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json": [
	"examples/${{ matrix.demo-folder }}/stacks/*/.yaml",
	"examples/${{ matrix.demo-folder }}/stacks/*/.yml"
	]
	}

	release:
	needs: [test, lint, mock, k3s, floci, floci-go, docker, validate]
	if: github.event_name == 'push'
	uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@8244c7c9142e92281e7841f655fa48e9ceb9b454 # main
	with:
	publish: false
	format: binary
	runs-on: '["runs-on=${{github.run_id}}", "runner=large", "tag=atmos","extras=s3-cache", "private=false"]'
	secrets: inherit

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update floci/floci docker digest to d2ecc80 #22782

Workflow file

chore(deps): update floci/floci docker digest to d2ecc80 #22782

Uh oh!

Workflow file for this run