test.yml

name: Tests
on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths-ignore:
      - "README.md"

  push:
    branches:
      - main
      - release/v*
    paths-ignore:
      - ".github/**"
      - "docs/**"
      - "examples/**"
      - "test/**"

  workflow_dispatch:

# Grant `packages: read` so jobs that pull OCI images from ghcr.io
# (e.g. vendor pulls in mock/acceptance tests) can authenticate with
# the auto-generated GITHUB_TOKEN. The default PR-event scope is
# `contents: read` only, which causes ghcr.io to reject the token with
# `DENIED: denied` whenever credentials are sent (as happens on Windows
# runners that have no usable Docker keychain entry for ghcr.io). Reviewdog
# gets job-level checks write access for tflint annotations.
permissions:
  checks: read
  contents: read
  packages: read
  pull-requests: read

env:
  TERRAFORM_VERSION: "1.15.6"
  OPEN_TOFU_VERSION: "1.12.2"
  HELM_VERSION: "v3.19.2"
  HELMFILE_VERSION: "v1.1.0"
  PACKER_VERSION: "1.14.2"

jobs:
  # ensure the code builds...
  build:
    name: Build (${{ matrix.target }})
    # windows-latest is the slowest target: it compiles this large dependency
    # tree far slower than the Linux (self-hosted, s3-cache) and macOS runners,
    # and on top of that the post-job Go cache save (tar + zstd of
    # GOMODCACHE/GOCACHE) takes several minutes. A cold cache after dependency
    # changes plus that save pushes the job past a tight limit and the run gets
    # cancelled. Give the slowest target enough headroom for build + cache save.
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "runs-on=${{github.run_id}}/runner=terraform/tag=atmos/extras=s3-cache/private=false"
            target: linux
          - os: "windows-latest"
            target: windows
          - os: "macos-latest"
            target: macos
    runs-on: ${{ matrix.os }}
    steps:
      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
        if: matrix.target == 'linux'

      - name: Build
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft ) }}
        run: echo "Building on ${{ matrix.os }}"

      - name: Add GNU tar to PATH (significantly faster than windows tar)
        if: matrix.target == 'windows' && ! github.event.pull_request.draft
        run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

      - name: Check out code into the Go module directory
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        # setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: "go.mod"
        id: go

      - name: Get dependencies
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          make deps

      - name: Build
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          make build-${{ matrix.target }}

      - name: Version
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          make version-${{ matrix.target }}

      - name: Upload build artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        if: ${{ ! ( matrix.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          name: build-artifacts-${{ matrix.target }}
          path: |
            ./build/

  # run acceptance tests
  test:
    name: Acceptance Tests (${{ matrix.flavor.target }})
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - { os: "runs-on=${{github.run_id}}/runner=terraform/tag=atmos/extras=s3-cache/private=false", target: linux }
          - { os: "windows-latest", target: windows }
          - { os: "macos-latest", target: macos }
    timeout-minutes: 60
    runs-on: ${{ matrix.flavor.os }}
    steps:
      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
        if: matrix.flavor.target == 'linux'

      - name: Check out code into the Go module directory
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Add GNU tar to PATH (significantly faster than windows tar)
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

      - name: Download build artifacts for ${{ matrix.flavor.target }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          name: build-artifacts-${{ matrix.flavor.target }}
          path: ${{ github.workspace }}

      - name: Add build artifacts directory to PATH for linux or macos
        if: matrix.flavor.target == 'linux' || matrix.flavor.target == 'macos'
        run: |
          echo "${{ github.workspace }}" >> $GITHUB_PATH
          chmod +x "${{ github.workspace }}/atmos"

      - name: Add build artifacts directory to PATH for windows
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        shell: pwsh
        run: |
          $atmosPath = Join-Path ${{ github.workspace }} "atmos.exe"
          if (-not (Test-Path $atmosPath)) {
            throw "atmos.exe not found at: $atmosPath"
          }
          echo "${{ github.workspace }}" >> $Env:GITHUB_PATH

      - name: Install Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          tofu_version: ${{ env.OPEN_TOFU_VERSION }}
          tofu_wrapper: false

      # https://github.com/hashicorp/setup-packer
      - name: Install Packer
        uses: hashicorp/setup-packer@3286471d6cc6756d056a0b199fea5e0becdbc189 # main
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          version: ${{ env.PACKER_VERSION }}

      # Dogfood `atmos ci cache`: cache the configured Atmos cache root via the
      # recommended composite action. Do not export ATMOS_XDG_CACHE_HOME or
      # TF_PLUGIN_CACHE_DIR for the full acceptance job: many tests assert XDG
      # defaults and Terraform's plugin cache is not safe for shared concurrent
      # use. This cache step restores/saves toolchain bits only; it must stay a
      # pure accelerator.
      - name: Cache Atmos toolchain
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        continue-on-error: true
        uses: ./actions/cache

      - name: Install Helm and Helmfile
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          atmos toolchain install --default helm/helm@${{ env.HELM_VERSION }}
          atmos toolchain install --default helmfile/helmfile@${{ env.HELMFILE_VERSION }}
          atmos toolchain env --format=github

      - name: Verify Helm and Helmfile
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          helm version --short
          helmfile version

      - name: Install helm-diff plugin
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        run: helm plugin install https://github.com/databus23/helm-diff

      - name: Check atmos.exe integrity
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        shell: pwsh
        run: |
          Write-Output "PATH=$Env:PATH"
          Write-Output "PATHEXT=$Env:PATHEXT"
          Get-ChildItem "${{ github.workspace }}"
          Get-Command "${{ github.workspace }}\atmos.exe"
          atmos version

      - name: Set up Go
        # setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        with:
          go-version-file: "go.mod"
        id: go

      - name: Get dependencies
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        run: |
          make deps

      - name: Terraform registry cache acceptance test
        timeout-minutes: 10
        if: matrix.flavor.target == 'linux' || matrix.flavor.target == 'macos' || (matrix.flavor.target == 'windows' && ! github.event.pull_request.draft)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
          ATMOS_TEST_TERRAFORM_REGISTRY_CACHE: 1
          CGO_ENABLED: 0
        run: go test ./tests -run '^TestTerraformRegistryCache$' -count=1 -timeout 10m -v

      # Enable this after merging test-cases
      # Only seems to work with remote schema files
      #- name: Validate YAML Schema for Test Cases
      #  uses: InoUno/yaml-ls-check@v1.4.0
      #  with:
      #    root: "tests/test-cases"
      #    schemaMapping: |
      #      {
      #        "schema.json": [
      #          "**/*.yaml"
      #        ]
      #       }

      - name: Acceptance tests with coverage
        timeout-minutes: 45
        if: matrix.flavor.target == 'linux'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Use the GitHub token for downloading the Packer plugins
          PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Skip precondition checks in CI to ensure tests run and maintain coverage
          ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
          # Enable Playwright integration tests to validate browser driver download
          RUN_PLAYWRIGHT_INTEGRATION: 1
        run: make testacc-cover

      - name: Acceptance tests
        timeout-minutes: 45
        if: matrix.flavor.target == 'macos' || (matrix.flavor.target == 'windows' && ! github.event.pull_request.draft)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Use the GitHub token for downloading the Packer plugins
          PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Skip precondition checks in CI to ensure tests run and maintain coverage
          ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
          # Enable Playwright integration tests to validate browser driver download
          RUN_PLAYWRIGHT_INTEGRATION: 1
        run: make testacc

      - name: Upload coverage report to Codecov
        if: matrix.flavor.target == 'linux' && hashFiles('coverage.out') != ''
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: ${{ github.repository }}
          files: coverage.out
          # Codecov's uploader downloads its CLI and verifies the binary's GPG
          # signature. Transient Codecov-side issues (e.g. an empty public-key
          # import: "gpg: no valid OpenPGP data found" / "Can't check signature:
          # No public key") make verification exit 1, which would hard-fail this
          # job even when every test passed. Don't let a coverage-upload/infra
          # flake fail a green test run — the 80% coverage gate is still enforced
          # by Codecov's own PR status check, independent of this step's exit code.
          fail_ci_if_error: false
          flags: unittests
          verbose: true
          # Install the Codecov CLI from PyPI instead of cli.codecov.io. The
          # default path fetches Codecov's GPG public key from Keybase
          # (https://keybase.io/codecovsecurity/pgp_keys.asc) to verify the CLI
          # binary; that URL is currently returning 404 ("SELF-SIGNED PUBLIC KEY
          # NOT FOUND"), so the import yields "no valid OpenPGP data found" and
          # the run fails with "Could not verify signature". The PyPI path avoids
          # the broken keyserver fetch. See codecov/codecov-action#1955. Safe to
          # remove once Codecov restores the Keybase key.
          use_pypi: true

  docker:
    name: "[lint] Dockerfile"
    needs: build
    runs-on: ubuntu-latest
    # The workflow-level `permissions:` block above (added in #2487 for
    # `packages: read` on ghcr.io pulls) REPLACES — not extends — the default
    # token scope for every job. That stripped the implicit
    # `security-events: write` this job relied on for SARIF upload, breaking
    # the post-merge run on main. Job-level `permissions:` also fully
    # overrides the workflow-level set, so `contents: read` is re-listed here
    # for actions/checkout.
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
        id: hadolint
        with:
          dockerfile: Dockerfile
          failure-threshold: warning
          format: sarif
          output-file: hadolint.sarif
          # https://github.com/hadolint/hadolint?tab=readme-ov-file#rules
          # DL3008 Pin versions in apt-get install
          ignore: DL3008

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        if: always()
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: hadolint.sarif
          # Optional category for the results (used to differentiate multiple results for one commit)
          category: hadolint
          wait-for-processing: true

  # Run the AWS-emulator demo tests against Floci (a free, LocalStack-compatible emulator;
  # LocalStack Community Edition was EOL'd in March 2026).
  # NOTE: "[floci] demo-floci" must be kept in sync with the required status checks in
  # branch protection on main (previously "[localstack] demo-localstack").
  floci:
    name: "[floci] ${{ matrix.demo-folder }}"
    needs: build
    runs-on: ubuntu-latest

    services:
      floci:
        # Pin by immutable digest for reproducibility/supply-chain safety (matches our SHA-pinned actions). Comment tracks the human-readable tag.
        image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23
        ports:
          - 4566:4566

    strategy:
      fail-fast: false
      matrix:
        demo-folder:
          - demo-floci

    timeout-minutes: 30
    steps:

      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: build-artifacts-linux
          path: /usr/local/bin

      - name: Set execute permissions on atmos
        run: chmod +x /usr/local/bin/atmos

      - name: Check out code into the Go module directory
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
        with:
          tofu_version: ${{ env.OPEN_TOFU_VERSION }}
          tofu_wrapper: false

      - name: Run tests for ${{ matrix.demo-folder }}
        run: |
          cd examples/${{ matrix.demo-folder }}
          timeout 25m atmos test || {
            status=$?
            echo "atmos test failed or timed out with status ${status}"
            exit "${status}"
          }

  # Run Go E2E tests against Floci. These cover store/secrets workflows that are
  # easier to assert directly from Go than through the demo `atmos test` runner.
  floci-go:
    name: "[floci] go e2e"
    needs: build
    runs-on: ubuntu-latest

    services:
      floci:
        # Pin by immutable digest for reproducibility/supply-chain safety (matches our SHA-pinned actions). Comment tracks the human-readable tag.
        image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23
        ports:
          - 4566:4566
      floci-gcp:
        # Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
        image: floci/floci-gcp@sha256:a6420f308ad721fa4a203b70658563eab9c8fbc8d091feca2d95016239f5854a # latest
        ports:
          - 4588:4588
      floci-az:
        # Pin by immutable digest for reproducibility/supply-chain safety. Comment tracks the human-readable tag.
        image: floci/floci-az@sha256:1e514c57db14dc41938f7925bbc1aca0293aa4da272c7014d98f1fba378cedb2 # latest
        ports:
          - 4577:4577

    timeout-minutes: 30
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: build-artifacts-linux
          path: /usr/local/bin

      - name: Set execute permissions on atmos
        run: chmod +x /usr/local/bin/atmos

      - name: Check out code into the Go module directory
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        # setup-go v6 requires runner v2.327.1+ and can affect toolchain handling.
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: "go.mod"
          cache: false

      - name: Install OpenTofu with Atmos toolchain
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          atmos toolchain install --default opentofu/opentofu@${{ env.OPEN_TOFU_VERSION }}
          atmos toolchain env --format=github

      - name: Verify OpenTofu
        run: tofu version

      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libudev-dev pkg-config

      - name: Run Floci Go E2E tests
        env:
          ATMOS_TEST_FLOCI: "true"
          FLOCI_ENDPOINT_URL: "http://localhost:4566"
          FLOCI_GCP_ENDPOINT: "http://localhost:4588"
          FLOCI_AZURE_ENDPOINT: "http://localhost:4577"
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: go test ./tests -run 'Test(AWS(StoreHooks|Secrets)|GCPSecrets|AzureSecrets)FlociE2E' -count=1 -timeout 15m -v

  # run k3s demo tests
  k3s:
    name: "[k3s] ${{ matrix.demo-folder }}"
    needs: build
    runs-on: ubuntu-latest
    env:
      KUBECONFIG: ${{github.workspace}}/examples/${{ matrix.demo-folder }}/kubeconfig.yaml
      ATMOS_LOGS_LEVEL: Debug
    strategy:
      matrix:
        demo-folder:
          - demo-helmfile

    timeout-minutes: 20
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Start Docker Compose
        working-directory: examples/${{ matrix.demo-folder }}
        run: docker compose up -d --wait

      - name: Wait for k3s to start
        working-directory: examples/${{ matrix.demo-folder }}
        run: |
          until kubectl get pods --all-namespaces >/dev/null 2>&1; do
            echo "Retrying..."
            sleep 1
          done
          kubectl get pods --all-namespaces

      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: build-artifacts-linux
          path: /usr/local/bin

      - name: Set execute permissions on atmos
        run: chmod +x /usr/local/bin/atmos

      - name: Install the Cloud Posse package repository
        run: curl -1sLf 'https://dl.cloudsmith.io/public/cloudposse/packages/cfg/setup/bash.deb.sh' | sudo bash

      - name: Install kubectl and helmfile
        run: sudo apt-get -y install kubectl helmfile

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
        with:
          version: ${{ env.HELM_VERSION }}

      - name: Install helm-diff plugin
        run: helm plugin install https://github.com/databus23/helm-diff

      - name: Write a default AWS profile to the AWS config file
        run: |
          mkdir -p ~/.aws
          echo '[default]' > ~/.aws/config

      - name: Run tests for ${{ matrix.demo-folder }}
        run: |
          cd examples/${{ matrix.demo-folder }}
          atmos test

  # run other demo tests
  mock:
    name: "[mock-${{ matrix.flavor.target}}] ${{ matrix.demo-folder }}"
    needs: build
    runs-on: ${{ matrix.flavor.os }}
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - { os: ubuntu-latest, target: linux }
          - { os: windows-latest, target: windows }
          - { os: macos-latest, target: macos }
        demo-folder:
          - examples/demo-atlantis
          # - examples/demo-component-manifest
          - examples/demo-component-versions
          - examples/demo-context
          # - examples/demo-custom-command
          # - examples/demo-json-validation
          # - examples/demo-opa-validation
          # - examples/demo-opentofu
          # - examples/demo-project
          # - examples/demo-stacks
          # - examples/demo-terraform
          # - examples/demo-terraform-overrides
          # - examples/demo-workflows
          # - examples/demo-yaml-anchors
          # - examples/demo-mock-architecture
          # - examples/demo-stack-templating
          # - examples/demo-multi-cloud
          - examples/demo-vendoring
          - examples/config-profiles
          - tests/fixtures/scenarios/complete

    timeout-minutes: 20
    steps:
      - name: Check out code into the Go module directory
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Add GNU tar to flavor.target (significantly faster than windows tar)
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        run: echo "C:\Program Files\Git\usr\bin" >> $Env:GITHUB_PATH

      - name: Download build artifacts for ${{ matrix.flavor.target }}
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: build-artifacts-${{ matrix.flavor.target }}
          path: ${{ github.workspace }}

      - name: Add build artifacts directory to PATH for linux or macos
        if: matrix.flavor.target == 'linux' || matrix.flavor.target == 'macos'
        run: |
          echo "${{ github.workspace }}" >> $GITHUB_PATH
          chmod +x "${{ github.workspace }}/atmos"

      - name: Add build artifacts directory to PATH for windows
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        shell: pwsh
        run: |
          echo "${{ github.workspace }}" >> $Env:GITHUB_PATH

      - name: Install Terraform
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: Install OpenTofu
        if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
        uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
        with:
          tofu_version: ${{ env.OPEN_TOFU_VERSION }}
          tofu_wrapper: false

      - name: Run tests in ${{ matrix.demo-folder }} for ${{ matrix.flavor.target }}
        working-directory: ${{ matrix.demo-folder }}
        if: matrix.flavor.target == 'linux' || matrix.flavor.target == 'macos'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          atmos test

      - name: Check atmos.exe integrity
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        shell: pwsh
        run: |
          Write-Output "PATH=$Env:PATH"
          Write-Output "PATHEXT=$Env:PATHEXT"
          Get-ChildItem "${{ github.workspace }}"
          Get-Command "${{ github.workspace }}\atmos.exe"
          atmos version

      - name: Run tests in ${{ matrix.demo-folder }} for ${{ matrix.flavor.target }}
        working-directory: ${{ matrix.demo-folder }}
        if: matrix.flavor.target == 'windows' && ! github.event.pull_request.draft
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          atmos test

  # run other demo tests
  lint:
    name: "[lint] ${{ matrix.demo-folder }}"
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: write
      pull-requests: read
    strategy:
      fail-fast: false
      matrix:
        demo-folder:
          # - demo-component-manifest
          - demo-context
          # - demo-custom-command
          # - demo-json-validation
          # - demo-library
          # - demo-floci
          # - demo-opa-validation
          # - demo-opentofu
          # - demo-project
          # - demo-stacks
          # - demo-terraform
          # - demo-terraform-overrides
          # - demo-workflows
          # - demo-yaml-anchors
          # - demo-mock-architecture
          # - demo-stack-templating
          # - demo-multi-cloud
          - quick-start-advanced
          #- quick-start-simple

    timeout-minutes: 20
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
          terraform_wrapper: false

      - name: Install OpenTofu
        uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
        with:
          tofu_version: ${{ env.OPEN_TOFU_VERSION }}
          tofu_wrapper: false

      - name: Lint examples/${{ matrix.demo-folder }}/components/terraform
        uses: reviewdog/action-tflint@54a5e5aed57dcfbb4662ec548de876df33d6288d # v1
        with:
          github_token: ${{ github.token }}
          working_directory: examples/${{ matrix.demo-folder }}/components/terraform
          flags: >-
            --enable-rule=terraform_unused_declarations
            --disable-rule=terraform_typed_variables
            --minimum-failure-severity=warning
            --recursive
            --config=${{ github.workspace }}/examples/.tflint.hcl
          fail_level: error

  # run other demo tests
  validate:
    name: "[validate] ${{ matrix.demo-folder }}"
    needs: build
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        demo-folder:
          - demo-context
          - demo-floci
          - demo-stacks
          - demo-helmfile
          - quick-start-advanced
          - quick-start-simple

    timeout-minutes: 20
    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      # The example stacks pin their `# yaml-language-server: $schema` modeline to the
      # published schema at atmos.tools, which only updates after a PR merges and the site
      # deploys. yaml-language-server gives the inline modeline absolute precedence over the
      # `schemaMapping` below, so without this step the examples would always validate against
      # the live (stale) schema — and a PR could never add a schema field and use it in an
      # example at the same time. Rewrite the modeline URL to the in-repo schema (ephemeral,
      # CI checkout only) so examples are validated against the schema this PR actually ships.
      # The committed files keep the public URL for users who copy them.
      - name: Use in-repo schema for validation
        run: |
          find "examples/${{ matrix.demo-folder }}/stacks" -type f \( -name '*.yaml' -o -name '*.yml' \) -print0 \
            | xargs -0 --no-run-if-empty sed -i \
              "s#https://atmos.tools/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json#file://${GITHUB_WORKSPACE}/website/static/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json#g"

      - name: Validate YAML Schema for Stacks
        uses: InoUno/yaml-ls-check@2c229b85b877b2853b40bd0fbdcfccff5ff735c7 # v1.4.0
        with:
          root: "examples/${{ matrix.demo-folder }}/stacks"
          schemaMapping: |
            {
              "file://${{ github.workspace }}/website/static/schemas/atmos/atmos-manifest/1.0/atmos-manifest.json": [
                "examples/${{ matrix.demo-folder }}/stacks/**/*.yaml",
                "examples/${{ matrix.demo-folder }}/stacks/**/*.yml"
              ]
            }

  release:
    needs: [test, lint, mock, k3s, floci, floci-go, docker, validate]
    if: github.event_name == 'push'
    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@8244c7c9142e92281e7841f655fa48e9ceb9b454 # main
    with:
      publish: false
      format: binary
      runs-on: '["runs-on=${{github.run_id}}", "runner=large", "tag=atmos","extras=s3-cache", "private=false"]'
    secrets: inherit