Merge branch 'main' into fix/concurrent-terminal-output

Author: osterman

.atmos.d/dev.yaml

@@ -144,11 +144,11 @@ commands:
                 content: NOTICE regenerated.
 
           - name: mocks
-            description: Regenerate auth/http mocks using go:generate directives
+            description: Regenerate auth/http/store mocks using go:generate directives
             env: *go_auto_env
             steps:
               - type: atmos
-                command: test generate-auth-http-mocks
+                command: test generate-auth-http-store-mocks
 
           - name: snapshots
             description: Regenerate CLI golden snapshots

.atmos.d/test.yaml

@@ -20,7 +20,7 @@ commands:
         default: false
       - name: generate-mocks
         type: bool
-        description: Regenerate auth/http mocks using go:generate directives
+        description: Regenerate auth/http/store mocks using go:generate directives
         default: false
     steps:
       - type: shell
@@ -44,7 +44,7 @@ commands:
           {{- if .Flags.full }} acceptance
           {{- else if .Flags.coverage }} acc-coverage
           {{- else if .Flags.race }} race
-          {{- else if index .Flags "generate-mocks" }} generate-auth-http-mocks
+          {{- else if index .Flags "generate-mocks" }} generate-auth-http-store-mocks
           {{- else }} short
           {{- end }}
     commands:
@@ -155,11 +155,13 @@ commands:
           - type: shell
             command: go test -race -shuffle=on ${TEST:-$(go list ./...)} ${TESTARGS:-} -timeout 10m
 
-      - name: generate-auth-http-mocks
-        description: Regenerate auth/http mocks using go:generate directives
+      - name: generate-auth-http-store-mocks
+        description: Regenerate auth/http/store mocks using go:generate directives
         env: *go_auto_env
         steps:
           - type: shell
             command: go generate ./pkg/auth/types/...
           - type: shell
             command: go generate ./pkg/http/...
+          - type: shell
+            command: go generate ./pkg/store/...

agent-skills/skills/atmos-hooks/SKILL.md

@@ -60,6 +60,9 @@ Use before/after events for component operations, for example:
 - `before.terraform.apply`, `after.terraform.apply`
 - `before.terraform.deploy`, `after.terraform.deploy`
 - `before.terraform.test`, `after.terraform.test`
+- `before.terraform.output`, `after.terraform.output` — fires for `atmos terraform output`,
+  useful for backfilling a store from already-deployed infrastructure without an `apply`
+- `before.terraform.refresh`, `after.terraform.refresh`
 
 Kubernetes provides `before`/`after` events for `render`, `diff`/`plan`, `apply`/`deploy`,
 `delete`, and `validate`. Native Helm provides `template`, `diff`, `apply`/`deploy`, and

agent-skills/skills/atmos-steps/SKILL.md

@@ -93,7 +93,7 @@ the type-specific files under `website/docs/workflows/workflows/workflow/steps/t
 as the canonical reference. Current canonical step types include:
 
 - Command and integration: `atmos`, `shell`, `script`, `exec`, `container`,
-  `emulator`, `http`, `archive`, `require`, `workdir`, `cast`.
+  `emulator`, `http`, `archive`, `require`, `workdir`, `cast`, `store`.
 - Orchestration: `parallel`, `matrix`, `wait`, `wait-all`, `cancel`.
 - Interactive: `input`, `confirm`, `choose`, `filter`, `file`, `write`.
 - UI and output: `toast`, `markdown`, `spin`, `table`, `pager`, `format`,

agent-skills/skills/atmos-stores/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: atmos-stores
-description: "Store backends: AWS SSM, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Redis, Artifactory configuration, hooks integration, cross-component data sharing"
+description: "Store backends: AWS SSM, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Redis, Artifactory configuration, hooks integration, cross-component data sharing, atmos store CLI CRUD, type: store workflow step"
 metadata:
   copyright: Copyright Cloud Posse, LLC 2026
   version: "1.0.0"
@@ -324,6 +324,47 @@ components:
 
 Atmos merges these into a complete hook definition at resolution time.
 
+## Write to Stores with the CLI or a Workflow Step
+
+For raw CRUD access to any configured store, use the `atmos store` CLI command family or the
+`type: store` workflow step. This access works for any store, not only Terraform outputs. Neither
+method requires a declaration. Both operate directly on any store configured under `stores:`, by
+name.
+
+```shell
+# CLI: set, get, delete, list -- scope to a stack and component, or omit for a global value
+atmos store set app-metadata image_tag sha256:abc123 --stack=prod --component=ecs-service
+atmos store get app-metadata image_tag --stack=prod --component=ecs-service
+atmos store list
+atmos store list app-metadata --stack=prod --component=ecs-service
+```
+
+Passing a store name to `atmos store list` lists the key/value pairs stored under a scope
+(instead of the configured backends themselves), for backends that support key enumeration. Most
+backends support it. 1Password and the default system keychain backend do not, because their
+underlying APIs do not support enumeration. Check the `Listable` column in a bare
+`atmos store list` before relying on it for a given store. Values are masked the same way
+`atmos store get` masks a single value.
+
+```yaml
+# Workflow, custom-command, or hook step: write a value, for example an image tag from a build step
+- name: record-tag
+  type: store
+  action: write
+  with:
+    store: app-metadata
+    key: image_tag
+    value: "{{ .steps.push.metadata.digest }}"
+    stack: prod
+    component: ecs-service
+```
+
+Atmos allows you to write to a `secret: true` store this way, for example to write a generated
+password. But this write skips the `atmos secret` declaration and scope system. When a value must
+be tracked as a formal secret, use `secrets.vars` and `atmos secret set` instead. See the
+`atmos-secrets` skill for that system. See the `atmos-steps` skill and the
+`/workflows/steps/type/store` docs for the step type.
+
 ## Cross-Account and Cross-Region Access
 
 ### AWS Cross-Account via Role Assumption

cmd/root.go

@@ -103,6 +103,7 @@ import (
 	_ "github.com/cloudposse/atmos/cmd/scaffold"
 	_ "github.com/cloudposse/atmos/cmd/secret"
 	stackcmd "github.com/cloudposse/atmos/cmd/stack"
+	_ "github.com/cloudposse/atmos/cmd/store"
 	_ "github.com/cloudposse/atmos/cmd/terraform"
 	"github.com/cloudposse/atmos/cmd/terraform/backend"
 	terraformcache "github.com/cloudposse/atmos/cmd/terraform/cache"

cmd/store/delete.go

@@ -0,0 +1,61 @@
+package store
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/cloudposse/atmos/pkg/flags"
+	"github.com/cloudposse/atmos/pkg/perf"
+	"github.com/cloudposse/atmos/pkg/ui"
+)
+
+var deleteParser *flags.StandardParser
+
+var deleteCmd = &cobra.Command{
+	Use:     "delete STORE KEY",
+	Aliases: []string{"rm", "unset"},
+	Short:   "Remove a value from a store.",
+	Long:    "Remove a value from a configured store backend. Returns an error if the backend does not support deletion.",
+	Args:    cobra.ExactArgs(2),
+	RunE:    runStoreDelete,
+}
+
+func init() {
+	deleteParser = flags.NewStandardParser(
+		flags.WithBoolFlag("force", "f", false, "Delete without confirmation"),
+	)
+	deleteParser.RegisterFlags(deleteCmd)
+}
+
+func runStoreDelete(cmd *cobra.Command, args []string) error {
+	defer perf.Track(nil, "store.runStoreDelete")()
+
+	scope, err := parseStoreScope(cmd)
+	if err != nil {
+		return err
+	}
+	storeName, key := args[0], args[1]
+
+	force, _ := cmd.Flags().GetBool("force")
+	if !force {
+		confirmed, confErr := confirmActionFn("Delete `" + key + "` from store `" + storeName + "`?")
+		if confErr != nil {
+			return confErr
+		}
+		if !confirmed {
+			ui.Warning("Aborted")
+			return nil
+		}
+	}
+
+	svc, err := loadServiceFn(scope)
+	if err != nil {
+		return err
+	}
+
+	if err := svc.Delete(storeName, scope.Stack, scope.Component, key); err != nil {
+		return err
+	}
+
+	ui.Successf("Deleted `%s` from store `%s`", key, storeName)
+	return nil
+}

cmd/store/delete_test.go

@@ -0,0 +1,68 @@
+package store
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunStoreDelete_Force(t *testing.T) {
+	setupIO(t)
+	svc := newFakeStoreService()
+	installService(t, svc, nil)
+
+	err := runStoreSubcommand(t, "delete", "app-metadata", "image_tag", "--force", "--stack", "dev", "--component", "vpc")
+	require.NoError(t, err)
+
+	require.Len(t, svc.deleteCalls, 1)
+	assert.Equal(t, "app-metadata", svc.deleteCalls[0].name)
+	assert.Equal(t, "dev", svc.deleteCalls[0].stack)
+	assert.Equal(t, "vpc", svc.deleteCalls[0].component)
+	assert.Equal(t, "image_tag", svc.deleteCalls[0].key)
+}
+
+func TestRunStoreDelete_ConfirmedPrompt(t *testing.T) {
+	setupIO(t)
+	svc := newFakeStoreService()
+	installService(t, svc, nil)
+	titles := overrideConfirmAction(t, true, nil)
+
+	err := runStoreSubcommand(t, "delete", "app-metadata", "key")
+	require.NoError(t, err)
+
+	require.Len(t, svc.deleteCalls, 1)
+	require.Len(t, *titles, 1)
+}
+
+func TestRunStoreDelete_AbortedPrompt(t *testing.T) {
+	setupIO(t)
+	svc := newFakeStoreService()
+	installService(t, svc, nil)
+	overrideConfirmAction(t, false, nil)
+
+	err := runStoreSubcommand(t, "delete", "app-metadata", "key")
+	require.NoError(t, err)
+	assert.Empty(t, svc.deleteCalls)
+}
+
+func TestRunStoreDelete_ConfirmError(t *testing.T) {
+	setupIO(t)
+	svc := newFakeStoreService()
+	installService(t, svc, nil)
+	overrideConfirmAction(t, false, assert.AnError)
+
+	err := runStoreSubcommand(t, "delete", "app-metadata", "key")
+	require.ErrorIs(t, err, assert.AnError)
+	assert.Empty(t, svc.deleteCalls)
+}
+
+func TestRunStoreDelete_NotSupported(t *testing.T) {
+	setupIO(t)
+	svc := newFakeStoreService()
+	svc.deleteErr = assert.AnError
+	installService(t, svc, nil)
+
+	err := runStoreSubcommand(t, "delete", "app-metadata", "key", "--force")
+	require.ErrorIs(t, err, assert.AnError)
+}

cmd/store/deps.go

@@ -0,0 +1,52 @@
+package store
+
+import (
+	"github.com/cloudposse/atmos/pkg/io"
+	pstore "github.com/cloudposse/atmos/pkg/store"
+)
+
+// storeService is the subset of *pstore.Service the command handlers depend on. It exists so
+// handlers operate against an interface, letting tests inject a fake without constructing real
+// config/auth. *pstore.Service satisfies it structurally -- no change to pkg/store is required.
+type storeService interface {
+	Set(name, stack, component, key string, value any) error
+	Get(name, stack, component, key string) (any, error)
+	Delete(name, stack, component, key string) error
+	ListKeyValues(name, stack, component string) ([]pstore.KeyValue, error)
+	List() []pstore.Descriptor
+	IsSecret(name string) bool
+}
+
+// Seam variables wrap the real implementations so tests can override behavior. Each defaults to
+// the production function; handlers call the variable, never the underlying function directly.
+// Restore any override with t.Cleanup in tests.
+var (
+	// Loads a store service (config + auth) for the given scope.
+	loadServiceFn = func(scope storeScope) (storeService, error) {
+		svc, err := loadService(scope)
+		if err != nil {
+			return nil, err
+		}
+		return svc, nil
+	}
+
+	// Loads a store service for `store list`, with no authentication attempt.
+	loadServiceForListFn = func(scope storeScope) (storeService, error) {
+		svc, err := loadServiceForList(scope)
+		if err != nil {
+			return nil, err
+		}
+		return svc, nil
+	}
+
+	// Interactively reads a value (masked input).
+	promptForValueFn = promptForStoreValue
+
+	// Interactively confirms a destructive action.
+	confirmActionFn = confirmAction
+
+	// Registers a value with the output masker. Overridden in tests to record calls, since the
+	// real masker lives on a package-global io.Context that these lightweight test harnesses
+	// (which construct their own iolib.Context for data/ui output) never wire up as global.
+	registerSecretValueFn = io.RegisterSecretValue
+)

cmd/store/errors.go

@@ -0,0 +1,12 @@
+package store
+
+import "errors"
+
+// ErrStoreNameRequired indicates a store NAME argument is required.
+var ErrStoreNameRequired = errors.New("a store NAME is required")
+
+// ErrStoreKeyRequired indicates a KEY argument is required.
+var ErrStoreKeyRequired = errors.New("a KEY is required")
+
+// ErrRawFormatConflict indicates --raw was combined with a non-text --format.
+var ErrRawFormatConflict = errors.New("--raw is text-only and cannot be combined with --format=json or --format=env")