fix(kubernetes): honor validate:false, surface real git errors, close schema gap

A field-test pass over the Kustomize GitOps delivery feature found four
real bugs, all fixed here:

- validate: false on a Kubernetes component was silently dropped during
  stack processing and never reached any command: internal/exec's
  Kubernetes comp-assembly copied provider/paths/manifests/render but
  never validate. Threaded it through the full 3-layer merge (global ->
  base component -> instance) via the same key-presence-safe
  mergeComponentAnySection pattern paths/manifests already use (not
  provider's zero-value pattern, which would be unsafe for a bool), plus
  the matching --affected diffing and base-component cache entries.

- Git target errors (atmos kubernetes deploy/apply --target <git>) were
  always opaque ("git clone (exit 128)", no cause) because the git
  provisioner target never captured subprocess stderr, unlike the atmos
  git command family. Moved the capture-and-hint machinery from cmd/git
  into exported pkg/git symbols (CaptureStderr, WrapOperationError) so
  both share one implementation, and wired it into the provisioner's
  clone/commit/push calls.

- components.kubernetes.<name>.validate: false failed schema validation
  ("additionalProperties 'validate' not allowed') because the repo has
  three hand-maintained copies of the stack-manifest JSON schema and the
  original fix only patched one; atmos describe stacks/validate stacks
  enforce a different copy. Patched the copy that's actually enforced and
  added a regression test.

- A successful git-target delivery printed nothing at all, unlike cluster
  apply and validate. Added a confirmation message.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: osterman

cmd/git/executor.go

@@ -1,18 +1,14 @@
 package git
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	errUtils "github.com/cloudposse/atmos/errors"
 	atmosgit "github.com/cloudposse/atmos/pkg/git"
-	iolib "github.com/cloudposse/atmos/pkg/io"
 	"github.com/cloudposse/atmos/pkg/perf"
 	"github.com/cloudposse/atmos/pkg/ui"
 	"github.com/cloudposse/atmos/pkg/ui/spinner"
@@ -38,10 +34,6 @@ type Executor struct {
 	provider atmosgit.Provider
 }
 
-type stderrSwapper interface {
-	SwapStderr(io.Writer) func()
-}
-
 // newExecutor builds an Executor using the named provider from the registry.
 // Pass an empty string to use the default "cli" provider.
 func newExecutor(providerName string) (*Executor, error) {
@@ -65,12 +57,12 @@ func (e *Executor) Init(ctx context.Context, opts *atmosgit.InitOptions, label s
 	reconcile := initWillReconcile(opts)
 	progressMsg := initProgressMessage(label, opts, reconcile)
 	completedMsg := initCompletedMessage(label, opts, reconcile)
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		return spinner.ExecWithSpinner(progressMsg, completedMsg, func() error {
 			return e.provider.Init(ctx, opts)
 		})
 	})
-	return wrapGitOperationError(
+	return atmosgit.WrapOperationError(
 		fmt.Sprintf("initialize Git repository %q", label),
 		opts.Workdir,
 		stderr,
@@ -133,7 +125,7 @@ func (e *Executor) Clone(ctx context.Context, opts *atmosgit.CloneOptions, label
 
 	progressMsg := fmt.Sprintf("Cloning %s", label)
 	completedMsg := fmt.Sprintf("Cloned %s into %s.", label, opts.Workdir)
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		return spinner.ExecWithSpinner(progressMsg, completedMsg, func() error {
 			return e.provider.Clone(ctx, opts)
 		})
@@ -144,7 +136,7 @@ func (e *Executor) Clone(ctx context.Context, opts *atmosgit.CloneOptions, label
 func (e *Executor) CloneWithoutSpinner(ctx context.Context, opts *atmosgit.CloneOptions, label string) error {
 	defer perf.Track(nil, "git.Executor.CloneWithoutSpinner")()
 
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		return e.provider.Clone(ctx, opts)
 	})
 	if err != nil {
@@ -155,22 +147,8 @@ func (e *Executor) CloneWithoutSpinner(ctx context.Context, opts *atmosgit.Clone
 	return nil
 }
 
-func (e *Executor) captureStderr(operation func() error) (string, error) {
-	swapper, ok := e.provider.(stderrSwapper)
-	if !ok {
-		return "", operation()
-	}
-
-	var stderr bytes.Buffer
-	restore := swapper.SwapStderr(iolib.MaskWriter(&stderr))
-	defer restore()
-
-	err := operation()
-	return strings.TrimSpace(stderr.String()), err
-}
-
 func wrapCloneError(label, workdir, stderr string, err error) error {
-	return wrapGitOperationError(
+	return atmosgit.WrapOperationError(
 		fmt.Sprintf("clone Git repository %q", label),
 		workdir,
 		stderr,
@@ -179,34 +157,11 @@ func wrapCloneError(label, workdir, stderr string, err error) error {
 	)
 }
 
-func wrapGitOperationError(action, workdir, stderr string, err error, hint string) error {
-	if err == nil {
-		return nil
-	}
-
-	explanation := fmt.Sprintf("Failed to %s.", action)
-	if workdir != "" {
-		explanation = fmt.Sprintf("Failed to %s in %q.", action, workdir)
-	}
-	explanation += "\n\nUnderlying error:\n\n```text\n" + err.Error() + "\n```"
-	if stderr != "" {
-		explanation += "\n\nGit output:\n\n```text\n" + stderr + "\n```"
-	}
-
-	builder := errUtils.Build(err).
-		WithExplanation(explanation).
-		WithExitCode(2)
-	if hint != "" {
-		builder = builder.WithHint(hint)
-	}
-	return builder.Err()
-}
-
 // Pull delegates to the provider.
 func (e *Executor) Pull(ctx context.Context, opts *atmosgit.PullOptions) error {
 	defer perf.Track(nil, "git.Executor.Pull")()
 
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		return e.provider.Pull(ctx, opts)
 	})
 	if errors.Is(err, errUtils.ErrGitNoTrackingBranch) {
@@ -218,7 +173,7 @@ func (e *Executor) Pull(ctx context.Context, opts *atmosgit.PullOptions) error {
 			Err()
 	}
 	if err != nil {
-		return wrapGitOperationError(
+		return atmosgit.WrapOperationError(
 			"pull Git repository",
 			opts.Workdir,
 			stderr,
@@ -236,13 +191,13 @@ func (e *Executor) Status(ctx context.Context, opts *atmosgit.StatusOptions) (*a
 	defer perf.Track(nil, "git.Executor.Status")()
 
 	var result *atmosgit.StatusResult
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		var opErr error
 		result, opErr = e.provider.Status(ctx, opts)
 		return opErr
 	})
 	if err != nil {
-		return nil, wrapGitOperationError("read Git status", opts.Workdir, stderr, err, "")
+		return nil, atmosgit.WrapOperationError("read Git status", opts.Workdir, stderr, err, "")
 	}
 	return result, nil
 }
@@ -252,13 +207,13 @@ func (e *Executor) Diff(ctx context.Context, opts *atmosgit.DiffOptions) (*atmos
 	defer perf.Track(nil, "git.Executor.Diff")()
 
 	var result *atmosgit.DiffResult
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		var opErr error
 		result, opErr = e.provider.Diff(ctx, opts)
 		return opErr
 	})
 	if err != nil {
-		return nil, wrapGitOperationError("show Git diff", opts.Workdir, stderr, err, "")
+		return nil, atmosgit.WrapOperationError("show Git diff", opts.Workdir, stderr, err, "")
 	}
 	return result, nil
 }
@@ -268,13 +223,13 @@ func (e *Executor) Commit(ctx context.Context, opts *atmosgit.CommitOptions) (*a
 	defer perf.Track(nil, "git.Executor.Commit")()
 
 	var result *atmosgit.CommitResult
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		var opErr error
 		result, opErr = e.provider.Commit(ctx, opts)
 		return opErr
 	})
 	if err != nil {
-		return nil, wrapGitOperationError("commit Git changes", opts.Workdir, stderr, err, "")
+		return nil, atmosgit.WrapOperationError("commit Git changes", opts.Workdir, stderr, err, "")
 	}
 	return result, nil
 }
@@ -283,11 +238,11 @@ func (e *Executor) Commit(ctx context.Context, opts *atmosgit.CommitOptions) (*a
 func (e *Executor) Push(ctx context.Context, opts *atmosgit.PushOptions) error {
 	defer perf.Track(nil, "git.Executor.Push")()
 
-	stderr, err := e.captureStderr(func() error {
+	stderr, err := atmosgit.CaptureStderr(e.provider, func() error {
 		return e.provider.Push(ctx, opts)
 	})
 	if err != nil {
-		return wrapGitOperationError(
+		return atmosgit.WrapOperationError(
 			"push Git repository",
 			opts.Workdir,
 			stderr,

internal/exec/describe_affected_components.go

@@ -590,6 +590,7 @@ func addKubernetesSectionAffected(
 		{sectionNamePaths, affectedReasonStackPaths},
 		{sectionNameManifests, affectedReasonStackManifests},
 		{sectionNameRender, affectedReasonStackRender},
+		{cfg.ValidateSectionName, fmt.Sprintf("stack.%s", cfg.ValidateSectionName)},
 	}...)
 	sections = appendSectionChecks(sections, resolveComponentSectionChecks(atmosConfig)...)
 

internal/exec/stack_processor_cache.go

@@ -139,6 +139,11 @@ func deepCopyBaseComponentConfigMaps(dst, src *schema.BaseComponentConfig) error
 			return err
 		}
 	}
+	if src.BaseComponentValidate != nil {
+		if dst.BaseComponentValidate, err = deepCopyComponentAnySection(src.BaseComponentValidate); err != nil {
+			return err
+		}
+	}
 	if src.BaseComponentPlugins != nil {
 		if dst.BaseComponentPlugins, err = deepCopyComponentAnySection(src.BaseComponentPlugins); err != nil {
 			return err

internal/exec/stack_processor_merge.go

@@ -381,6 +381,17 @@ func mergeComponentConfigurations(atmosConfig *schema.AtmosConfiguration, opts *
 		return nil, err
 	}
 
+	finalComponentValidate, err := mergeComponentAnySection(
+		mergeConfig,
+		cfg.ValidateSectionName,
+		opts.GlobalKubernetesValidate,
+		result.BaseComponentValidate,
+		result.ComponentValidate,
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	var finalComponentRender map[string]any
 	if opts.ComponentType == cfg.KubernetesComponentType {
 		finalComponentRender, err = m.Merge(
@@ -608,6 +619,9 @@ func mergeComponentConfigurations(atmosConfig *schema.AtmosConfiguration, opts *
 		if len(finalComponentRender) > 0 {
 			comp[cfg.RenderSectionName] = finalComponentRender
 		}
+		if finalComponentValidate != nil {
+			comp[cfg.ValidateSectionName] = finalComponentValidate
+		}
 		comp[cfg.GenerateSectionName] = finalComponentGenerate
 	}
 

internal/exec/stack_processor_merge_test.go

@@ -735,6 +735,48 @@ func TestMergeComponentConfigurations_Kubernetes(t *testing.T) {
 		assert.Equal(t, "global-wd", provision["workdir"])
 		assert.Equal(t, "5m", provision["timeout"])
 	})
+
+	t.Run("validate-component-instance-false-overrides-base-true", func(t *testing.T) {
+		opts := ComponentProcessorOptions{
+			ComponentType: cfg.KubernetesComponentType,
+			Component:     "api",
+			AtmosConfig:   atmosCfg,
+		}
+		res := minimalComponentResult()
+		res.BaseComponentValidate = true
+		res.ComponentValidate = false
+		comp, err := mergeComponentConfigurations(atmosCfg, &opts, res)
+		require.NoError(t, err)
+		assert.Equal(t, false, comp[cfg.ValidateSectionName],
+			"an explicit component-instance validate:false must override a base-component validate:true")
+	})
+
+	t.Run("validate-base-true-flows-through-when-component-unset", func(t *testing.T) {
+		opts := ComponentProcessorOptions{
+			ComponentType: cfg.KubernetesComponentType,
+			Component:     "api",
+			AtmosConfig:   atmosCfg,
+		}
+		res := minimalComponentResult()
+		res.BaseComponentValidate = true
+		comp, err := mergeComponentConfigurations(atmosCfg, &opts, res)
+		require.NoError(t, err)
+		assert.Equal(t, true, comp[cfg.ValidateSectionName],
+			"base-component validate:true must flow through when the component instance sets nothing")
+	})
+
+	t.Run("validate-unset-everywhere-is-absent-from-comp", func(t *testing.T) {
+		opts := ComponentProcessorOptions{
+			ComponentType: cfg.KubernetesComponentType,
+			Component:     "api",
+			AtmosConfig:   atmosCfg,
+		}
+		res := minimalComponentResult()
+		comp, err := mergeComponentConfigurations(atmosCfg, &opts, res)
+		require.NoError(t, err)
+		_, ok := comp[cfg.ValidateSectionName]
+		assert.False(t, ok, "validate must be absent (not defaulted to any value) when unset at every layer")
+	})
 }
 
 // TestMergeComponentConfigurations_Retry covers the per-component retry merge added by

internal/exec/stack_processor_process_stacks.go

@@ -166,6 +166,7 @@ func ProcessStackConfig(
 	var kubernetesPaths any
 	var kubernetesManifests any
 	kubernetesRender := map[string]any{}
+	var kubernetesValidate any
 
 	helmVars := map[string]any{}
 	helmSettings := map[string]any{}
@@ -812,6 +813,10 @@ func ProcessStackConfig(
 		}
 	}
 
+	if i, ok := globalKubernetesSection[cfg.ValidateSectionName]; ok {
+		kubernetesValidate = i
+	}
+
 	// Helm section.
 	if i, ok := globalHelmSection[cfg.CommandSectionName]; ok {
 		helmCommand, ok = i.(string)
@@ -1146,6 +1151,7 @@ func ProcessStackConfig(
 					GlobalKubernetesPaths:      kubernetesPaths,
 					GlobalKubernetesManifests:  kubernetesManifests,
 					GlobalKubernetesRender:     kubernetesRender,
+					GlobalKubernetesValidate:   kubernetesValidate,
 					AtmosConfig:                atmosConfig,
 				}, nil
 			}

internal/exec/stack_processor_process_stacks_helpers.go

@@ -53,6 +53,7 @@ type ComponentProcessorOptions struct {
 	GlobalKubernetesPaths     any
 	GlobalKubernetesManifests any
 	GlobalKubernetesRender    map[string]any
+	GlobalKubernetesValidate  any
 
 	// Atmos configuration.
 	AtmosConfig *schema.AtmosConfiguration
@@ -70,6 +71,7 @@ type ComponentProcessorResult struct {
 	ComponentProvider     string
 	ComponentPaths        any
 	ComponentManifests    any
+	ComponentValidate     any
 	// ComponentPlugins holds the Helm CLI plugins list (helm/helmfile components).
 	ComponentPlugins any
 	ComponentRender  map[string]any
@@ -94,6 +96,7 @@ type ComponentProcessorResult struct {
 	BaseComponentProvider      string
 	BaseComponentPaths         any
 	BaseComponentManifests     any
+	BaseComponentValidate      any
 	// BaseComponentPlugins holds the inherited Helm CLI plugins list from base components.
 	BaseComponentPlugins any
 	BaseComponentRender  map[string]any

internal/exec/stack_processor_process_stacks_helpers_extraction.go

@@ -290,6 +290,10 @@ func extractComponentSections(opts *ComponentProcessorOptions, result *Component
 			result.ComponentManifests = i
 		}
 
+		if i, ok := opts.ComponentMap[cfg.ValidateSectionName]; ok {
+			result.ComponentValidate = i
+		}
+
 		if i, ok := opts.ComponentMap[cfg.RenderSectionName]; ok {
 			componentRender, ok := i.(map[string]any)
 			if !ok {

internal/exec/stack_processor_process_stacks_helpers_inheritance.go

@@ -235,6 +235,7 @@ func applyBaseComponentConfig(opts *ComponentProcessorOptions, result *Component
 	result.BaseComponentProvider = baseComponentConfig.BaseComponentProvider
 	result.BaseComponentPaths = baseComponentConfig.BaseComponentPaths
 	result.BaseComponentManifests = baseComponentConfig.BaseComponentManifests
+	result.BaseComponentValidate = baseComponentConfig.BaseComponentValidate
 	result.BaseComponentRender = baseComponentConfig.BaseComponentRender
 	result.BaseComponentHelm = baseComponentConfig.BaseComponentHelm
 	// BaseComponentRetry flows from the inheritance chain through to merge — see

internal/exec/stack_processor_utils.go

@@ -2319,6 +2319,7 @@ func processBaseComponentConfigInternal(
 	var baseComponentProvider string
 	var baseComponentPaths any
 	var baseComponentManifests any
+	var baseComponentValidate any
 	var baseComponentPlugins any
 	var baseComponentRender map[string]any
 	var baseComponentHelm map[string]any
@@ -2547,6 +2548,10 @@ func processBaseComponentConfigInternal(
 			baseComponentManifests = baseComponentManifestsSection
 		}
 
+		if baseComponentValidateSection, baseComponentValidateSectionExist := baseComponentMap[cfg.ValidateSectionName]; baseComponentValidateSectionExist {
+			baseComponentValidate = baseComponentValidateSection
+		}
+
 		if baseComponentPluginsSection, baseComponentPluginsSectionExist := baseComponentMap[cfg.PluginsSectionName]; baseComponentPluginsSectionExist {
 			baseComponentPlugins = baseComponentPluginsSection
 		}
@@ -2784,6 +2789,13 @@ func processBaseComponentConfigInternal(
 		}
 		baseComponentConfig.BaseComponentManifests = mergedAny
 
+		// Base component `validate`
+		mergedAny, err = mergeComponentAnySection(levelMergeConfig, cfg.ValidateSectionName, baseComponentConfig.BaseComponentValidate, baseComponentValidate)
+		if err != nil {
+			return err
+		}
+		baseComponentConfig.BaseComponentValidate = mergedAny
+
 		// Base component `plugins` (Helm CLI plugins list).
 		mergedAny, err = mergeComponentAnySection(levelMergeConfig, cfg.PluginsSectionName, baseComponentConfig.BaseComponentPlugins, baseComponentPlugins)
 		if err != nil {