Merge branch 'main' into renovate/actions-checkout-6.x

Author: mergify[bot]

.github/workflows/test.yml

@@ -100,6 +100,10 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: "go.mod"
+          # Disable setup-go's module cache to avoid restoring or saving mutable
+          # cache entries from PR-controlled keys; make deps repopulates modules
+          # from checksummed sources instead.
+          cache: false
         id: go
 
       - name: Set up Atmos bootstrap
@@ -254,6 +258,10 @@ jobs:
         if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
         with:
           go-version-file: "go.mod"
+          # Disable setup-go's module cache to avoid restoring or saving mutable
+          # cache entries from PR-controlled keys; make deps repopulates modules
+          # from checksummed sources instead.
+          cache: false
         id: go
 
       - name: Get dependencies
@@ -298,8 +306,6 @@ jobs:
           PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Skip precondition checks in CI to ensure tests run and maintain coverage
           ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
-          # Enable Playwright integration tests to validate browser driver download
-          RUN_PLAYWRIGHT_INTEGRATION: 1
         run: TESTARGS="-skip=^TestTerraformRegistryCache$" atmos test acceptance --cover
 
       - name: Acceptance tests
@@ -319,8 +325,6 @@ jobs:
           PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Skip precondition checks in CI to ensure tests run and maintain coverage
           ATMOS_TEST_SKIP_PRECONDITION_CHECKS: true
-          # Enable Playwright integration tests to validate browser driver download
-          RUN_PLAYWRIGHT_INTEGRATION: 1
         run: atmos test acceptance
 
       - name: Upload coverage report artifact

.golangci.yml

@@ -66,6 +66,7 @@ linters:
           files:
             - "$all"
             - "!**/pkg/auth/providers/**"
+            - "!**/pkg/store/providers/**"
             - "!**/pkg/auth/identities/**"
             - "!**/pkg/auth/cloud/**"
             - "!**/pkg/auth/factory/**"

cmd/terraform/utils.go

@@ -45,6 +45,9 @@ const ciHookFailedMsg = "CI hook execution failed"
 // logKeyComponent is the structured-log key for a component name.
 const logKeyComponent = "component"
 
+// logKeyStack is the structured-log key for a stack name.
+const logKeyStack = "stack"
+
 // verifyPlanFlagName is the tri-state planfile-verify flag (--verify-plan,
 // --verify-plan=false).
 const verifyPlanFlagName = "verify-plan"
@@ -1155,7 +1158,7 @@ func handleUnconfiguredPlanfileStorage(atmosConfig *schema.AtmosConfiguration, i
 
 	if v := atmosConfig.Components.Terraform.Planfiles.Verify; v == schema.PlanfileVerifyFail || v == schema.PlanfileVerifyWarn {
 		log.Warn("components.terraform.planfiles.verify is set but planfile storage is not configured; skipping planfile verification",
-			logKeyComponent, info.ComponentFromArg, "stack", info.Stack)
+			logKeyComponent, info.ComponentFromArg, logKeyStack, info.Stack)
 	}
 	return nil
 }
@@ -1172,7 +1175,7 @@ func handleMissingStoredPlan(atmosConfig *schema.AtmosConfiguration, info *schem
 	}
 
 	log.Warn("No stored planfile found to verify; applying a fresh plan without verification",
-		logKeyComponent, info.ComponentFromArg, "stack", info.Stack)
+		logKeyComponent, info.ComponentFromArg, logKeyStack, info.Stack)
 	return nil
 }
 
@@ -1314,7 +1317,7 @@ func handleInteractiveComponentStackSelection(info *schema.ConfigAndStacksInfo,
 	// If stack is already provided (via --stack flag), filter components to that stack.
 	if info.ComponentFromArg == "" {
 		component, err := promptForComponent(cmd, info.Stack)
-		if err = handlePromptError(err, "component"); err != nil {
+		if err = handlePromptError(err, logKeyComponent); err != nil {
 			return err
 		}
 		info.ComponentFromArg = component
@@ -1323,7 +1326,7 @@ func handleInteractiveComponentStackSelection(info *schema.ConfigAndStacksInfo,
 	// Prompt for stack if missing.
 	if info.Stack == "" {
 		stack, err := promptForStack(cmd, info.ComponentFromArg)
-		if err = handlePromptError(err, "stack"); err != nil {
+		if err = handlePromptError(err, logKeyStack); err != nil {
 			return err
 		}
 		info.Stack = stack

internal/exec/template_funcs_store_test.go

@@ -12,6 +12,7 @@ import (
 	errUtils "github.com/cloudposse/atmos/errors"
 	"github.com/cloudposse/atmos/pkg/schema"
 	"github.com/cloudposse/atmos/pkg/store"
+	"github.com/cloudposse/atmos/pkg/store/providers"
 	u "github.com/cloudposse/atmos/pkg/utils"
 )
 
@@ -25,7 +26,7 @@ func TestStoreTemplateFunc(t *testing.T) {
 	t.Setenv("ATMOS_REDIS_URL", redisUrl)
 
 	// Create a new Redis store
-	redisStore, err := store.NewRedisStore(store.RedisStoreOptions{
+	redisStore, err := providers.NewRedisStore(providers.RedisStoreOptions{
 		URL: &redisUrl,
 	})
 	assert.NoError(t, err)
@@ -124,7 +125,7 @@ func TestComponentConfigWithStoreTemplateFunc(t *testing.T) {
 	t.Setenv("ATMOS_REDIS_URL", redisUrl)
 
 	// Create a new Redis store
-	redisStore, err := store.NewRedisStore(store.RedisStoreOptions{
+	redisStore, err := providers.NewRedisStore(providers.RedisStoreOptions{
 		URL: &redisUrl,
 	})
 	assert.NoError(t, err)

internal/exec/yaml_func_store_get_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/cloudposse/atmos/pkg/schema"
 	"github.com/cloudposse/atmos/pkg/store"
+	"github.com/cloudposse/atmos/pkg/store/providers"
 )
 
 func TestProcessTagStoreGet(t *testing.T) {
@@ -24,7 +25,7 @@ func TestProcessTagStoreGet(t *testing.T) {
 	t.Setenv("ATMOS_REDIS_URL", redisUrl)
 
 	// Create a new Redis store
-	redisStore, err := store.NewRedisStore(store.RedisStoreOptions{
+	redisStore, err := providers.NewRedisStore(providers.RedisStoreOptions{
 		URL: &redisUrl,
 	})
 	assert.NoError(t, err)
@@ -42,7 +43,7 @@ func TestProcessTagStoreGet(t *testing.T) {
 
 	// Add some arbitrary keys directly in Redis for testing GetKey
 	// We need to access the Redis client directly to set arbitrary keys
-	redisClient := redisStore.(*store.RedisStore).RedisClient()
+	redisClient := redisStore.(*providers.RedisStore).RedisClient()
 
 	// Set arbitrary keys directly in Redis
 	globalConfig := map[string]interface{}{

internal/exec/yaml_func_store_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/cloudposse/atmos/pkg/schema"
 	"github.com/cloudposse/atmos/pkg/store"
+	"github.com/cloudposse/atmos/pkg/store/providers"
 )
 
 func TestProcessTagStore(t *testing.T) {
@@ -22,7 +23,7 @@ func TestProcessTagStore(t *testing.T) {
 	t.Setenv("ATMOS_REDIS_URL", redisUrl)
 
 	// Create a new Redis store
-	redisStore, err := store.NewRedisStore(store.RedisStoreOptions{
+	redisStore, err := providers.NewRedisStore(providers.RedisStoreOptions{
 		URL: &redisUrl,
 	})
 	assert.NoError(t, err)

main_hooks_and_keychain_store_integration_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/cloudposse/atmos/pkg/store"
+	"github.com/cloudposse/atmos/pkg/store/providers"
 )
 
 // TestMainHooksAndKeychainStoreIntegration proves end-to-end, with no cloud credentials and no
@@ -63,7 +63,7 @@ func TestMainHooksAndKeychainStoreIntegration(t *testing.T) {
 
 	// Round-trip: read the value back through a keychain store constructed with the same options.
 	// This asserts the hook persisted the exact content, not merely that a deploy succeeded.
-	s, err := store.NewKeychainStore(&store.KeychainStoreOptions{Backend: "file"})
+	s, err := providers.NewKeychainStore(&providers.KeychainStoreOptions{Backend: "file"})
 	require.NoError(t, err)
 	got, err := s.Get("test", "component1", "random_id")
 	require.NoError(t, err)

pkg/auth/providers/aws/saml_storage_test.go

@@ -461,8 +461,10 @@ func TestSAMLProvider_BrowserSetupGatedOnDriverType(t *testing.T) {
 
 func TestSAMLProvider_Authenticate_BrowserGateCreatesDir(t *testing.T) {
 	// Verify the browser gate in Authenticate: when driver is "Browser",
-	// the storage directory is created. Uses a non-download config so
-	// saml2aws.NewSAMLClient is fast (no Playwright initialization).
+	// the storage setup path creates the directory. Keep this focused on
+	// setupBrowserAutomation rather than the full saml2aws browser runtime:
+	// on Windows, Playwright can leave node.exe locked under t.TempDir and
+	// make Go's automatic TempDir cleanup fail even after the test body passes.
 	homeDir := t.TempDir()
 	t.Setenv("HOME", homeDir)
 	t.Setenv("USERPROFILE", homeDir)
@@ -476,9 +478,7 @@ func TestSAMLProvider_Authenticate_BrowserGateCreatesDir(t *testing.T) {
 		RoleToAssumeFromAssertion: "arn:aws:iam::123456789012:role/test",
 	}
 
-	// Authenticate fails downstream (no real IDP), but the browser gate
-	// runs first and creates the storage directory.
-	_, _ = p.Authenticate(context.TODO())
+	require.NoError(t, p.setupBrowserAutomation())
 
 	saml2awsDir := filepath.Join(homeDir, ".aws", "saml2aws")
 	info, err := os.Stat(saml2awsDir)

pkg/config/utils.go

@@ -15,6 +15,7 @@ import (
 	"github.com/cloudposse/atmos/pkg/perf"
 	"github.com/cloudposse/atmos/pkg/schema"
 	"github.com/cloudposse/atmos/pkg/store"
+	_ "github.com/cloudposse/atmos/pkg/store/providers" // Register the built-in store backends.
 	"github.com/cloudposse/atmos/pkg/ui"
 	u "github.com/cloudposse/atmos/pkg/utils"
 	"github.com/cloudposse/atmos/pkg/version"

pkg/datafetcher/schema/atmos/config/1.0.json

@@ -8974,7 +8974,8 @@
       "type": "object"
     },
     "StoreRegistry": {
-      "type": "object"
+      "type": "object",
+      "description": "StoreRegistry is a map of store name to a live store implementation."
     },
     "SyntaxHighlighting": {
       "properties": {