what

Fixed a regression introduced in v1.201.0 where relative paths in atmos.yaml were resolved incorrectly
Implemented correct base path resolution semantics that allow users to run atmos from anywhere inside a repository
Treats . and .. as config-file-relative paths (following the convention of tsconfig.json, package.json, etc.)
Empty base_path now triggers git root discovery with proper fallback order
Added !cwd YAML function for explicit CWD-relative paths when needed
Added comprehensive tests and documentation for path resolution semantics

why

Issue #1858 revealed that after upgrading from v1.200.0 to v1.201.0, atmos validate stacks failed with "stacks directory does not exist" when ATMOS_CLI_CONFIG_PATH pointed to a subdirectory while stacks/components were at repo root.

The root cause was that empty base_path was not properly triggering git root discovery when atmos.yaml is in a deeply nested subdirectory. The fix implements correct path resolution semantics where:

Config-file-relative paths (. and ..) work like other configuration files
Smart defaults (empty string) trigger git root discovery with proper fallback order
Simple relative paths search git root first, then fall back to config directory

Path Resolution Semantics

`base_path` value	Resolves to	Rationale
`""` (empty/unset)	Git repo root, fallback to dirname(atmos.yaml)	Smart default - most users want repo root
`"."`	dirname(atmos.yaml)	Explicit config-file-relative
`".."`	Parent of dirname(atmos.yaml)	Config-file-relative navigation
`"./foo"`	dirname(atmos.yaml)/foo	Explicit config-file-relative path
`"../foo"`	Parent of dirname(atmos.yaml)/foo	Parent traversal from config location
`"foo"` or `"foo/bar"`	Git repo root/foo, fallback to dirname(atmos.yaml)/foo	Simple relative paths anchor to repo root
`"/absolute/path"`	/absolute/path (unchanged)	Absolute paths are explicit
`!repo-root`	Git repository root	Explicit git root tag
`!cwd`	Current working directory	Explicit CWD tag

Key Semantic Distinctions

"" vs ".": These are NOT the same
- "" = smart default (git root with fallback to config dir)
- "." = explicit config directory (where atmos.yaml lives)
"./foo" vs "foo": These are NOT the same
- "./foo" = config-dir/foo (explicit config-file-relative)
- "foo" = git-root/foo with fallback (search path)
"..": Always relative to atmos.yaml location
- Used for navigating from config location to elsewhere in repo
- Common pattern: config in subdirectory, base_path: "../.." to reach repo root

Config File Search Order

Atmos searches for atmos.yaml in the following order:

Priority	Source	Description
1	CLI flags	`--config`, `--config-path`
2	Environment variable	`ATMOS_CLI_CONFIG_PATH`
3	Profiles	`--profile` or `ATMOS_PROFILE` for named config overrides
4	Current directory	`./atmos.yaml` (CWD only, no parent search)
5	Git repository root	`repo-root/atmos.yaml`
6	Parent directory search	Walks up from CWD looking for `atmos.yaml`
7	Home directory	`~/.atmos/atmos.yaml`
8	System directory	`/usr/local/etc/atmos/atmos.yaml`

references

Closes #1858
See docs/prd/base-path-resolution-semantics.md for complete PRD
See docs/fixes/path-resolution-regression.md for detailed analysis and manual testing instructions

Summary by CodeRabbit

Bug Fixes
- Restored and clarified base_path resolution and git-root discovery; reduced noisy config-path debug logs.
New Features
- Added !cwd YAML function to reference the current working directory.
- Introduced an explicit CLI config-path environment override and refined config discovery precedence.
Documentation
- Added PRD and user docs for base-path semantics and !cwd; updated docs and examples.
Chores
- Bumped many dependencies, updated license references, and advanced example Atmos Docker version.
Tests
- Added extensive path-resolution, YAML-tag, fixture, and cross-platform tests; improved test isolation.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Dec 13 '25 01:12 aknysh

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

go.mod

Dec 13 '25 01:12 github-actions[bot]

[!IMPORTANT]

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

Dec 13 '25 01:12 mergify[bot]

📝 Walkthrough

Walkthrough

Reworked config discovery and base_path resolution: added staged readers and ATMOS_CLI_CONFIG_PATH env constant, enhanced resolveAbsolutePath with git-root/config-dir/CWD helpers and explicit-relative rules, introduced !cwd YAML tag and ProcessTagCwd, plus extensive tests, fixtures, docs, snapshots, and dependency/license updates.

Changes

Cohort / File(s)	Summary
Core config & path-resolution `pkg/config/config.go`, `pkg/config/load.go`, `pkg/config/git_root.go`	Add staged, priority-based config readers; introduce `AtmosCliConfigPathEnvVar` (`ATMOS_CLI_CONFIG_PATH`); refine discovery order, Viper merge semantics, and git-root apply/skip logic; implement resolveAbsolutePath helpers (git-root/config-dir/CWD resolution).
YAML tag support & utilities `pkg/config/process_yaml.go`, `pkg/utils/git.go`, `pkg/utils/yaml_utils.go`	Add `!cwd` YAML function, implement ProcessTagCwd and process/handle helpers, and register `!cwd` in the tag registry.
Path-resolution tests & fixtures `pkg/config/config_test.go`, `tests/fixtures/scenarios/cli-config-path/...`, `tests/fixtures/scenarios/nested-config-empty-base-path/...`	New unit tests and scenario fixtures validating base_path semantics (empty, `.`, `..`, git-root resolution) and minimal Terraform test modules.
YAML & git tests `pkg/config/process_yaml_test.go`, `pkg/utils/git_test.go`, `pkg/utils/yaml_utils_test.go`	Add tests for `!cwd`, tag processing, ProcessTagCwd, and related git-root cases.
Config-loading & test isolation updates `internal/exec/*_test.go`, `internal/exec/component_path_resolution_test.go`, `internal/exec/stack_manifest_name_test.go`, `internal/exec/validate_component_test.go`, `internal/exec/yaml_func_template_test.go`	Many tests set `ATMOS_CLI_CONFIG_PATH="."` (t.Setenv) to scope config loading to CWD and disable parent-dir/git-root discovery; minor comment/formatting tweaks.
Platform guards & cross-platform fixes `internal/exec/shell_utils_test.go`, `pkg/utils/_test.go`, `cmd/auth_workflows_test.go`, `errors/error_funcs_test.go`, `pkg/utils/shell_utils_test.go`, `tests/test-cases/`	Add Windows guards/skips and OS-specific command selection to improve cross-platform test stability.
I/O robustness in tests `internal/exec/terraform_test.go`	Add concurrent pipe readers to avoid deadlocks when capturing external command output.
Docs & website `docs/fixes/path-resolution-regression.md`, `docs/prd/base-path-resolution-semantics.md`, `website/docs/cli/configuration/configuration.mdx`, `website/docs/functions/yaml/cwd.mdx`, `website/docs/functions/yaml/index.mdx`	Add PRD and regression docs, update configuration docs with new resolution semantics, and document the `!cwd` YAML function and examples.
Snapshots & logging `tests/snapshots/*`	Update golden snapshots: adjust logging verbosity and locations (demote some logs to TRACE, remove repeated ATMOS_CLI_CONFIG_PATH debug lines, add/adjust traces).
Devcontainer & examples `pkg/devcontainer/lifecycle_rebuild_test.go`, `examples/quick-start-advanced/Dockerfile`, `examples/demo-helmfile/atmos.yaml`	Bump referenced ATMOS_VERSION to 1.202.0 in tests/examples and explicitly unset `kubeconfig_path` in example.
Fixtures Terraform modules `tests/fixtures/.../components/terraform/test-component/main.tf`	Add minimal Terraform module variables/outputs used by fixtures.
Dependency & license metadata `go.mod`, `NOTICE`, `LICENSES`, ...	Bump multiple Go module versions and update license URLs/NOTICE entries (metadata-only).
Misc tests & parsing `pkg/config/load_test.go`, `pkg/config/process_yaml_test.go`, various internal tests	Add profile-parsing tests, more tag/sequence processing tests, and other test-suite expansions.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant User as CLI (atmos)
    participant Env as Environment
    participant Loader as Config Loader
    participant Git as Git discovery
    participant YAML as YAML processor

    User->>Env: read ATMOS_CLI_CONFIG_PATH / ATMOS_GIT_ROOT_BASEPATH
    User->>Loader: InitCliConfig (load request)
    Loader->>Loader: staged reads: system → home → parent-dir (unless env set)
    alt git-root allowed
        Loader->>Git: readGitRootConfig (discover repo root)
        Git-->>Loader: repo root path or skip
    end
    Loader->>Loader: readWorkDirConfigOnly → readEnvConfig → readCliArgConfig
    Loader->>Loader: merge Viper sources (later overrides earlier)
    User->>Loader: resolveAbsolutePath(base_path)
    alt explicit-relative (., ..)
        Loader->>Loader: resolve against config file dir (if cliConfigPath)
    else empty/simple-relative
        Loader->>Git: tryResolveWithGitRoot
        Git-->>Loader: resolved path or none
        Loader->>Loader: fallback → config dir → CWD
    end
    Loader->>YAML: processScalarNodeValue (tags)
    YAML->>YAML: ProcessTagCwd returns CWD-based path for `!cwd`
    Loader-->>User: return merged config with absolute paths

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Focus areas:
- pkg/config/load.go & pkg/config/config.go — staged discovery, merge semantics, and resolveAbsolutePath helpers.
- pkg/config/git_root.go — git-root discovery, skip/apply edge cases and env interactions.
- YAML tag plumbing: pkg/config/process_yaml.go, pkg/utils/git.go, pkg/utils/yaml_utils.go — !cwd handling and tag registration.
- Tests & fixtures: cross-platform determinism, git-context-dependent tests and fixture correctness.
- Snapshots/logging: verify intended log-level changes and removed messages.

Possibly related PRs

cloudposse/atmos#1774 — overlaps on path/base-resolution logic and tests touching pkg/config and resolveAbsolutePath.
cloudposse/atmos#1072 — related handling and propagation of ATMOS_CLI_CONFIG_PATH across config loading/runtime.
cloudposse/atmos#1489 — prior changes to config-loading/discovery order and import/merge handling in pkg/config/load.go.

Suggested reviewers

osterman

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 56.25% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: Fix base path resolution and fallback order' clearly and directly describes the main change: correcting base path resolution logic and its fallback order, which aligns with the PR's core objective of fixing a v1.201.0 regression.
Linked Issues check	✅ Passed	The PR fully addresses issue #1858 requirements: restores path-resolution for nested config directories [#1858], implements deterministic base_path semantics including git-root fallback [#1858], preserves config-file-relative behavior for . and .. [#1858], adds comprehensive tests and documentation [#1858], and introduces !cwd for CWD-relative paths [PR description].
Out of Scope Changes check	✅ Passed	All changes align with the stated objectives: path resolution refactoring, test coverage, documentation, and necessary platform-specific test guards. The dependency updates in go.mod and NOTICE align with supporting the path resolution improvements.

✨ Finishing touches

[ ] 📝 Generate docstrings

🧪 Generate unit tests (beta)

[ ] Create PR with unit tests
[ ] Post copyable unit tests in a comment
[ ] Commit unit tests in branch aknysh/fix-path-based-component-resolution

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 1e35cddf7d63366d6e8829fdaba291d7944744ef and ab5e84b984e21c05523f5eafd8589f1db7f13886.

📒 Files selected for processing (1)

pkg/config/config_test.go (1 hunks)

🧰 Additional context used

📓 Path-based instructions (2)

**/*.go

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

**/*.go: Use Viper for managing configuration, environment variables, and flags in CLI commands Use interfaces for external dependencies to facilitate mocking and consider using testify/mock for creating mock implementations All code must pass golangci-lint checks Follow Go's error handling idioms: use meaningful error messages, wrap errors with context using fmt.Errorf("context: %w", err), and consider using custom error types for domain-specific errors Follow standard Go coding style: use gofmt and goimports to format code, prefer short descriptive variable names, use kebab-case for command-line flags, and snake_case for environment variables Document all exported functions, types, and methods following Go's documentation conventions Document complex logic with inline comments in Go code Support configuration via files, environment variables, and flags following the precedence order: flags > environment variables > config file > defaults Provide clear error messages to users, include troubleshooting hints when appropriate, and log detailed errors for debugging

**/*.go: NEVER use fmt.Fprintf(os.Stdout/Stderr) or fmt.Println(); use data.* or ui.* functions instead All comments must end with periods (enforced by godot linter) Organize imports in three groups separated by blank lines, sorted alphabetically: 1) Go stdlib, 2) 3rd-party (NOT cloudposse/atmos), 3) Atmos packages; maintain aliases: cfg, log, u, errUtils Add defer perf.Track(atmosConfig, "pkg.FuncName")() + blank line to all public functions for performance tracking; use nil if no atmosConfig param All errors MUST be wrapped using static errors defined in errors/errors.go; use errors.Join for combining multiple errors; use fmt.Errorf with %w for adding string context; use error builder for complex errors; use errors.Is() for error checking; NEVER use dynamic errors directly Use go.uber.org/mock/mockgen with //go:generate directives for mock generation; never create manual mocks Keep files small...

Files:

pkg/config/config_test.go

**/*_test.go

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

**/*_test.go: Every new feature must include comprehensive unit tests targeting >80% code coverage for all packages Use table-driven tests for testing multiple scenarios in Go Include integration tests for command flows and test CLI end-to-end when possible with test fixtures

**/*_test.go: Prefer unit tests with mocks over integration tests; use interfaces + dependency injection for testability; generate mocks with go.uber.org/mock/mockgen; use table-driven tests; target >80% coverage Test behavior, not implementation; never test stub functions; avoid tautological tests; make code testable via DI; no coverage theater; remove always-skipped tests; use errors.Is() for error checking

Files:

pkg/config/config_test.go

🧠 Learnings (19)

📓 Common learnings

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1686
File: docs/prd/tool-dependencies-integration.md:58-64
Timestamp: 2025-12-13T06:07:37.766Z
Learning: cloudposse/atmos: For PRD docs (docs/prd/*.md), markdownlint issues like MD040/MD010/MD034 can be handled in a separate documentation cleanup commit and should not block the current PR.

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Learnt from: osterman
Repo: cloudposse/atmos PR: 887
File: internal/exec/workflow_utils.go:167-169
Timestamp: 2024-12-25T20:28:19.618Z
Learning: The user plans to revert the change from `path.Join` to `filepath.Join` in this PR due to testing gaps and will open a new PR to safely handle the migration without breaking `main`.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: Final XDG Base Directory Specification implementation for atmos toolchain is complete and verified: toolchain/xdg_cache.go provides GetXDGCacheDir() and GetXDGTempCacheDir() functions, all hardcoded ~/.cache/tools-cache paths have been replaced with XDG-compliant paths using ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback), and tests have been updated to expect the new path structure.

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: The atmos toolchain has been updated to follow XDG Base Directory Specification with helper functions GetXDGCacheDir() and GetXDGTempCacheDir() in toolchain/xdg_cache.go, using XDG_CACHE_HOME when set and falling back to ~/.cache/atmos-toolchain, making it consistent with atmos core's XDG compliance.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: XDG Base Directory Specification compliance implementation for atmos toolchain is complete: created toolchain/xdg_cache.go with GetXDGCacheDir() and GetXDGTempCacheDir() functions, updated toolchain/installer.go and cmd/toolchain_clean.go to use these XDG helpers, and changed all cache paths from hardcoded ~/.cache/tools-cache to XDG-compliant ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback).

Learnt from: haitham911
Repo: cloudposse/atmos PR: 727
File: internal/exec/path_utils.go:145-146
Timestamp: 2024-10-23T22:11:41.077Z
Learning: In the `atmos` project, the preference is to print relative paths in log messages instead of full paths.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: The atmos toolchain XDG compliance implementation is complete with GetXDGCacheDir() and GetXDGTempCacheDir() functions in toolchain/xdg_cache.go, updated installer.go and toolchain_clean.go to use these helpers, and changed cache paths from ~/.cache/tools-cache to ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain when XDG_CACHE_HOME is not set).

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*_test.go : Include integration tests for command flows and test CLI end-to-end when possible with test fixtures

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*_test.go : Every new feature must include comprehensive unit tests targeting >80% code coverage for all packages

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: The atmos codebase has a custom extension to *testing.T that provides a Chdir method, allowing test functions to call t.Chdir() to change working directories during tests. This is used consistently across test files in the codebase.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-12-16T18:20:55.630Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-16T18:20:55.630Z
Learning: Applies to **/*_test.go : Test behavior, not implementation; never test stub functions; avoid tautological tests; make code testable via DI; no coverage theater; remove always-skipped tests; use errors.Is() for error checking

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-12-02T21:26:32.337Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-10-28T01:51:30.811Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 727
File: internal/exec/terraform_clean.go:329-332
Timestamp: 2024-10-28T01:51:30.811Z
Learning: In the Atmos Go code, when deleting directories or handling file paths (e.g., in `terraform_clean.go`), always resolve the absolute path using `filepath.Abs` and use the logger `u.LogWarning` for logging messages instead of using `fmt.Printf`.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-12-16T18:20:55.630Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-16T18:20:55.630Z
Learning: Applies to **/*.go : Add `defer perf.Track(atmosConfig, "pkg.FuncName")()` + blank line to all public functions for performance tracking; use nil if no atmosConfig param

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-09-08T01:25:44.958Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: Final XDG Base Directory Specification implementation for atmos toolchain is complete and verified: toolchain/xdg_cache.go provides GetXDGCacheDir() and GetXDGTempCacheDir() functions, all hardcoded ~/.cache/tools-cache paths have been replaced with XDG-compliant paths using ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback), and tests have been updated to expect the new path structure.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*_test.go : Use table-driven tests for testing multiple scenarios in Go

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-12-25T20:28:47.526Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 887
File: internal/exec/stack_processor_utils.go:380-380
Timestamp: 2024-12-25T20:28:47.526Z
Learning: Windows path handling often requires `filepath.Join` to ensure correct separators and comparisons. Insufficient tests can break cross-platform compatibility, so migrating from `path.Join` to `filepath.Join` needs thorough testing on Windows before merging.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-11-22T12:38:33.132Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-02-05T11:10:51.031Z

Learnt from: mss
Repo: cloudposse/atmos PR: 1024
File: internal/exec/go_getter_utils.go:31-33
Timestamp: 2025-02-05T11:10:51.031Z
Learning: The path traversal check in `ValidateURI` function in `internal/exec/go_getter_utils.go` is intentionally kept despite potentially blocking valid Git URLs, as this validation is planned to be addressed in a separate ticket.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-11-19T23:00:45.899Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 795
File: internal/exec/stack_processor_utils.go:378-386
Timestamp: 2024-11-19T23:00:45.899Z
Learning: In the `ProcessYAMLConfigFile` function within `internal/exec/stack_processor_utils.go`, directory traversal in stack imports is acceptable and should not be restricted.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-12-16T18:20:55.630Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-16T18:20:55.630Z
Learning: Applies to **/*.go : Code must be Linux/macOS/Windows compatible; use SDKs over binaries; use filepath.Join() instead of hardcoded path separators

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests. This is implemented through custom testing framework extensions and is used consistently throughout the test suite.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method that can be called on *testing.T objects. This functionality is implemented through custom testing framework extensions and is used consistently throughout the test suite for changing working directories during tests.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-11-10T23:23:39.771Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1686
File: toolchain/registry/aqua/aqua_test.go:417-442
Timestamp: 2025-11-10T23:23:39.771Z
Learning: In Atmos toolchain AquaRegistry, tests should not hit real GitHub. Use the options pattern via WithGitHubBaseURL to inject an httptest server URL and make GetLatestVersion/GetAvailableVersions deterministic.

Applied to files:

pkg/config/config_test.go

⏰ Context from checks skipped due to timeout of 900000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

GitHub Check: Acceptance Tests (windows)
GitHub Check: Acceptance Tests (macos)
GitHub Check: Summary

🔇 Additional comments (6)

pkg/config/config_test.go (6)

1036-1108: Well-structured cross-platform path handling.

The platform-specific test cases correctly differentiate between Windows (where backslash is a path separator) and Unix (where backslash is a literal character). This ensures consistent behavior across platforms.

1143-1197: Solid integration test for the regression fix.

This test effectively validates the core fix for issue #1858 - ensuring that ".." base_path resolves relative to the atmos.yaml location (config directory), allowing configs in subdirectories to reference parent-level directories.

1199-1255: Comprehensive test for nested config with empty base_path.

This test validates a critical regression scenario where empty base_path should trigger git root discovery even with deeply nested config directories. The use of TEST_GIT_ROOT for isolation is good practice.

1257-1315: Clear test for "." path resolution semantics.

These tests effectively demonstrate that "." resolves relative to the config directory (config-file-relative), following the convention of other config files like tsconfig.json. The separation of CWD != config dir vs CWD == config dir cases provides good coverage.

1317-1373: Well-focused unit tests for helper functions.

These tests provide clean coverage of the git root discovery helpers with appropriate isolation using environment variables. The test cases cover the key scenarios without over-complicating.

1375-1409: Complete unit test coverage for config path resolution.

This test cleanly covers all branches of the tryResolveWithConfigPath helper, including the fallback-to-CWD cases. The use of t.TempDir() ensures cross-platform compatibility.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Dec 13 '25 02:12 coderabbitai[bot]

📝 Walkthrough

Walkthrough

This PR fixes a path resolution regression in v1.201.0 by modifying resolveAbsolutePath to only resolve relative paths relative to cliConfigPath when paths explicitly reference relative directories (starting with ".." or "./"). Simple relative paths resolve against the current working directory. The PR includes dependency version updates, test fixtures, and documentation.

Changes

Cohort / File(s)	Summary
Path resolution regression fix `pkg/config/config.go`, `pkg/config/config_test.go`	Modified `resolveAbsolutePath` to handle explicit relative paths ("../", "./") distinctly from simple relative paths for backward compatibility. Added `TestResolveAbsolutePath` and `TestCliConfigPathRegression` unit tests to verify the corrected resolution logic.
Test fixtures for path resolution scenarios `tests/fixtures/scenarios/cli-config-path/config/atmos.yaml`, `tests/fixtures/scenarios/cli-config-path/stacks/dev.yaml`, `tests/fixtures/scenarios/cli-config-path/components/terraform/test-component/main.tf`	New fixture files demonstrating CLI config path behavior with relative path resolution, including Terraform component configuration and stack definitions.
Version updates `examples/quick-start-advanced/Dockerfile`, `pkg/devcontainer/lifecycle_rebuild_test.go`	Updated Atmos version argument from 1.201.0 to 1.202.0.
Go module dependencies `go.mod`	Updated multiple AWS SDK components (config, credentials, feature/s3/manager, service/s3, service/ssm, service/sts), stdlib packages (crypto, exp, mod, net, tools), and utility libraries (charmbracelet/\*, kubescape/go-git-url, terraform-docs, protobuf-go, mvdan/xurls) to newer patch/minor versions.
License notices `NOTICE.md`	Updated license URLs for AWS SDK components and Go libraries to reflect newer dependency versions; removed obsolete/duplicate entries.
Documentation `docs/fixes/path-resolution-regression.md`	Added comprehensive documentation for Issue `#1858` describing the path resolution regression, root cause analysis, fix rationale, test coverage, and manual reproduction steps.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20–25 minutes

Path resolution logic (pkg/config/config.go): The core fix introduces isExplicitRelativePath guard logic; requires careful verification that the condition correctly distinguishes explicit relative paths ("../", "./") from simple relative paths and that backward compatibility is preserved.
Test coverage (pkg/config/config_test.go): New regression tests exercise multiple scenarios; verify edge cases and environment setup handling are complete.
Dependency updates (go.mod, NOTICE.md): Numerous routine version bumps across AWS SDK and stdlib; scan for any breaking changes or compatibility issues.
Fixture consistency: Ensure new test fixtures (cli-config-path/\\*) align with the documented resolution behavior and test assumptions.

Possibly related PRs

PR #1774: Implements path-based component resolution work that directly overlaps with this PR's path resolution logic changes and fixture approach.
PR #1096: Addresses CLI config path and base path resolution handling, closely related to the regression fix scope.
PR #1072: Adds CLI config path normalization and environment variable export (ATMOS_CLI_CONFIG_PATH, ATMOS_BASE_PATH), complementary to this path resolution work.

Suggested reviewers

osterman
milldr

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the primary fix—addressing a path resolution regression introduced in v1.201.0.
Linked Issues check	✅ Passed	The PR fixes all objectives from issue #1858: restores path resolution to v1.200.0 behavior for simple relative paths, maintains explicit relative path handling from PR #1774, adds comprehensive tests, and provides documentation.
Out of Scope Changes check	✅ Passed	All changes directly support the regression fix: logic updates in config.go, new tests, fixture files for testing, documentation, and version bump in Dockerfile.

✨ Finishing touches

[ ] 📝 Generate docstrings

🧪 Generate unit tests (beta)

[ ] Create PR with unit tests
[ ] Post copyable unit tests in a comment
[ ] Commit unit tests in branch aknysh/fix-path-based-component-resolution

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 93d2e6bac5e659f0a72d24b1dbc0eaaa29c665e4 and a33e3f456fa82e8020ce16fbfcc6a73303c33110.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (10)

NOTICE (16 hunks)
docs/fixes/path-resolution-regression.md (1 hunks)
examples/quick-start-advanced/Dockerfile (1 hunks)
go.mod (7 hunks)
pkg/config/config.go (2 hunks)
pkg/config/config_test.go (1 hunks)
pkg/devcontainer/lifecycle_rebuild_test.go (1 hunks)
tests/fixtures/scenarios/cli-config-path/components/terraform/test-component/main.tf (1 hunks)
tests/fixtures/scenarios/cli-config-path/config/atmos.yaml (1 hunks)
tests/fixtures/scenarios/cli-config-path/stacks/dev.yaml (1 hunks)

🧰 Additional context used

📓 Path-based instructions (3)

**/*.go

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

**/*.go: Use Viper for managing configuration, environment variables, and flags in CLI commands Use interfaces for external dependencies to facilitate mocking and consider using testify/mock for creating mock implementations All code must pass golangci-lint checks Follow Go's error handling idioms: use meaningful error messages, wrap errors with context using fmt.Errorf("context: %w", err), and consider using custom error types for domain-specific errors Follow standard Go coding style: use gofmt and goimports to format code, prefer short descriptive variable names, use kebab-case for command-line flags, and snake_case for environment variables Document all exported functions, types, and methods following Go's documentation conventions Document complex logic with inline comments in Go code Support configuration via files, environment variables, and flags following the precedence order: flags > environment variables > config file > defaults Provide clear error messages to users, include troubleshooting hints when appropriate, and log detailed errors for debugging

**/*.go: Comment style: All comments must end with periods (enforced by godot linter) Import organization: Three groups separated by blank lines (stdlib, 3rd-party, Atmos packages), sorted alphabetically within groups, maintain aliases: cfg, log, u, errUtils Performance tracking: Add defer perf.Track(atmosConfig, "pkg.FuncName")() + blank line to all public functions. Use nil if no atmosConfig param Error handling: ALL user-facing errors MUST use ErrorBuilder with sentinel errors from errors/errors.go. ALWAYS use errors.Is() for checking, NEVER string comparison. ALWAYS use assert.ErrorIs() in tests, NEVER assert.Contains(err.Error(), ...) Mock generation: Use go.uber.org/mock/mockgen with //go:generate directives. Never manual mocks File organization: Keep files small and focused (<600 lines). One cmd/impl per file. Co-locate tests. Never use `//revive:disable:file-lengt...

Files:

pkg/config/config_test.go
pkg/devcontainer/lifecycle_rebuild_test.go
pkg/config/config.go

**/*_test.go

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

**/*_test.go: Every new feature must include comprehensive unit tests targeting >80% code coverage for all packages Use table-driven tests for testing multiple scenarios in Go Include integration tests for command flows and test CLI end-to-end when possible with test fixtures

**/*_test.go: Test skipping conventions: Use t.Skipf("reason") with clear context. CLI tests auto-build temp binaries Golden snapshots: NEVER manually edit golden snapshot files - Always use -regenerate-snapshots flag. Snapshots capture exact output including invisible formatting (lipgloss padding, ANSI codes, trailing whitespace). Different environments produce different output. Never use pipe redirection (2>&1, | head, | tail) when running tests as piping breaks TTY detection

Files:

pkg/config/config_test.go
pkg/devcontainer/lifecycle_rebuild_test.go

{go.mod,go.sum}

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

Manage dependencies with Go modules and keep dependencies up to date while minimizing external dependencies

Files:

go.mod

🧠 Learnings (52)

📓 Common learnings

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Learnt from: haitham911
Repo: cloudposse/atmos PR: 727
File: internal/exec/path_utils.go:145-146
Timestamp: 2024-10-23T22:11:41.077Z
Learning: In the `atmos` project, the preference is to print relative paths in log messages instead of full paths.

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-19T14:50:16.194Z
Learning: In the Atmos project, path traversal is acceptable due to its role in automation. Do not flag path traversal as an issue in code reviews.

Learnt from: osterman
Repo: cloudposse/atmos PR: 887
File: internal/exec/workflow_utils.go:167-169
Timestamp: 2024-12-25T20:28:19.618Z
Learning: The user plans to revert the change from `path.Join` to `filepath.Join` in this PR due to testing gaps and will open a new PR to safely handle the migration without breaking `main`.

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*_test.go : Include integration tests for command flows and test CLI end-to-end when possible with test fixtures

Applied to files:

pkg/config/config_test.go

📚 Learning: 2024-10-28T01:51:30.811Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 727
File: internal/exec/terraform_clean.go:329-332
Timestamp: 2024-10-28T01:51:30.811Z
Learning: In the Atmos Go code, when deleting directories or handling file paths (e.g., in `terraform_clean.go`), always resolve the absolute path using `filepath.Abs` and use the logger `u.LogWarning` for logging messages instead of using `fmt.Printf`.

Applied to files:

pkg/config/config_test.go
docs/fixes/path-resolution-regression.md
pkg/config/config.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: The atmos codebase has a custom extension to *testing.T that provides a Chdir method, allowing test functions to call t.Chdir() to change working directories during tests. This is used consistently across test files in the codebase.

Applied to files:

pkg/config/config_test.go
tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2024-12-25T20:28:47.526Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 887
File: internal/exec/stack_processor_utils.go:380-380
Timestamp: 2024-12-25T20:28:47.526Z
Learning: Windows path handling often requires `filepath.Join` to ensure correct separators and comparisons. Insufficient tests can break cross-platform compatibility, so migrating from `path.Join` to `filepath.Join` needs thorough testing on Windows before merging.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests. This is implemented through custom testing framework extensions and is used consistently throughout the test suite.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*_test.go : Every new feature must include comprehensive unit tests targeting >80% code coverage for all packages

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method that can be called on *testing.T objects. This functionality is implemented through custom testing framework extensions and is used consistently throughout the test suite for changing working directories during tests.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-12-10T18:32:51.237Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1808
File: cmd/terraform/backend/backend_delete_test.go:9-23
Timestamp: 2025-12-10T18:32:51.237Z
Learning: In cmd subpackages (e.g., cmd/terraform/backend/), tests cannot use cmd.NewTestKit(t) due to Go's test visibility rules (NewTestKit is in a parent package test file). These tests only need TestKit if they execute commands through RootCmd or modify RootCmd state. Structural tests that only verify command structure/flags without touching RootCmd don't require TestKit cleanup.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-05-23T19:51:47.091Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1255
File: cmd/describe_affected_test.go:15-15
Timestamp: 2025-05-23T19:51:47.091Z
Learning: In the atmos codebase, t.Chdir() is a valid method call on *testing.T objects and works correctly for changing directories in tests.

Applied to files:

pkg/config/config_test.go

📚 Learning: 2025-09-08T01:25:44.958Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: Final XDG Base Directory Specification implementation for atmos toolchain is complete and verified: toolchain/xdg_cache.go provides GetXDGCacheDir() and GetXDGTempCacheDir() functions, all hardcoded ~/.cache/tools-cache paths have been replaced with XDG-compliant paths using ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback), and tests have been updated to expect the new path structure.

Applied to files:

pkg/config/config_test.go
docs/fixes/path-resolution-regression.md
pkg/devcontainer/lifecycle_rebuild_test.go
tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2025-01-17T00:18:57.769Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Applied to files:

docs/fixes/path-resolution-regression.md
examples/quick-start-advanced/Dockerfile
NOTICE

📚 Learning: 2024-11-22T12:38:33.132Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Applied to files:

docs/fixes/path-resolution-regression.md

📚 Learning: 2025-09-08T01:25:44.958Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: The atmos toolchain has been updated to follow XDG Base Directory Specification with helper functions GetXDGCacheDir() and GetXDGTempCacheDir() in toolchain/xdg_cache.go, using XDG_CACHE_HOME when set and falling back to ~/.cache/atmos-toolchain, making it consistent with atmos core's XDG compliance.

Applied to files:

docs/fixes/path-resolution-regression.md
pkg/devcontainer/lifecycle_rebuild_test.go
tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-12-13T00:52:18.278Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-13T00:52:18.278Z
Learning: Test data: Use fixtures in `tests/test-cases/`: `atmos.yaml`, `stacks/`, `components/`. NEVER modify `tests/test-cases/` or `tests/testdata/` unless explicitly instructed. Golden snapshots are sensitive to minor changes

Applied to files:

tests/fixtures/scenarios/cli-config-path/stacks/dev.yaml
tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2025-11-10T23:23:39.771Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1686
File: toolchain/registry/aqua/aqua_test.go:417-442
Timestamp: 2025-11-10T23:23:39.771Z
Learning: In Atmos toolchain AquaRegistry, tests should not hit real GitHub. Use the options pattern via WithGitHubBaseURL to inject an httptest server URL and make GetLatestVersion/GetAvailableVersions deterministic.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go

📚 Learning: 2024-10-25T20:26:56.449Z

Learnt from: Cerebrovinny
Repo: cloudposse/atmos PR: 729
File: .goreleaser.yml:26-26
Timestamp: 2024-10-25T20:26:56.449Z
Learning: There is no inconsistency in the version path in `build.sh`; it already uses the correct path `github.com/cloudposse/atmos/pkg/version.Version`.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
examples/quick-start-advanced/Dockerfile

📚 Learning: 2024-12-02T21:26:32.337Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
pkg/config/config.go

📚 Learning: 2024-11-12T03:15:15.627Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 775
File: examples/quick-start-advanced/Dockerfile:9-9
Timestamp: 2024-11-12T03:15:15.627Z
Learning: It is acceptable to set `ARG ATMOS_VERSION` to a future version like `1.105.0` in `examples/quick-start-advanced/Dockerfile` if that will be the next release.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-09-08T01:25:44.958Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: The atmos toolchain XDG compliance implementation is complete with GetXDGCacheDir() and GetXDGTempCacheDir() functions in toolchain/xdg_cache.go, updated installer.go and toolchain_clean.go to use these helpers, and changed cache paths from ~/.cache/tools-cache to ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain when XDG_CACHE_HOME is not set).

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go

📚 Learning: 2025-11-11T03:47:59.576Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1686
File: toolchain/which_test.go:166-223
Timestamp: 2025-11-11T03:47:59.576Z
Learning: In the cloudposse/atmos repo, tests that manipulate environment variables should use testing.T.Setenv for automatic setup/teardown instead of os.Setenv/Unsetenv.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-09-08T01:25:44.958Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: XDG Base Directory Specification compliance implementation for atmos toolchain is complete: created toolchain/xdg_cache.go with GetXDGCacheDir() and GetXDGTempCacheDir() functions, updated toolchain/installer.go and cmd/toolchain_clean.go to use these XDG helpers, and changed all cache paths from hardcoded ~/.cache/tools-cache to XDG-compliant ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback).

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go

📚 Learning: 2025-07-05T20:59:02.914Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 1363
File: internal/exec/template_utils.go:18-18
Timestamp: 2025-07-05T20:59:02.914Z
Learning: In the Atmos project, gomplate v4 is imported with a blank import (`_ "github.com/hairyhenderson/gomplate/v4"`) alongside v3 imports to resolve AWS SDK version conflicts. V3 uses older AWS SDK versions that conflict with newer AWS modules used by Atmos. A full migration to v4 requires extensive refactoring due to API changes and should be handled in a separate PR.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
go.mod

📚 Learning: 2025-12-13T00:52:18.278Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-13T00:52:18.278Z
Learning: Applies to **/*.go : Environment variables: Use `viper.BindEnv("ATMOS_VAR", "ATMOS_VAR", "FALLBACK")` - ATMOS_ prefix required

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go

📚 Learning: 2024-11-23T00:13:22.004Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 801
File: examples/quick-start-advanced/Dockerfile:9-9
Timestamp: 2024-11-23T00:13:22.004Z
Learning: When updating the `ATMOS_VERSION` in Dockerfiles, the team prefers to pin to the next future version when the PR merges, even if the version is not yet released.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
examples/quick-start-advanced/Dockerfile

📚 Learning: 2024-12-11T18:40:12.808Z

Learnt from: Listener430
Repo: cloudposse/atmos PR: 844
File: cmd/helmfile.go:37-37
Timestamp: 2024-12-11T18:40:12.808Z
Learning: In the atmos project, `cliConfig` is initialized within the `cmd` package in `root.go` and can be used in other command files.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
pkg/config/config.go

📚 Learning: 2024-10-20T13:12:46.499Z

Learnt from: haitham911
Repo: cloudposse/atmos PR: 736
File: pkg/config/const.go:6-6
Timestamp: 2024-10-20T13:12:46.499Z
Learning: In `cmd/cmd_utils.go`, it's acceptable to have hardcoded references to `atmos.yaml` in logs, and it's not necessary to update them to use the `CliConfigFileName` constant.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
pkg/config/config.go

📚 Learning: 2024-10-23T21:36:40.262Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 740
File: cmd/cmd_utils.go:340-359
Timestamp: 2024-10-23T21:36:40.262Z
Learning: In the Go codebase for Atmos, when reviewing functions like `checkAtmosConfig` in `cmd/cmd_utils.go`, avoid suggesting refactoring to return errors instead of calling `os.Exit` if such changes would significantly increase the scope due to the need to update multiple call sites.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go
pkg/config/config.go

📚 Learning: 2025-08-16T23:32:40.412Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 1405
File: internal/exec/describe_dependents_test.go:455-456
Timestamp: 2025-08-16T23:32:40.412Z
Learning: In the cloudposse/atmos Go codebase, `InitCliConfig` returns a `schema.AtmosConfiguration` value (not a pointer), while `ExecuteDescribeDependents` expects a `*schema.AtmosConfiguration` pointer parameter. Therefore, when passing the result of `InitCliConfig` to `ExecuteDescribeDependents`, use `&atmosConfig` to pass the address of the value.

Applied to files:

pkg/devcontainer/lifecycle_rebuild_test.go

📚 Learning: 2024-11-25T17:17:15.703Z

Learnt from: RoseSecurity
Repo: cloudposse/atmos PR: 797
File: pkg/list/atmos.yaml:213-214
Timestamp: 2024-11-25T17:17:15.703Z
Learning: The file `pkg/list/atmos.yaml` is primarily intended for testing purposes.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-09-10T21:17:55.273Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1466
File: toolchain/http_client_test.go:3-10
Timestamp: 2025-09-10T21:17:55.273Z
Learning: In the cloudposse/atmos repository, imports should never be changed as per samtholiya's coding guidelines.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-01-25T15:21:40.413Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: examples/demo-atmos-cli-imports/atmos.yaml:8-8
Timestamp: 2025-01-25T15:21:40.413Z
Learning: In Atmos, when a directory is specified for configuration loading (e.g., in the `import` section of atmos.yaml), all files within that directory should be treated as Atmos configurations. Do not suggest restricting file extensions in directory-based glob patterns.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2025-03-18T12:26:25.329Z

Learnt from: Listener430
Repo: cloudposse/atmos PR: 1149
File: tests/snapshots/TestCLICommands_atmos_vendor_pull_ssh.stderr.golden:7-7
Timestamp: 2025-03-18T12:26:25.329Z
Learning: In the Atmos project, typos or inconsistencies in test snapshot files (such as "terrafrom" instead of "terraform") may be intentional as they capture the exact output of commands and should not be flagged as issues requiring correction.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-09-24T20:45:40.401Z

Learnt from: Benbentwo
Repo: cloudposse/atmos PR: 1475
File: tests/fixtures/scenarios/atmos-auth/stacks/deploy/nonprod.yaml:3-4
Timestamp: 2025-09-24T20:45:40.401Z
Learning: In Atmos stack files, the correct syntax for importing other stack files is `import:` (singular), not `imports:` (plural). All stack files in the Atmos codebase consistently use `import:` followed by a list of paths to import.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2024-12-12T15:17:45.245Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: examples/demo-atmos.d/atmos.d/tools/helmfile.yml:10-10
Timestamp: 2024-12-12T15:17:45.245Z
Learning: In `examples/demo-atmos.d/atmos.d/tools/helmfile.yml`, when suggesting changes to `kubeconfig_path`, ensure that the values use valid Go template syntax.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
pkg/config/config.go

📚 Learning: 2025-01-25T03:51:57.689Z

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-09-13T16:39:20.007Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1466
File: cmd/markdown/atmos_toolchain_aliases.md:2-4
Timestamp: 2025-09-13T16:39:20.007Z
Learning: In the cloudposse/atmos repository, CLI documentation files in cmd/markdown/ follow a specific format that uses " $ atmos command" (with leading space and dollar sign prompt) in code blocks. This is the established project convention and should not be changed to comply with standard markdownlint rules MD040 and MD014.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2024-10-23T22:11:41.077Z

Learnt from: haitham911
Repo: cloudposse/atmos PR: 727
File: internal/exec/path_utils.go:145-146
Timestamp: 2024-10-23T22:11:41.077Z
Learning: In the `atmos` project, the preference is to print relative paths in log messages instead of full paths.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2025-01-08T19:01:32.938Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 899
File: examples/tests/test-vendor/test-components/main.tf:1-7
Timestamp: 2025-01-08T19:01:32.938Z
Learning: In the examples/tests directory of the atmos project, code examples are intentionally kept minimal and simple to facilitate understanding. Avoid suggesting additional complexity or validations that might make the examples harder to follow.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml
examples/quick-start-advanced/Dockerfile

📚 Learning: 2024-12-12T15:15:46.457Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: examples/demo-atmos-cli-imports/atmos.yaml:7-7
Timestamp: 2024-12-12T15:15:46.457Z
Learning: In example configuration files, such as `examples/demo-atmos-cli-imports/atmos.yaml`, it's acceptable to use `refs/heads/main` in remote URLs.

Applied to files:

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml

📚 Learning: 2025-11-01T20:24:29.557Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1714
File: NOTICE:0-0
Timestamp: 2025-11-01T20:24:29.557Z
Learning: In the cloudposse/atmos repository, the NOTICE file is programmatically generated and should not be manually edited. Issues with dependency license URLs in NOTICE will be resolved when upstream package metadata is corrected.

Applied to files:

examples/quick-start-advanced/Dockerfile
NOTICE

📚 Learning: 2025-09-10T17:34:52.568Z

Learnt from: Benbentwo
Repo: cloudposse/atmos PR: 1475
File: pkg/auth/providers/github/oidc.go:96-100
Timestamp: 2025-09-10T17:34:52.568Z
Learning: The ATMOS_ environment variable binding guideline applies to Atmos configuration variables, not external service-required environment variables like GitHub Actions OIDC variables (GITHUB_ACTIONS, ACTIONS_ID_TOKEN_*) which must use their standard names.

Applied to files:

examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-12-12T18:52:54.205Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1857
File: Dockerfile:29-29
Timestamp: 2025-12-12T18:52:54.205Z
Learning: In Dockerfiles that install Helm plugins, omit --verify=false for helm plugin install when using Helm 3.x; this flag is only supported in Helm 4.x. Ensure your Helm version and command usage align to avoid errors.

Applied to files:

examples/quick-start-advanced/Dockerfile

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to {go.mod,go.sum} : Manage dependencies with Go modules and keep dependencies up to date while minimizing external dependencies

Applied to files:

go.mod
pkg/config/config.go
NOTICE

📚 Learning: 2025-01-17T00:21:32.987Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:3-3
Timestamp: 2025-01-17T00:21:32.987Z
Learning: Go version 1.23.0 was deliberately introduced by the maintainer (aknysh) in January 2025. While this might be a pre-release or development version of Go, it has been approved for use in this project.

Applied to files:

go.mod
NOTICE

📚 Learning: 2025-01-17T00:21:32.987Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:3-3
Timestamp: 2025-01-17T00:21:32.987Z
Learning: The project uses Go version 1.23.0 which has been confirmed by the maintainer to be working in production for months. Do not flag this as an invalid Go version.

Applied to files:

go.mod

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*.go : Use Viper for managing configuration, environment variables, and flags in CLI commands

Applied to files:

go.mod

📚 Learning: 2025-12-13T00:52:18.278Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-13T00:52:18.278Z
Learning: Applies to **/*.go : Import organization: Three groups separated by blank lines (stdlib, 3rd-party, Atmos packages), sorted alphabetically within groups, maintain aliases: `cfg`, `log`, `u`, `errUtils`

Applied to files:

go.mod
NOTICE

📚 Learning: 2025-11-08T19:56:18.660Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 1697
File: internal/exec/oci_utils.go:0-0
Timestamp: 2025-11-08T19:56:18.660Z
Learning: In the Atmos codebase, when a function receives an `*schema.AtmosConfiguration` parameter, it should read configuration values from `atmosConfig.Settings` fields rather than using direct `os.Getenv()` or `viper.GetString()` calls. The Atmos pattern is: viper.BindEnv in cmd/root.go binds environment variables → Viper unmarshals into atmosConfig.Settings via mapstructure → business logic reads from the Settings struct. This provides centralized config management, respects precedence, and enables testability. Example: `atmosConfig.Settings.AtmosGithubToken` instead of `os.Getenv("ATMOS_GITHUB_TOKEN")` in functions like `getGHCRAuth` in internal/exec/oci_utils.go.

Applied to files:

pkg/config/config.go

📚 Learning: 2025-02-13T07:30:28.946Z

Learnt from: Listener430
Repo: cloudposse/atmos PR: 1061
File: internal/exec/go_getter_utils.go:74-75
Timestamp: 2025-02-13T07:30:28.946Z
Learning: In the `CustomGitDetector.Detect` method of `internal/exec/go_getter_utils.go`, verbose debug logging of raw URLs is intentionally kept for debugging purposes, despite potential credential exposure risks.

Applied to files:

NOTICE

📚 Learning: 2025-02-21T20:56:05.539Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1077
File: pkg/downloader/custom_github_detector.go:0-0
Timestamp: 2025-02-21T20:56:05.539Z
Learning: The `github.com/charmbracelet/log` package should be imported with the alias `log` according to the project's import alias configuration.

Applied to files:

NOTICE

📚 Learning: 2025-02-21T20:56:20.761Z

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1077
File: pkg/downloader/custom_github_detector_test.go:0-0
Timestamp: 2025-02-21T20:56:20.761Z
Learning: The `github.com/charmbracelet/log` package should be imported with the alias `log`, not `clog`.

Applied to files:

NOTICE

🧬 Code graph analysis (1)

pkg/config/config_test.go (2)

pkg/config/config.go (1)

InitCliConfig (28-67)

pkg/schema/schema.go (1)

ConfigAndStacksInfo (646-742)

🪛 GitHub Actions: Dependency Review

NOTICE

[error] 1-1: NOTICE file is out of date. Run './scripts/generate-notice.sh' locally and commit the changes.

🪛 GitHub Actions: Tests

pkg/devcontainer/lifecycle_rebuild_test.go

[error] 434-434: ATMOS_VERSION mismatch in TestManager_Rebuild: expected '1.201.0' but found '1.202.0'.

🪛 LanguageTool

docs/fixes/path-resolution-regression.md

[typographical] ~38-~38: Consider using a typographic opening quote here. Context: ...ge) ## Root Cause Commit 2aad133f6 ("fix: resolve ATMOS_BASE_PATH relative to...

(EN_QUOTES)

[typographical] ~38-~38: Consider using a typographic close quote here. Context: ...SE_PATH relative to CLI config directory") introduced a new `resolveAbsolutePath(...

(EN_QUOTES)

[style] ~42-~42: Consider using a different verb for a more formal wording. Context: ...ng atmos.yaml). This was intended to fix a legitimate issue where `ATMOS_BASE_PA...

(FIX_RESOLVE)

[typographical] ~139-~139: Consider using a typographic opening quote here. Context: ....yaml ``` The config/atmos.yaml uses base_path: ".." to reference the parent directory (...

(EN_QUOTES)

[typographical] ~174-~174: In American English, use a period after an abbreviation. Context: ...t, not inside config/ ``` ### Expected vs Broken Behavior | Command | v1.200.0 (...

(MISSING_PERIOD_AFTER_ABBREVIATION)

[typographical] ~178-~178: Consider using a typographic opening quote here. Context: ...atmos validate stacks | ✅ Success | ❌ "stacks directory does not exist" | ✅ Suc...

(EN_QUOTES)

(EN_QUOTES)

(EN_QUOTES)

(EN_QUOTES)

[typographical] ~184-~184: Consider using a typographic opening quote here. Context: ... PRs/Commits - Commit 2aad133f6: "fix: resolve ATMOS_BASE_PATH relative to...

(EN_QUOTES)

[typographical] ~184-~184: Consider using a typographic close quote here. Context: ...SE_PATH relative to CLI config directory" (introduced the regression) - **PR #177...

(EN_QUOTES)

[typographical] ~185-~185: Consider using a typographic opening quote here. Context: ...roduced the regression) - PR #1774: "Path-based component resolution for all ...

(EN_QUOTES)

[typographical] ~185-~185: Consider using a typographic close quote here. Context: ...ed component resolution for all commands" (contained the breaking commit)

(EN_QUOTES)

🪛 markdownlint-cli2 (0.18.1)

docs/fixes/path-resolution-regression.md

15-15: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

127-127: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

⏰ Context from checks skipped due to timeout of 900000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Summary

🔇 Additional comments (15)

examples/quick-start-advanced/Dockerfile (1)

9-9: LGTM! Version bump follows team convention.

The update to 1.202.0 is intentional and aligns with the team's preference to pin to the next release version.

go.mod (6)

25-32: LGTM - AWS SDK v2 updates.

Routine patch version bumps across AWS SDK v2 components.

37-42: LGTM - Charmbracelet UI library updates.

Minor version bumps for colorprofile and ansi libraries.

73-73: LGTM - Kubescape go-git-url update.

Patch version bump for git URL parsing library.

96-96: LGTM - Terraform Docs update.

Minor version bump from v0.20.0 to v0.21.0.

132-132: LGTM - Indirect dependency updates.

Routine patch/minor version bumps for indirect dependencies (BurntSushi/toml, clipperhouse/displaywidth, sagikazarmark/locafero, terraform-config-inspect).

Also applies to: 182-182, 344-344, 356-356

395-407: LGTM - Golang.org/x package updates.

Routine updates to golang.org/x packages (crypto, exp, mod, net, tools, genproto, protobuf) and mvdan.cc/xurls.

Also applies to: 412-412

tests/fixtures/scenarios/cli-config-path/stacks/dev.yaml (1)

1-8: LGTM - Valid test fixture.

Simple stack configuration for the cli-config-path test scenario.

tests/fixtures/scenarios/cli-config-path/components/terraform/test-component/main.tf (1)

1-8: LGTM - Valid Terraform test component.

Minimal Terraform configuration for testing path resolution.

tests/fixtures/scenarios/cli-config-path/config/atmos.yaml (1)

1-25: LGTM - Test fixture correctly demonstrates the regression scenario.

The config structure matches the issue #1858 scenario: atmos.yaml in a subdirectory with base_path: ".." using explicit relative path syntax, while stacks and components paths are simple relative paths that should resolve to CWD.

pkg/config/config_test.go (2)

867-968: LGTM - Comprehensive path resolution test coverage.

The test covers all path resolution scenarios:

Absolute paths

Simple relative paths resolving to CWD

Empty and dot paths resolving to CWD

Explicit relative paths (.., ../, ./) resolving to config dir

Edge case with empty config path

The table-driven approach is clean and the assertions verify correct resolution behavior.

970-1026: LGTM - Integration test validates regression fix.

The test correctly exercises the issue #1858 scenario:

Config in subdirectory with base_path: ".." (explicit relative path)

Simple relative paths like "stacks" should resolve to CWD, not inside config/

BasePathAbsolute correctly resolves to repo root

The test uses the appropriate test fixture and validates the expected behavior.

docs/fixes/path-resolution-regression.md (1)

1-185: LGTM - Comprehensive documentation of the fix.

The documentation clearly explains:

The regression symptoms

Root cause analysis

The solution and its rationale

Test coverage

Manual testing steps

Backward compatibility considerations

This will be valuable for users affected by the regression and for future maintainers.

pkg/config/config.go (2)

203-213: LGTM - Clear documentation of resolution strategy.

The updated documentation clearly explains:

The three resolution rules

Backward compatibility rationale

Reference to GitHub issue #1858

This will help future maintainers understand the intent.

220-246: LGTM - Correct implementation of explicit relative path detection.

The fix correctly identifies paths that explicitly reference the config directory:

Paths starting with ".." (parent traversal)

Paths starting with "./" (explicit current dir)

Other relative paths correctly fall back to CWD resolution for backward compatibility. The error messages include helpful context.

The implementation handles edge cases properly:

Empty paths resolve to CWD

"." resolves to CWD

Paths with ".." in the middle (not at start) resolve to CWD

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Dec 13 '25 02:12 coderabbitai[bot]

@coderabbitai full review please

Dec 13 '25 02:12 aknysh

@aknysh, I'll perform a full review of the PR now.

🧠 Learnings used

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-13T00:52:18.278Z
Learning: Test data: Use fixtures in `tests/test-cases/`: `atmos.yaml`, `stacks/`, `components/`. NEVER modify `tests/test-cases/` or `tests/testdata/` unless explicitly instructed. Golden snapshots are sensitive to minor changes

Learnt from: haitham911
Repo: cloudposse/atmos PR: 727
File: internal/exec/path_utils.go:145-146
Timestamp: 2024-10-23T22:11:41.077Z
Learning: In the `atmos` project, the preference is to print relative paths in log messages instead of full paths.

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: Benbentwo
Repo: cloudposse/atmos PR: 1475
File: tests/fixtures/scenarios/atmos-auth/stacks/deploy/nonprod.yaml:3-4
Timestamp: 2025-09-24T20:45:40.401Z
Learning: In Atmos stack files, the correct syntax for importing other stack files is `import:` (singular), not `imports:` (plural). All stack files in the Atmos codebase consistently use `import:` followed by a list of paths to import.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1466
File: website/docs/cli/commands/toolchain/usage.mdx:117-121
Timestamp: 2025-09-08T01:25:44.958Z
Learning: Final XDG Base Directory Specification implementation for atmos toolchain is complete and verified: toolchain/xdg_cache.go provides GetXDGCacheDir() and GetXDGTempCacheDir() functions, all hardcoded ~/.cache/tools-cache paths have been replaced with XDG-compliant paths using ${XDG_CACHE_HOME}/atmos-toolchain (or ~/.cache/atmos-toolchain fallback), and tests have been updated to expect the new path structure.

✅ Actions performed

Full review triggered.

Dec 13 '25 02:12 coderabbitai[bot]

@aknysh, I'll perform a comprehensive review of all changes in this PR, including the path resolution logic fix, new tests, documentation, and dependency updates.

🧠 Learnings used

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1147
File: internal/exec/validate_schema.go:42-57
Timestamp: 2025-04-11T22:06:46.999Z
Learning: The "ExecuteAtmosValidateSchemaCmd" function in internal/exec/validate_schema.go has been reviewed and confirmed to have acceptable cognitive complexity despite static analysis warnings. The function uses a clean structure with only three if statements for error handling and delegates complex operations to helper methods.

Learnt from: aknysh
Repo: cloudposse/atmos PR: 1185
File: internal/exec/yaml_func_store.go:26-26
Timestamp: 2025-04-04T02:03:23.676Z
Learning: The Atmos codebase currently uses `log.Fatal` for error handling in multiple places. The maintainers are aware this isn't an ideal pattern (should only be used in main() or init() functions) and plan to address it comprehensively in a separate PR. CodeRabbit should not flag these issues or push for immediate changes until that refactoring is complete.

✅ Actions performed

Full review triggered.

Dec 13 '25 03:12 coderabbitai[bot]

Codecov Report

:x: Patch coverage is 69.40299% with 41 lines in your changes missing coverage. Please review. :white_check_mark: Project coverage is 73.18%. Comparing base (47d0b2c) to head (ab5e84b). :warning: Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/config/load.go	66.03%	12 Missing and 6 partials :warning:
pkg/config/config.go	72.91%	9 Missing and 4 partials :warning:
pkg/config/process_yaml.go	65.21%	5 Missing and 3 partials :warning:
pkg/utils/git.go	80.00%	1 Missing and 1 partial :warning:

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #1868    +/-   ##
========================================
  Coverage   73.17%   73.18%            
========================================
  Files         609      609            
  Lines       56766    56883   +117     
========================================
+ Hits        41540    41631    +91     
- Misses      12305    12315    +10     
- Partials     2921     2937    +16

Flag	Coverage Δ
unittests	`73.18% <69.40%> (+<0.01%)`	:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
pkg/config/git_root.go	`84.21% <ø> (-1.16%)`	:arrow_down:
pkg/utils/yaml_utils.go	`81.84% <ø> (ø)`
pkg/utils/git.go	`61.36% <80.00%> (+8.42%)`	:arrow_up:
pkg/config/process_yaml.go	`70.04% <65.21%> (+0.84%)`	:arrow_up:
pkg/config/config.go	`74.64% <72.91%> (-0.52%)`	:arrow_down:
pkg/config/load.go	`78.32% <66.03%> (-0.84%)`	:arrow_down:

... and 5 files with indirect coverage changes

:rocket: New features to boost your workflow:

:snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Dec 13 '25 04:12 codecov[bot]

[!WARNING]

This PR exceeds the recommended limit of 1,000 lines.

Large PRs are difficult to review and may be rejected due to their size.

Please verify that this PR does not address multiple issues. Consider refactoring it into smaller, more focused PRs to facilitate a smoother review process.

Dec 15 '25 18:12 mergify[bot]

💥 This pull request now has conflicts. Could you fix it @aknysh? 🙏

Dec 15 '25 18:12 mergify[bot]

@coderabbitai full review please

Dec 15 '25 19:12 aknysh

@aknysh, I'll perform a comprehensive full review of this PR now, covering:

Path resolution logic changes in pkg/config/config.go and related helpers
New git root discovery functionality
The new !cwd YAML tag implementation
Test coverage across unit and integration tests
Documentation updates in website and PRD docs
Dependency updates in go.mod

Given the scope of changes addressing the path resolution regression from v1.201.0, I'll pay particular attention to the resolution semantics for different path patterns (absolute, explicit relative, simple relative, and empty paths) and ensure the backward compatibility goals are met.

🧠 Learnings used

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-22T12:38:33.132Z
Learning: In the Atmos project, continue to flag path traversal issues in code reviews but acknowledge when they are expected and acceptable in specific cases.

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Learnt from: osterman
Repo: cloudposse/atmos PR: 1686
File: docs/prd/tool-dependencies-integration.md:58-64
Timestamp: 2025-12-13T06:07:34.794Z
Learning: cloudposse/atmos: For PRD docs (docs/prd/*.md), markdownlint issues like MD040/MD010/MD034 can be handled in a separate documentation cleanup commit and should not block the current PR.

Learnt from: osterman
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_utils.go:496-513
Timestamp: 2024-11-19T14:50:16.194Z
Learning: In the Atmos project, path traversal is acceptable due to its role in automation. Do not flag path traversal as an issue in code reviews.

Learnt from: osterman
Repo: cloudposse/atmos PR: 727
File: internal/exec/terraform_clean.go:329-332
Timestamp: 2024-10-28T01:51:30.811Z
Learning: In the Atmos Go code, when deleting directories or handling file paths (e.g., in `terraform_clean.go`), always resolve the absolute path using `filepath.Abs` and use the logger `u.LogWarning` for logging messages instead of using `fmt.Printf`.

Learnt from: osterman
Repo: cloudposse/atmos PR: 887
File: internal/exec/workflow_utils.go:167-169
Timestamp: 2024-12-25T20:28:19.618Z
Learning: The user plans to revert the change from `path.Join` to `filepath.Join` in this PR due to testing gaps and will open a new PR to safely handle the migration without breaking `main`.

Learnt from: aknysh
Repo: cloudposse/atmos PR: 1185
File: internal/exec/yaml_func_store.go:26-26
Timestamp: 2025-04-04T02:03:23.676Z
Learning: The Atmos codebase currently uses `log.Fatal` for error handling in multiple places. The maintainers are aware this isn't an ideal pattern (should only be used in main() or init() functions) and plan to address it comprehensively in a separate PR. CodeRabbit should not flag these issues or push for immediate changes until that refactoring is complete.

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1147
File: internal/exec/validate_schema.go:42-57
Timestamp: 2025-04-11T22:06:46.999Z
Learning: The "ExecuteAtmosValidateSchemaCmd" function in internal/exec/validate_schema.go has been reviewed and confirmed to have acceptable cognitive complexity despite static analysis warnings. The function uses a clean structure with only three if statements for error handling and delegates complex operations to helper methods.

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Learnt from: samtholiya
Repo: cloudposse/atmos PR: 1466
File: toolchain/http_client_test.go:3-10
Timestamp: 2025-09-10T21:17:55.273Z
Learning: In the cloudposse/atmos repository, imports should never be changed as per samtholiya's coding guidelines.

✅ Actions performed

Full review triggered.

Dec 15 '25 19:12 coderabbitai[bot]

@aknysh update PR description

Dec 16 '25 01:12 osterman

💥 This pull request now has conflicts. Could you fix it @aknysh? 🙏

Dec 17 '25 14:12 mergify[bot]

These changes were released in v1.202.0.

Dec 18 '25 19:12 github-actions[bot]

These changes were released in v1.203.0-test.1.

Dec 19 '25 17:12 github-actions[bot]

fix: Fix base path resolution and fallback order

what

why

Path Resolution Semantics

Key Semantic Distinctions

Config File Search Order

references

Summary by CodeRabbit

Dependency Review

Scanned Files

Cloud Posse Engineering Team Review Required

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested reviewers

Pre-merge checks and finishing touches

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Pre-merge checks and finishing touches

Codecov Report

This PR exceeds the recommended limit of 1,000 lines.