cloudposse
diff --git a/‎.github/workflows/codeql.yml‎
Lines changed: 6 additions & 0 deletions b/‎.github/workflows/codeql.yml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎CLAUDE.md‎
Lines changed: 54 additions & 0 deletions b/‎CLAUDE.md‎
Lines changed: 54 additions & 0 deletions
diff --git a/‎cmd/auth_env_test.go‎
Lines changed: 10 additions & 0 deletions b/‎cmd/auth_env_test.go‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎cmd/auth_login_test.go‎
Lines changed: 8 additions & 0 deletions b/‎cmd/auth_login_test.go‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎cmd/auth_user_test.go‎
Lines changed: 16 additions & 0 deletions b/‎cmd/auth_user_test.go‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎cmd/auth_validate_test.go‎
Lines changed: 6 additions & 0 deletions b/‎cmd/auth_validate_test.go‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎cmd/auth_whoami_test.go‎
Lines changed: 8 additions & 0 deletions b/‎cmd/auth_whoami_test.go‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎cmd/describe_affected_test.go‎
Lines changed: 8 additions & 0 deletions b/‎cmd/describe_affected_test.go‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎cmd/describe_dependents_test.go‎
Lines changed: 8 additions & 0 deletions b/‎cmd/describe_dependents_test.go‎
Lines changed: 8 additions & 0 deletions
@@ -90,6 +90,12 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      # Pre-populate module cache to prevent goanalysis_metalinter failures.
+      # Without this, the linter may fail with "could not load export data" errors.
+      # See: https://github.com/golangci/golangci-lint/issues/5437
+      - name: Download modules
+        run: go mod download
+
       # Install the golangci-lint v2 CLI tool (not the linters themselves).
       # This tool is needed to run `golangci-lint custom` which builds a custom binary
       # that includes both standard linters AND our custom module plugins.
 
@@ -253,6 +253,60 @@ var (
 - Target >80% coverage, especially for `pkg/` and `internal/exec/`
 - **Comments must end with periods**: All comments should be complete sentences ending with a period (enforced by golangci-lint)
 
+### Test Isolation (MANDATORY)
+- **ALWAYS use `cmd.NewTestKit(t)` for ALL cmd package tests**.
+- **TestKit pattern follows Go 1.15+ testing.TB interface idiom**.
+- **Provides automatic RootCmd state cleanup similar to `t.Setenv()` and `t.Chdir()`**.
+- **Required for ALL tests that**:
+  - Call `RootCmd.Execute()` or `Execute()`.
+  - Call `RootCmd.SetArgs()` or modify `RootCmd` flags.
+  - Call any command that internally uses `RootCmd`.
+  - When in doubt, use it - it's safe and lightweight.
+
+- **Basic usage**:
+  ```go
+  func TestMyCommand(t *testing.T) {
+      t := cmd.NewTestKit(t) // Wraps testing.TB with automatic cleanup
+
+      // Rest of test - all testing.TB methods available
+      RootCmd.SetArgs([]string{"terraform", "plan"})
+      require.NoError(t, RootCmd.PersistentFlags().Set("chdir", "/tmp"))
+
+      // State automatically restored when test completes.
+  }
+  ```
+
+- **For table-driven tests with subtests**:
+  ```go
+  func TestTableDriven(t *testing.T) {
+      _ = cmd.NewTestKit(t) // Parent test gets cleanup
+
+      tests := []struct{...}{...}
+      for _, tt := range tests {
+          t.Run(tt.name, func(t *testing.T) {
+              _ = cmd.NewTestKit(t) // Each subtest gets its own cleanup
+
+              // Test code...
+          })
+      }
+  }
+  ```
+
+- **Why this is critical**:
+  - RootCmd is global state shared across all tests.
+  - Flag values persist between tests causing mysterious failures.
+  - StringSlice flags (config, config-path) are especially problematic.
+  - Without cleanup, tests pass in isolation but fail when run together.
+  - We use reflection to properly reset StringSlice flags which append instead of replace.
+
+- **Implementation notes**:
+  - TestKit wraps `testing.TB` and adds automatic RootCmd cleanup.
+  - Snapshots ALL flag values and their Changed state when created.
+  - Uses `t.Cleanup()` for automatic LIFO restoration.
+  - Handles StringSlice/StringArray flags specially (they require reflection to reset).
+  - All `testing.TB` methods work: `Helper()`, `Log()`, `Setenv()`, `Cleanup()`, etc.
+  - No performance penalty - snapshot is fast and only done once per test.
+
 ### Test Quality (MANDATORY)
 - **Test behavior, not implementation** - Verify inputs/outputs, not internal state
 - **Never test stub functions** - Either implement the function or remove the test
 
@@ -16,6 +16,8 @@ import (
 )
 
 func TestAuthEnvCmd(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name           string
 		args           []string
@@ -166,6 +168,8 @@ func TestAuthEnvCmd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Create a mock command for testing
 			cmd := &cobra.Command{
 				Use: "env",
@@ -274,6 +278,8 @@ func TestAuthEnvCmd(t *testing.T) {
 }
 
 func TestAuthEnvCmdFlags(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock command to test flag structure
 	cmd := &cobra.Command{
 		Use: "env",
@@ -293,6 +299,8 @@ func TestAuthEnvCmdFlags(t *testing.T) {
 }
 
 func TestFormatEnvironmentVariables(t *testing.T) {
+	_ = NewTestKit(t)
+
 	envVars := []schema.EnvironmentVariable{
 		{Key: "AWS_PROFILE", Value: "test-profile"},
 		{Key: "AWS_REGION", Value: "us-east-1"},
@@ -327,6 +335,8 @@ func TestFormatEnvironmentVariables(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.format, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			var output strings.Builder
 
 			switch tt.format {
 
@@ -14,6 +14,8 @@ import (
 )
 
 func TestAuthLoginCmd(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name           string
 		args           []string
@@ -123,6 +125,8 @@ func TestAuthLoginCmd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Setup test environment
 			originalArgs := os.Args
 			defer func() { os.Args = originalArgs }()
@@ -190,6 +194,8 @@ func TestAuthLoginCmd(t *testing.T) {
 }
 
 func TestAuthLoginCmdFlags(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock command to test flag structure
 	cmd := &cobra.Command{
 		Use: "login",
@@ -204,6 +210,8 @@ func TestAuthLoginCmdFlags(t *testing.T) {
 }
 
 func TestCreateAuthManager(t *testing.T) {
+	_ = NewTestKit(t)
+
 	authConfig := &schema.AuthConfig{
 		Providers: map[string]schema.Provider{
 			"test-provider": {
 
@@ -13,6 +13,8 @@ import (
 )
 
 func TestAuthUserConfigureCmd(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name           string
 		args           []string
@@ -166,6 +168,8 @@ func TestAuthUserConfigureCmd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Create a mock command for testing
 			cmd := &cobra.Command{
 				Use: "configure",
@@ -257,6 +261,8 @@ func maskAccessKey(accessKey string) string {
 }
 
 func TestAuthUserCmdStructure(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock command to test structure
 	cmd := &cobra.Command{
 		Use:   "user",
@@ -282,6 +288,8 @@ func TestAuthUserCmdStructure(t *testing.T) {
 }
 
 func TestAuthUserConfigureCmdStructure(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock configure command
 	configureCmd := &cobra.Command{
 		Use:   "configure",
@@ -295,6 +303,8 @@ func TestAuthUserConfigureCmdStructure(t *testing.T) {
 }
 
 func TestCredentialValidation(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name        string
 		accessKey   string
@@ -347,6 +357,8 @@ func TestCredentialValidation(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Mock credential validation
 			hasError := tt.accessKey == "" || tt.secretKey == ""
 
@@ -360,6 +372,8 @@ func TestCredentialValidation(t *testing.T) {
 }
 
 func TestMaskAccessKey(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		input    string
 		expected string
@@ -384,6 +398,8 @@ func TestMaskAccessKey(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.input, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			result := maskAccessKey(tt.input)
 			assert.Equal(t, tt.expected, result)
 		})
 
@@ -11,6 +11,8 @@ import (
 )
 
 func TestAuthValidateCmd(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name           string
 		setupConfig    func() *schema.AtmosConfiguration
@@ -158,6 +160,8 @@ func TestAuthValidateCmd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Create a mock command for testing
 			cmd := &cobra.Command{
 				Use: "validate",
@@ -238,6 +242,8 @@ func mockValidateAuthConfig(config *schema.AuthConfig) error {
 }
 
 func TestAuthValidateCmdIntegration(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock command to test structure
 	cmd := &cobra.Command{
 		Use:   "validate",
 
@@ -15,6 +15,8 @@ import (
 )
 
 func TestAuthWhoamiCmd(t *testing.T) {
+	_ = NewTestKit(t)
+
 	tests := []struct {
 		name           string
 		args           []string
@@ -119,6 +121,8 @@ func TestAuthWhoamiCmd(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Create a mock command for testing
 			cmd := &cobra.Command{
 				Use: "whoami",
@@ -201,6 +205,8 @@ func TestAuthWhoamiCmd(t *testing.T) {
 }
 
 func TestAuthWhoamiCmdFlags(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Create a mock command to test flag structure
 	cmd := &cobra.Command{
 		Use: "whoami",
@@ -215,6 +221,8 @@ func TestAuthWhoamiCmdFlags(t *testing.T) {
 }
 
 func TestWhoamiJSONOutput(t *testing.T) {
+	_ = NewTestKit(t)
+
 	expTime, _ := time.Parse(time.RFC3339, "2024-01-01T12:00:00Z")
 	whoamiInfo := authTypes.WhoamiInfo{
 		Identity:   "test-identity",
 
@@ -13,6 +13,8 @@ import (
 )
 
 func TestDescribeAffected(t *testing.T) {
+	_ = NewTestKit(t)
+
 	t.Chdir("../tests/fixtures/scenarios/basic")
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
@@ -33,6 +35,8 @@ func TestDescribeAffected(t *testing.T) {
 }
 
 func TestSetFlagValueInCliArgs(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Initialize test cases
 	tests := []struct {
 		name          string
@@ -98,6 +102,8 @@ func TestSetFlagValueInCliArgs(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			// Create a new flag set
 			fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 
@@ -149,6 +155,8 @@ func TestSetFlagValueInCliArgs(t *testing.T) {
 }
 
 func TestDescribeAffectedCmd_Error(t *testing.T) {
+	_ = NewTestKit(t)
+
 	stacksPath := "../tests/fixtures/scenarios/terraform-apply-affected"
 
 	t.Setenv("ATMOS_CLI_CONFIG_PATH", stacksPath)
 
@@ -13,6 +13,8 @@ import (
 )
 
 func TestDescribeDependents(t *testing.T) {
+	_ = NewTestKit(t)
+
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
@@ -38,6 +40,8 @@ func TestDescribeDependents(t *testing.T) {
 }
 
 func TestSetFlagInDescribeDependents(t *testing.T) {
+	_ = NewTestKit(t)
+
 	// Initialize test cases
 	tests := []struct {
 		name        string
@@ -78,6 +82,8 @@ func TestSetFlagInDescribeDependents(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			_ = NewTestKit(t)
+
 			fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
 			fs.StringP("format", "f", "yaml", "Specify the output format (`yaml` is default)")
 			fs.StringP("output", "o", "list", "Specify the output type (`list` is default)")
@@ -96,6 +102,8 @@ func TestSetFlagInDescribeDependents(t *testing.T) {
 }
 
 func TestDescribeDependentsCmd_Error(t *testing.T) {
+	_ = NewTestKit(t)
+
 	stacksPath := "../tests/fixtures/scenarios/terraform-apply-affected"
 
 	t.Setenv("ATMOS_CLI_CONFIG_PATH", stacksPath)