Skip to main content

atmos plugin pack

Pack precompiled native executables and schemas into a multi-platform OCI layout.
Experimental
atmos plugin pack --help

Usage​

atmos plugin pack [directory] --output=<layout>

Success confirms the local OCI layout path and displays the package ID, version, and included platforms, followed by an inventory of every file packed for each platform with its size and mode. Review the inventory before you publish. Packing prepares a local release; use plugin publish to upload it to a registry.

What goes into a release​

Each platform payload contains only:

  • plugin.yaml
  • schemas/**/*.json
  • the executable that the manifest declares for that platform

Nothing else is added, and Atmos rejects the pack instead of silently skipping a problem file:

  • Hidden files and directories, such as .git, .terraform, .atmos, .env, .aws, or .ssh.
  • Names that look like credentials, keys, or state: .tfstate, .tfvars, .pem, .key, .p12, .pfx, id_rsa-style names, terraform.rc, and anything containing credentials or secret.
  • Symbolic links, hard links, directories, and special files. Only regular files are packed.
  • Any file under schemas/ that is not a .json file.
  • An executable that is not a native binary for its platform. Atmos reads the file header (ELF for Linux and BSD, Mach-O for macOS, PE for Windows) and checks the operating system and architecture; it never runs the file. A script, or a binary built for another platform, fails with a hint to build for that platform.

The same rules run in plugin validate and again when a release is published or extracted, so a layout edited by hand cannot smuggle extra files into a release.

Each source executable is stored at the common spec.runtime.executable path inside its platform payload. If the release declares any Windows platform, that common path must end in .exe, for example bin/plugin.exe; this filename also works on Linux and macOS. pack and publish reject Windows releases with an extensionless runtime executable.

Build all declared targets with plugin build --all-platforms, and run conformance on native runners before publishing. Native-header validation checks OS and architecture; it does not prove CPU instruction-set requirements or external library compatibility. Publishers are responsible for testing the variants they declare.

Arguments and flags​

directory
Package directory; defaults to the current directory.
--output, -o
New destination directory for the OCI layout. Every declared platform must already be compiled.
--format
Output format: table (default), json, yaml, csv, or tsv. Also configurable with ATMOS_PLUGIN_FORMAT.

Examples​

atmos plugin pack ./corporate-oidc --output=./oidc-release
atmos plugin pack ./corporate-oidc --output=./another-release --format=json