atmos vendor verify

Compare every lock-owned file on disk against its recorded vendor.lock.yaml receipt. Report drift — missing files, or files whose contents no longer match what was last vendored. Exits non-zero when any drift is found, for use in CI.

Usage

atmos vendor verify [--component <name>] [--type <type>] [--file <path>] [--tags <a,b>] [--format table|json]
atmos vendor verify [--stack <stack>] [--labels <k>=<v>] [--tags <a,b>] [--format table|json]

This never checks for a newer version upstream — see atmos vendor update --check for that. The vendor verify command is purely a read-only, on-disk integrity check against what's already recorded in the lock file: it never fetches, writes, or modifies anything.

At most one base selector may be given: --component or --stack/--labels (a stack-resolved component set, composable with each other, like atmos vendor pull's own --stack/--labels). --tags (vendor.yaml's own declared source tags) is a separate, independent filter that composes with either base selector, or stands on its own — narrowing the verified set to only components whose declared tags also match; a component with no vendor.yaml entry has no tags to match and is excluded by a non-empty --tags filter. Omit every selector to verify everything. A selector that matches nothing is an error, not a silent "verify everything" fallback.

Examples

# Verify every vendored artifact.
atmos vendor verify

# Verify only one component.
atmos vendor verify --component vpc

# Verify every component whose vendor.yaml source declares a given tag.
atmos vendor verify --tags networking

# Verify every component in a stack, or matching stack metadata.labels.
atmos vendor verify --stack dev-us-west-2
atmos vendor verify --labels tier=1

# Verify a stack's components, narrowed further by declared vendor.yaml tags.
atmos vendor verify --stack dev-us-west-2 --tags networking

# Machine-readable output for CI.
atmos vendor verify --format json

Flags

--component / -c (string)

Verify only this component. Mutually exclusive with --stack/--labels. Composes with --tags (narrows to this component only if its declared vendor.yaml tags also match). Omit every selector to verify every artifact recorded in the lock file.

--tags (string)

Verify only components whose vendor.yaml source declares any of these comma-separated tags (matches any). An independent filter: composes with --component or --stack/--labels to narrow further, or stands on its own.

--stack / -s (string)

Verify only components belonging to the specified stack. Composes with --labels to narrow further, and with --tags to filter by declared source tags. Mutually exclusive with --component.

--labels (string)

Verify only components whose stack metadata.labels match ALL of these comma-separated key=value or key:value pairs. Composes with --stack and --tags. Mutually exclusive with --component.

--type / -t (string, default terraform)

Component type (terraform, helmfile, or packer). Pass this flag explicitly to scope a --stack/--labels selection to one component type. When you omit it, every component type is considered.

--file (string, default ./vendor.yaml)

The vendor manifest to read declared source tags from when resolving --tags.

--format (string, default table)

Output format: table or json.

note

The atmos vendor verify command reports drift; it never fixes it. Re-run atmos vendor pull --refresh-lock (or atmos vendor pull --component <name> --refresh-lock for a single component) to re-fetch and reconcile drifted sources. Or run atmos vendor clean to remove lock-owned files outright.