# atmos vendor verify

Compare every lock-owned file on disk against its recorded `vendor.lock.yaml` receipt. Report
drift — missing files, or files whose contents no longer match what was last vendored. Exits
non-zero when any drift is found, for use in CI.

## Usage

```shell
atmos vendor verify [--component <name>] [--type <type>] [--file <path>] [--tags <a,b>] [--format table|json]
atmos vendor verify [--stack <stack>] [--labels <k>=<v>] [--tags <a,b>] [--format table|json]
```

This never checks for a newer version upstream — see
`atmos vendor update --check` for that. The `vendor
verify` command is purely a read-only, on-disk integrity check against what's already recorded in
the lock file: it never fetches, writes, or modifies anything.

At most one base selector may be given: `--component` or `--stack`/`--labels` (a stack-resolved
component set, composable with each other, like
`atmos vendor pull`'s own `--stack`/`--labels`). `--tags`
(vendor.yaml's own declared source tags) is a separate, independent filter that composes with
either base selector, or stands on its own — narrowing the verified set to only components whose
declared tags also match; a component with no `vendor.yaml` entry has no tags to match and is
excluded by a non-empty `--tags` filter. Omit every selector to verify everything. A selector that
matches nothing is an error, not a silent "verify everything" fallback.

## Examples

```shell
# Verify every vendored artifact.
atmos vendor verify

# Verify only one component.
atmos vendor verify --component vpc

# Verify every component whose vendor.yaml source declares a given tag.
atmos vendor verify --tags networking

# Verify every component in a stack, or matching stack metadata.labels.
atmos vendor verify --stack dev-us-west-2
atmos vendor verify --labels tier=1

# Combine multiple selectors in one comma-separated --labels value.
atmos vendor verify --labels tier=1,cost-center=platform

# Verify a stack's components, narrowed further by declared vendor.yaml tags.
atmos vendor verify --stack dev-us-west-2 --tags networking

# Machine-readable output for CI.
atmos vendor verify --format json
```

## Flags

- **`--component` / `-c` (string)** — Verify only this component. Mutually exclusive with `--stack`/`--labels`. Composes with `--tags` (narrows to this component only if its declared `vendor.yaml` tags also match). Omit every selector to verify every artifact recorded in the lock file.
- **`--tags` (string)** — Verify only components whose `vendor.yaml` source declares any of these comma-separated tags (matches any). An independent filter: composes with `--component` or `--stack`/`--labels` to narrow further, or stands on its own.Environment variable: `ATMOS_VENDOR_TAGS`
- **`--stack` / `-s` (string)** — Verify only components belonging to the specified stack. Composes with `--labels` to narrow further, and with `--tags` to filter by declared source tags. Mutually exclusive with `--component`.
- **`--labels` (string)** — Verify only components whose stack `metadata.labels` match ALL of these `key=value` or `key:value` pairs — comma-separated in one flag value (`--labels tier=1,cost-center=platform`). Composes with `--stack` and `--tags`. Mutually exclusive with `--component`.Environment variable: `ATMOS_VENDOR_LABELS`
- **`--type` / `-t` (string, default `terraform`)** — Component type (`terraform`, `helmfile`, or `packer`). Pass this flag explicitly to scope a `--stack`/`--labels` selection to one component type. When you omit it, every component type is considered.
- **`--file` (string, default `./vendor.yaml`)** — The vendor manifest to read declared source tags from when resolving `--tags`.
- **`--format` (string, default `table`)** — Output format: `table` or `json`.

:::note
The `atmos vendor verify` command reports drift; it never fixes it. Re-run
`atmos vendor pull --refresh-lock` (or `atmos vendor pull --component <name> --refresh-lock` for a
single component) to re-fetch and reconcile drifted sources. Or run
`atmos vendor clean` to remove lock-owned files
outright.
:::

## Try it out

### demo-vendoring

Copy the example into a new directory and make it your own:

```shell
atmos init examples/demo-vendoring
cd demo-vendoring
```

Download `weather` and refresh its local receipt, then verify that its files match. The initial pull requires Git and network access; verification is offline.

```shell
atmos vendor pull --component weather --refresh-lock
atmos vendor verify --component weather
```

- [Installation guide](/install)
- [Explore the example](/examples/demo-vendoring)
- [Initialization and repository settings](/cli/commands/init#examples-and-source-directories)