Bug: store-outputs hook fires before JIT workdir is provisioned on terraform apply, causing backend file generation failure #2307

cat << 'SCRIPT' > repro.sh
#!/usr/bin/env bash
# ============================================================
# ATMOS REPRO: JIT workdir not provisioned before hooks fire
#
# Stack name:  demo       (from vars.name + name_template)
# Component:   null-label (key under components.terraform)
# Commands:    atmos terraform <cmd> null-label -s demo
#
# Requires: atmos, tofu, docker
# ============================================================

set -euo pipefail

# --- 0) Create isolated workspace ---
WORKDIR="$(mktemp -d -t atmos-repro-XXXXXX)"
echo "Working in: ${WORKDIR}"
cd "${WORKDIR}"

# --- 1) Start a local Redis instance for the store ---
echo "== starting redis =="
docker stop atmos-repro-redis 2>/dev/null || true
docker run -d --rm --name atmos-repro-redis -p 6379:6379 redis:7-alpine
trap 'docker stop atmos-repro-redis 2>/dev/null || true' EXIT
sleep 1

# --- 2) Write atmos.yaml (shared across both scenarios) ---
cat <<'EOF' > atmos.yaml
base_path: "."

stores:
  local/redis:
    type: redis
    options:
      url: "redis://localhost:6379"

components:
  terraform:
    base_path: "components/terraform"
    command: "tofu"
    workspaces_enabled: true
    apply_auto_approve: false
    deploy_run_init: true
    init_run_reconfigure: true
    auto_generate_backend_file: true

stacks:
  name_template: "{{ .vars.name }}"
  base_path: "stacks"
  included_paths:
    - "**/*"
EOF

mkdir -p stacks

cleanup() {
  echo "-- cleanup --"
  atmos terraform workdir clean --all 2>/dev/null || true
  echo "-- cleanup done --"
}

# ============================================================
# SCENARIO 1 (SUCCESS): JIT + workdir WITHOUT hooks
# Confirms the component itself works fine — the bug is
# introduced by the before-terraform-apply hook.
# ============================================================
echo
echo "================================================="
echo "SCENARIO 1: apply WITHOUT hooks (expect success)"
echo "================================================="
cleanup

cat <<'EOF' > stacks/demo.yaml
vars:
  name: demo

terraform:
  backend_type: local

components:
  terraform:
    null-label:
      vars:
        namespace: "eg"
        stage: "test"
        name: "demo"
        enabled: true
      source:
        uri: "git::https://github.com/cloudposse/terraform-null-label.git"
        version: "0.25.0"
        ttl: "0s"
      provision:
        workdir:
          enabled: true
      # NO hooks — baseline to confirm JIT + workdir works
EOF

echo "== init =="
atmos terraform init null-label -s demo

echo "== apply =="
atmos terraform apply null-label -s demo -- -auto-approve
echo "SCENARIO 1: PASSED (success as expected)"

# ============================================================
# SCENARIO 2 (FAILURE): JIT + workdir WITH before-apply hook
# The before.terraform.apply hook fires before the workdir is
# provisioned, so backend.tf.json does not exist yet.
# ============================================================
echo
echo "================================================="
echo "SCENARIO 2: apply WITH before-apply hook (expect failure)"
echo "================================================="
cleanup

cat <<'EOF' > stacks/demo.yaml
vars:
  name: demo

terraform:
  backend_type: local

components:
  terraform:
    null-label:
      vars:
        namespace: "eg"
        stage: "test"
        name: "demo"
        enabled: true
      source:
        uri: "git::https://github.com/cloudposse/terraform-null-label.git"
        version: "0.25.0"
        ttl: "0s"
      provision:
        workdir:
          enabled: true
      hooks:
        store-outputs:
          events:
            - before-terraform-apply
          command: store
          name: local/redis
          outputs:
            label_id: .id
EOF

echo "== init =="
atmos terraform init null-label -s demo

echo "== apply (expected to FAIL) =="
set +e
atmos terraform apply null-label -s demo -- -auto-approve
EXIT_CODE=$?
set -e

if [[ $EXIT_CODE -ne 0 ]]; then
  echo "SCENARIO 2: FAILED (failure expected — bug confirmed)"
else
  echo "SCENARIO 2: UNEXPECTEDLY SUCCEEDED — bug may be fixed"
fi

echo
echo "Done. Workspace preserved at: ${WORKDIR}"
SCRIPT
bash repro.sh 2>&1 | tee repro.log