fix(git): tolerate config errors for CI git-clone bootstrap pre-Cobra

.claude/settings.json

@@ -39,6 +39,7 @@
       "Bash(git reset --hard:*)",
       "Bash(git clean:*)",
       "Bash(go clean:*)",
+      "Bash(gofmt:*)",
       "Bash(git add -A:*)",
       "Bash(git add --all:*)",
       "Bash(git add .:*)",

cmd/cmd_utils.go

@@ -50,6 +50,7 @@ import (
 	"github.com/cloudposse/atmos/pkg/ui"
 	u "github.com/cloudposse/atmos/pkg/utils"
 	"github.com/cloudposse/atmos/pkg/version"
+	workflowPkg "github.com/cloudposse/atmos/pkg/workflow"
 )
 
 //go:embed markdown/getting_started.md
@@ -1280,15 +1281,85 @@ func executeCustomCommand(
 			commandResult, runErr = stepPkg.ExecuteCommandResult(step.Name, run)
 			return runErr
 		}
+		// Use cmd.Context() so cancellation (e.g. Ctrl-C on the top-level Cobra invocation)
+		// propagates into step execution and container runtime operations;
+		// context.Background() would let them run to completion after the user has already
+		// cancelled. cmd.Context() is nil only when this command is invoked directly in tests
+		// without going through Cobra's Execute().
+		executionCtx := cmd.Context()
+		if executionCtx == nil {
+			executionCtx = context.Background()
+		}
+		// runExtendedStep converts step to a schema.WorkflowStep and routes it through the
+		// registered pkg/runner/step handlers (used for genuinely-extended step types like
+		// input/confirm/choose, and for "script" steps with no active container override).
+		runExtendedStep := func(workflowStep schema.WorkflowStep) error {
+			// Carry env onto the step so handlers that read step.Env (e.g. the
+			// container handler's in-container env) see it. The step's own
+			// declared `env:` had its map keys lowercased by Viper, so restore
+			// the original case from the shared env case map, then merge it over
+			// the resolved command/process env (step vars win on collisions).
+			stepOwnEnv := workflowStep.Env
+			if atmosConfig.CaseMaps != nil {
+				stepOwnEnv = atmosConfig.CaseMaps.ApplyCase("env", stepOwnEnv)
+			}
+			mergedStepEnv := envpkg.SliceToMap(env)
+			for key, value := range stepOwnEnv {
+				mergedStepEnv[key] = value
+			}
+			workflowStep.Env = mergedStepEnv
+			workflowStep.WorkingDirectory = stepWorkDir
+
+			if stack, ok := flagsData["stack"].(string); ok && stack != "" {
+				executor.SetFlag("stack", stack)
+			}
+
+			// Execute the extended step.
+			_, execErr := executor.Execute(executionCtx, &workflowStep)
+			return execErr
+		}
+		// runContainerOverrideStep routes a step-level `container:` override through the same
+		// pkg/workflow session/merge logic internal/exec/workflow_utils.go uses for
+		// workflow-file container steps, shared by both the "shell" and "script" cases below
+		// (which differ only in the workflowStep and the command shown in output/logs).
+		runContainerOverrideStep := func(workflowStep *schema.WorkflowStep, displayCommand string) error {
+			return runCommandStep(func(stdout, stderr io.Writer) error {
+				return workflowPkg.RunStepContainerOverride(executionCtx, &workflowPkg.ContainerStepParams{
+					Workflow:      commandConfig.Name,
+					WorkflowPath:  atmosConfig.CliConfigPath,
+					BasePath:      atmosConfig.BasePath,
+					WorkflowDef:   &schema.WorkflowDefinition{},
+					Step:          workflowStep,
+					HostWorkDir:   stepWorkDir,
+					Command:       displayCommand,
+					StepEnv:       env,
+					RuntimeEnv:    env,
+					StdoutCapture: stdout,
+					StderrCapture: stderr,
+				})
+			})
+		}
 		runStep := func() error {
 			switch stepType {
 			case "shell":
 				// Execute shell command (backward compatible).
 				// Steps with tty/interactive attach the user's terminal so commands
 				// like `aws ssm start-session` get a real TTY and own Ctrl-C.
 				commandName := fmt.Sprintf("%s-step-%d", commandConfig.Name, i)
+				// A step-level `container:` override (mapping config, or the
+				// bare `false` opt-out) routes the step through the same
+				// pkg/workflow session/merge logic internal/exec/workflow_utils.go
+				// uses for workflow-file steps, instead of always running on
+				// the host. Custom commands have no ambient command-level
+				// container block (unlike schema.WorkflowDefinition.Container
+				// for workflow files), so the merge base is always nil and
+				// the step's own `container:` block is the whole config.
+				workflowStep := step.ToWorkflowStep()
+				if workflowPkg.StepContainerOverride(&workflowStep) {
+					return runContainerOverrideStep(&workflowStep, commandToRun)
+				}
 				return runCommandStep(func(stdoutCapture, stderrCapture io.Writer) error {
-					return process.RunShellStep(context.Background(), &process.ShellSessionSpec{
+					return process.RunShellStep(executionCtx, &process.ShellSessionSpec{
 						Command:     commandToRun,
 						Name:        commandName,
 						Dir:         stepWorkDir,
@@ -1303,6 +1374,7 @@ func executeCustomCommand(
 							stderr = io.Discard
 						}
 						return e.ExecuteShellWithWriters(&e.ExecuteShellSpec{
+							Context: executionCtx,
 							Command: commandToRun,
 							Name:    commandName,
 							Dir:     stepWorkDir,
@@ -1312,6 +1384,18 @@ func executeCustomCommand(
 						})
 					})
 				})
+			case schema.TaskTypeScript:
+				// A step-level `container:` override routes the step through the same
+				// pkg/workflow session/merge logic internal/exec/workflow_utils.go uses for
+				// workflow-file script steps, mirroring the "shell" case above.
+				// workflowPkg.RunStepContainerOverride's containerStepCommand already
+				// special-cases Type == script to invoke Interpreter/Script directly instead
+				// of wrapping the display command in `sh -lc`.
+				workflowStep := step.ToWorkflowStep()
+				if workflowPkg.StepContainerOverride(&workflowStep) {
+					return runContainerOverrideStep(&workflowStep, process.FormatScriptDisplay(step.Interpreter, step.Script))
+				}
+				return runExtendedStep(workflowStep)
 			case schema.TaskTypeExec:
 				// Replace the Atmos process with the command (shell exec semantics).
 				return process.ReplaceShellSession(&process.ExecSpec{
@@ -1329,6 +1413,7 @@ func executeCustomCommand(
 				}
 				return runCommandStep(func(stdout, stderr io.Writer) error {
 					execOpts := []e.ShellCommandOption{
+						e.WithProcessContext(executionCtx),
 						e.WithStdoutCapture(stdout),
 						e.WithStderrCapture(stderr),
 					}
@@ -1359,7 +1444,7 @@ func executeCustomCommand(
 				if s, ok := flagsData["stack"].(string); ok {
 					stack = s
 				}
-				return e.ExecuteCustomCommandControlStep(context.Background(), &e.CustomCommandControlContext{
+				return e.ExecuteCustomCommandControlStep(executionCtx, &e.CustomCommandControlContext{
 					AtmosConfig:      atmosConfig,
 					CommandName:      commandConfig.Name,
 					CommandEnv:       envpkg.CommandEnvToMap(commandConfig.Env),
@@ -1372,38 +1457,14 @@ func executeCustomCommand(
 			default:
 				// Check if this is an extended step type (input, confirm, choose, etc.).
 				if stepPkg.IsExtendedStepType(stepType) {
-					// Convert Task to WorkflowStep for handler compatibility.
-					workflowStep := step.ToWorkflowStep()
-					// Carry env onto the step so handlers that read step.Env (e.g. the
-					// container handler's in-container env) see it. The step's own
-					// declared `env:` had its map keys lowercased by Viper, so restore
-					// the original case from the shared env case map, then merge it over
-					// the resolved command/process env (step vars win on collisions).
-					stepOwnEnv := workflowStep.Env
-					if atmosConfig.CaseMaps != nil {
-						stepOwnEnv = atmosConfig.CaseMaps.ApplyCase("env", stepOwnEnv)
-					}
-					mergedStepEnv := envpkg.SliceToMap(env)
-					for key, value := range stepOwnEnv {
-						mergedStepEnv[key] = value
-					}
-					workflowStep.Env = mergedStepEnv
-					workflowStep.WorkingDirectory = stepWorkDir
-
-					if stack, ok := flagsData["stack"].(string); ok && stack != "" {
-						executor.SetFlag("stack", stack)
-					}
-
-					// Execute the extended step.
-					_, execErr := executor.Execute(context.Background(), &workflowStep)
-					return execErr
+					return runExtendedStep(step.ToWorkflowStep())
 				}
 				return fmt.Errorf("%w: unsupported step type %q for custom command step %d", errUtils.ErrInvalidWorkflowStepType, stepType, i)
 			}
 		}
 		err = stepPkg.RunGroupedForType(&atmosConfig, step.Name, commandToRun, stepType, func() error {
 			if step.Retry != nil {
-				if retryErr := retry.Do(context.Background(), step.Retry, runStep); retryErr != nil {
+				if retryErr := retry.Do(executionCtx, step.Retry, runStep); retryErr != nil {
 					return retryErr
 				}
 			} else if runErr := runStep(); runErr != nil {

cmd/custom_command_container_build_test.go

@@ -0,0 +1,181 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	cfg "github.com/cloudposse/atmos/pkg/config"
+	"github.com/cloudposse/atmos/pkg/schema"
+	"github.com/cloudposse/atmos/tests/testhelpers"
+)
+
+// TestCustomCommandContainerBuildPassesWithBlockToDocker reproduces
+// https://github.com/cloudposse/atmos/issues/2876 end to end: a
+// `.atmos.d/commands.yaml`-style custom command with a `type: container,
+// action: build` step and a `with:` block must invoke docker with the full
+// configured Buildx engine, builder, cache, tags, dockerfile, and context --
+// not silently fall back to `docker build -f Dockerfile .`.
+//
+// This writes real config to disk, loads it through cfg.InitCliConfig (the
+// same production config-loading path `atmos` itself uses), registers it via
+// processCustomCommands, and invokes the resulting custom command
+// through RootCmd.Execute() exactly as a user would from the shell. A fake,
+// logging `docker` executable on PATH (testhelpers.InstallFakeContainerRuntime)
+// captures the real argv Atmos emits, so this exercises the real command
+// executor rather than manually constructing schema.Task/WorkflowStep/
+// ContainerBuildStep values in Go.
+func TestCustomCommandContainerBuildPassesWithBlockToDocker(t *testing.T) {
+	_ = NewTestKit(t)
+
+	tempDir := t.TempDir()
+	appDir := filepath.Join(tempDir, "app")
+	require.NoError(t, os.MkdirAll(appDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(appDir, "Dockerfile"), []byte("FROM scratch\n"), 0o644))
+
+	atmosYAML := `
+base_path: "."
+commands:
+  - name: test-container-build-with-block
+    description: Build the application image
+    steps:
+      - name: build
+        type: container
+        action: build
+        provider: docker
+        with:
+          engine: buildx
+          context: app
+          dockerfile: Dockerfile
+          tags:
+            - "example.invalid/demo:sha-test"
+          driver:
+            name: atmos-native-ci
+            provider: docker-container
+            opts:
+              image: mirror.gcr.io/moby/buildkit:buildx-stable-1
+          cache:
+            from:
+              - type: registry
+                ref: "example.invalid/demo:buildcache"
+            to:
+              - type: registry
+                ref: "example.invalid/demo:buildcache"
+                mode: max
+`
+	require.NoError(t, os.WriteFile(filepath.Join(tempDir, "atmos.yaml"), []byte(atmosYAML), 0o644))
+
+	t.Setenv("ATMOS_CLI_CONFIG_PATH", tempDir)
+	t.Setenv("ATMOS_BASE_PATH", tempDir)
+	t.Chdir(tempDir)
+
+	argsPath := filepath.Join(t.TempDir(), "docker-args.log")
+	t.Setenv("ATMOS_FAKE_RUNTIME_ARGS_FILE", argsPath)
+	testhelpers.InstallFakeContainerRuntime(t, testhelpers.FakeContainerRuntimeSpec{
+		Name: "docker",
+		Mode: testhelpers.FakeContainerRuntimeStep,
+	})
+
+	atmosConfig, err := cfg.InitCliConfig(schema.ConfigAndStacksInfo{}, false)
+	require.NoError(t, err)
+
+	require.NoError(t, processCustomCommands(atmosConfig, atmosConfig.Commands, RootCmd))
+
+	RootCmd.SetArgs([]string{"test-container-build-with-block"})
+	require.NoError(t, RootCmd.Execute())
+
+	content, err := os.ReadFile(argsPath)
+	require.NoError(t, err, "the fake docker executable must have been invoked at least once")
+	lines := strings.Split(strings.TrimSpace(string(content)), "\n")
+
+	var buildLine string
+	for _, line := range lines {
+		fields := strings.Split(line, "\t")
+		if len(fields) > 1 && fields[0] == "buildx" && fields[1] == "build" {
+			buildLine = line
+			break
+		}
+	}
+	require.NotEmpty(t, buildLine,
+		"expected a `docker buildx build ...` invocation; got invocations: %v", lines)
+
+	fields := strings.Split(buildLine, "\t")
+	assert.Contains(t, fields, "--builder", "configured Buildx driver must be applied")
+	assert.Contains(t, fields, "atmos-native-ci")
+	assert.Contains(t, fields, "-t", "configured tag must be applied")
+	assert.Contains(t, fields, "example.invalid/demo:sha-test")
+	assert.Contains(t, fields, "-f", "configured Dockerfile must be applied")
+	// context/dockerfile are relative paths in the with: block, resolved
+	// against the step's working directory (#2880) into absolute paths --
+	// docker still receives the same file, just no longer as a bare relative
+	// string a differing subprocess cwd could silently misresolve.
+	assert.Contains(t, fields, filepath.Join(appDir, "Dockerfile"), "configured Dockerfile must be applied")
+	assert.Contains(t, fields, appDir, "configured context must be applied")
+
+	// The driver: block must provision a real Buildx builder before the build
+	// runs (pkg/container/docker.go's ensureBuilder calls `docker buildx
+	// create` as a separate invocation), and the cache entries must reach
+	// docker as the exact configured reference/mode, not merely as a bare
+	// `--cache-from`/`--cache-to` flag with an unchecked value. The fake
+	// runtime already records every invocation unconditionally, so both are
+	// present in the same recorded args log used above.
+	var createLine string
+	for _, line := range lines {
+		createFields := strings.Split(line, "\t")
+		if len(createFields) > 1 && createFields[0] == "buildx" && createFields[1] == "create" {
+			createLine = line
+			break
+		}
+	}
+	require.NotEmpty(t, createLine,
+		"expected a `docker buildx create ...` invocation provisioning the configured driver; got invocations: %v", lines)
+	createFields := strings.Split(createLine, "\t")
+
+	flagValueCases := []struct {
+		name   string
+		fields []string
+		flag   string
+		want   string
+	}{
+		{"builder uses configured driver provider", createFields, "--driver", "docker-container"},
+		{"builder uses configured driver image opt", createFields, "--driver-opt", "image=mirror.gcr.io/moby/buildkit:buildx-stable-1"},
+		{"cache-from carries the configured ref", fields, "--cache-from", "ref=example.invalid/demo:buildcache,type=registry"},
+		{"cache-to carries the configured ref and mode=max", fields, "--cache-to", "mode=max,ref=example.invalid/demo:buildcache,type=registry"},
+	}
+	for _, tc := range flagValueCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assertFlagValue(t, tc.fields, tc.flag, tc.want)
+		})
+	}
+	assert.Contains(t, createFields, "atmos-native-ci", "builder create must use the configured driver name")
+
+	// The exact bug report's symptom: Atmos must not fall back to a bare,
+	// unconfigured `docker build -f Dockerfile .`.
+	for _, line := range lines {
+		assert.NotEqual(t, "build\t-f\tDockerfile\t.", line,
+			"must not silently fall back to a bare, unconfigured docker build")
+	}
+}
+
+// assertFlagValue asserts fields contains flag immediately followed by want,
+// so a flag's actual configured value is checked rather than merely its
+// presence somewhere in the argv.
+func assertFlagValue(t *testing.T, fields []string, flag, want string) {
+	t.Helper()
+
+	for i, field := range fields {
+		if field == flag {
+			if i+1 >= len(fields) {
+				t.Errorf("flag %q has no following value in %v", flag, fields)
+				return
+			}
+			assert.Equal(t, want, fields[i+1], "%s value", flag)
+			return
+		}
+	}
+	t.Errorf("expected flag %q not found in %v", flag, fields)
+}