v1.223.1-rc.4

🚀 Enhancements

fix(steps): expose shell and atmos outputs to later steps Brian Ojeda (@sgtoj) (#2785)

## what

• Capture successful output from named shell and atmos steps in custom
  commands and workflows.
• Expose trimmed .value, masked stdout/stderr/exit-code metadata, and declared
  outputs through .steps.<name>.
• Evaluate declared outputs once after successful command execution, outside the
  retry envelope.
• Support host execution, persistent workflow containers, and per-step container
  overrides.
• Preserve legacy runners, retries, live streaming, custom-command shell and
  atmos output: none, terminal sessions, process cleanup, and failure
  propagation.
• Document command-result behavior and correct the interactive-session capture
  guidance.
• Add regression coverage for markdown consumers, retries, masking, suppression,
  terminal sessions, output-template failures, and container execution.

why

• Legacy shell and atmos execution bypassed StepExecutor result storage.
• Later steps therefore failed with map has no entry for key "<name>", even
  after the producer completed successfully.
• Retaining the legacy execution paths avoids known Windows regressions and
  child-process cleanup issues while satisfying the documented step-output
  contract.
• Captured values are masked before entering template context so later rendering
  cannot expose registered secrets.
• Keeping output evaluation outside retries prevents a template error from
  repeating a successful, potentially non-idempotent command.

validation

• Audited against the step-output and shell/atmos command-step PRDs.
• Patch-scoped coverage reported no uncovered added behavior.
• Passed complete tests for ./cmd, ./internal/exec, ./pkg/runner/step, and
  ./pkg/workflow.
• Passed focused race tests with shuffled ordering.
• Verified masking and output: none behavior for custom-command shell and
  atmos steps.
• Passed go build ./....
• Passed patch-scoped lint against upstream/main.
• Built the Docusaurus website successfully.
• Re-ran the original custom-command and workflow reproductions successfully.
• Full-repository test wrappers reached and passed every touched package;
  unrelated AWS/XDG assertions and an acceptance-test timeout caused the overall
  local run to remain nonzero.

references

• Closes #2781
• Step outputs documentation
• Step-output PRD
• shell and atmos step-type PRD

Summary by CodeRabbit

• New Features
  • Step output capture for shell and atmos is now consistent across local and container execution, including retries and named declared outputs (value, stdout, stderr, exit code).
  • Secret masking is applied to both live output and stored step metadata.
• Bug Fixes
  • output: none now suppresses streamed output while preserving stored results for downstream steps.
  • Output-template evaluation failures no longer cause retries and prevent storing a step result.
  • Retry behavior now ensures only the final successful attempt’s stored outputs are used.
  • Interactive/TTY sessions still attach directly to the terminal and remain non-capturable.
• Documentation
  • Updated workflow step output documentation and added a fix note for command output availability.

fix(auth): normalize component default markers Erik Osterman (Cloud Posse) (@osterman) (#2777)

## what

• Normalize component auth default-only identity markers before merging with active global/profile auth.
• Ignore undefined default: false markers and reject undefined default: true markers with a targeted configuration error.
• Add regression coverage plus the Default Auth Behavior PRD and fix log.

why

• Prevent a harmless false-only marker from becoming an incomplete runtime identity that fails authentication initialization.
• Preserve real component identity definitions and deterministic default selection.

references

• Default Auth Behavior PRD
• Component Auth Default-Only Markers fix log

Summary by CodeRabbit

• Bug Fixes

  • Improved component authentication configuration merging for identity default markers.
  • Prevented undefined default: false markers from creating invalid identities or causing initialization failures.
  • Added validation for undefined default: true markers with clearer configuration errors.
  • Preserved existing behavior for complete identity declarations and valid global identities.
  • Ensured invalid configurations do not modify existing global authentication settings.

• Documentation

  • Added guidance covering default-marker behavior, validation rules, and expected configuration outcomes.

Prevent sensitive YAML function value leaks Erik Osterman (Cloud Posse) (@osterman) (#2783)

## what

• Keep Terraform-declared sensitive inputs out of generated JSON varfiles and pass them through TF_VAR_* during execution.
• Block degraded (computed) values from Terraform handoff paths and add function-aware debug logging for graceful YAML-function degradation.
• Add a generic producer/consumer regression fixture covering explicit-tag preservation, resolved state values, and JSON/environment transport.

why

• A resolved value from a sensitive YAML function could bypass masker-derived detection, be written to a varfile, or be transported as lookup arguments instead of the resolved value.

references

• N/A

Summary by CodeRabbit

• Security
  • Terraform inputs marked sensitive = true are excluded from generated *.terraform.tfvars.json when masking is enabled, including --with-secrets.
  • Their resolved values are passed to Terraform via TF_VAR_<name> environment variables (not written to disk).
  • Masking-disabled behavior preserves prior JSON compatibility.
• Bug Fixes
  • Execution, shell setup, and varfile generation now reject unresolved “(computed)” Terraform values before handoff (including nested maps/slices).
  • Sensitive root-module handling is improved using module metadata.
• Diagnostics
  • Added debug logging for recoverable YAML function parsing errors with function name and context.
• Tests
  • Added regression tests plus a new sensitive-state fixture covering explicit YAML tags and non-leakage.

fix(yaml): accept non-whitespace boundaries after YAML function tags zack-is-cool (#2779)

## what

• matchesTag in internal/exec/yaml_func_utils.go now accepts any character that can't extend a tag name (not just whitespace) as a valid boundary after a YAML function tag.

why

• Regression introduced in the unsupported-YAML-tag validation work (#1515): matchesTag only treated space/tab/newline as a valid separator after a tag name.
• When Go template rendering trims the separating whitespace (e.g. a {{- trim marker eating the newline after !template), the rendered value becomes !template["one","two"] with no separator. The tag no longer matched and the value silently fell through as a literal string instead of being decoded, breaking !template (and any other YAML function hitting the same boundary) for anyone whose templates produce output flush against the tag.

references

• Closes #2778

Summary by CodeRabbit

• Bug Fixes
  • Improved YAML !template tag recognition when the tag is directly adjacent to its content (no whitespace separator).
  • Prevented incorrect tag matches by tightening boundary detection, including correct behavior around punctuation.
• Tests
  • Added unit coverage for !template handling with no-separator formats (e.g., inline array/object forms) and for positive/negative tag matching cases.