fix(workdir): sanitize nested component names in BuildPath

A component name containing "/" (e.g. a nested layout like ecs/cluster)
made workdir.BuildPath produce a real extra subdirectory instead of a
single path segment, since the name was interpolated into "<stack>-<name>"
without escaping and then filepath.Join'd. That put the nested component's
workdir one level deeper than a flat component's at the same stack.

Any path computed relative to the workdir -- most visibly a relative
`backend.local.path` template like `../../../.context/tfstate/...` --
therefore climbed to a different real ancestor for the nested component
than for the flat one, silently writing state under a different root
(<repo>/.workdir/.context/... instead of <repo>/.context/...) even though
both components used the identical backend config.

Sanitize the component name the same way internal/exec/terraform_generate_
backends.go already does for backend template context: replace "/" with
"-" before building the workdir directory name. BuildPath is the single
formula reused by the source provisioner and by internal/terraform_backend's
JIT-workdir state lookup, so both pick up the fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: osterman

internal/terraform_backend/terraform_backend_local_test.go

@@ -309,11 +309,15 @@ func TestReadTerraformBackendLocal_JITWorkdir(t *testing.T) {
 		}
 	}`
 
-	t.Run("state exists, no _workdir_path (describe path — provisioner not yet run)", func(t *testing.T) {
+	// assertJITStateFound places stateJSON at
+	// tempDir/.workdir/terraform/<workdirName>/terraform.tfstate.d/demo/terraform.tfstate
+	// (the BuildPath formula for stack "demo"), then asserts
+	// ReadTerraformBackendLocal finds it for a component whose
+	// atmos_component/component is componentName.
+	assertJITStateFound := func(t *testing.T, workdirName, componentName string) {
+		t.Helper()
 		tempDir := t.TempDir()
-		// BuildPath("tempDir", "terraform", "null-label", "demo", sections) → tempDir/.workdir/terraform/demo-null-label.
-		// workspace "demo" → terraform.tfstate.d/demo/terraform.tfstate.
-		stateDir := filepath.Join(tempDir, ".workdir", "terraform", "demo-null-label", "terraform.tfstate.d", "demo")
+		stateDir := filepath.Join(tempDir, ".workdir", "terraform", workdirName, "terraform.tfstate.d", "demo")
 		require.NoError(t, os.MkdirAll(stateDir, 0o755))
 		require.NoError(t, os.WriteFile(filepath.Join(stateDir, "terraform.tfstate"), []byte(stateJSON), 0o644))
 
@@ -326,18 +330,33 @@ func TestReadTerraformBackendLocal_JITWorkdir(t *testing.T) {
 				"workdir": map[string]any{"enabled": true},
 			},
 			"atmos_stack":     "demo",
-			"atmos_component": "null-label",
-			"component":       "null-label", // base component (metadata.component); also used by static fallback.
+			"atmos_component": componentName,
+			"component":       componentName, // base component (metadata.component); also used by static fallback.
 			"workspace":       "demo",
 		}
 
 		content, err := tb.ReadTerraformBackendLocal(config, &sections, nil)
 		require.NoError(t, err)
-		require.NotNil(t, content, "expected state file to be found at JIT workdir path")
+		require.NotNil(t, content, "expected state file to be found at the JIT workdir path")
 
 		result, err := tb.ProcessTerraformStateFile(content)
 		require.NoError(t, err)
 		assert.Equal(t, "eg-test-demo", result["id"])
+	}
+
+	t.Run("state exists, no _workdir_path (describe path — provisioner not yet run)", func(t *testing.T) {
+		// BuildPath("tempDir", "terraform", "null-label", "demo", sections) → tempDir/.workdir/terraform/demo-null-label.
+		assertJITStateFound(t, "demo-null-label", "null-label")
+	})
+
+	t.Run("nested component name does not shift the workdir root", func(t *testing.T) {
+		// BuildPath must sanitize "/" in the component name to a single path
+		// segment (demo-ecs-cluster), not a real subdirectory (demo-ecs/cluster)
+		// -- otherwise this nested component's workdir sits one level deeper
+		// than a flat component's at the same stack, and any path computed
+		// relative to it (e.g. a relative local backend path) silently climbs
+		// to a different ancestor.
+		assertJITStateFound(t, "demo-ecs-cluster", "ecs/cluster")
 	})
 
 	t.Run("_workdir_path set (apply path — provisioner already ran)", func(t *testing.T) {

pkg/provisioner/workdir/types.go

@@ -3,6 +3,7 @@ package workdir
 import (
 	"fmt"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/cloudposse/atmos/pkg/perf"
@@ -137,6 +138,17 @@ func BuildPath(basePath, componentType, component, stack string, componentConfig
 		workdirComponent = atmosComponent
 	}
 
+	// A nested component name (e.g. "ecs/cluster") must not add an extra path
+	// segment: filepath.Join would otherwise turn it into a real subdirectory,
+	// making the workdir one level deeper than a flat component's at the same
+	// stack. That silently changes how many ".." a relative backend path (or
+	// any other path computed relative to the workdir) needs to reach the
+	// same ancestor, so equivalent components would write state under
+	// different roots solely because one component name contains "/". Mirror
+	// the same sanitization already used for backend template context (see
+	// internal/exec/terraform_generate_backends.go).
+	workdirComponent = strings.ReplaceAll(workdirComponent, "/", "-")
+
 	workdirName := fmt.Sprintf("%s-%s", stack, workdirComponent)
 	return filepath.Join(basePath, WorkdirPath, componentType, workdirName)
 }

pkg/provisioner/workdir/types_test.go

@@ -73,6 +73,33 @@ func TestBuildPath(t *testing.T) {
 			componentConfig: nil,
 			want:            []string{"helmfile", "prod-app"},
 		},
+		{
+			// A nested component name (containing "/", e.g. an ecs/cluster
+			// directory layout) must sanitize to a single path segment, not
+			// add an extra directory level. Otherwise a relative backend
+			// path template like `../../../` climbs a different number of
+			// real ancestors for a nested component than for a flat one at
+			// the same stack, silently writing state under a different root
+			// (see docs/fixes for the regression this guards).
+			name:            "nested component name does not add a path segment",
+			basePath:        "/base",
+			componentType:   "terraform",
+			component:       "ecs/cluster",
+			stack:           "fixtures",
+			componentConfig: map[string]any{},
+			want:            []string{"terraform", "fixtures-ecs-cluster"},
+		},
+		{
+			name:          "nested atmos_component instance name does not add a path segment",
+			basePath:      "/base",
+			componentType: "terraform",
+			component:     "ecs/cluster",
+			stack:         "fixtures",
+			componentConfig: map[string]any{
+				"atmos_component": "ecs/cluster-inherited-instance",
+			},
+			want: []string{"terraform", "fixtures-ecs-cluster-inherited-instance"},
+		},
 	}
 
 	for _, tt := range tests {