fix(terraform): suppress concurrent lifecycle output

Author: zack-is-cool

docs/fixes/2026-08-06-jit-output-suppression.md

@@ -0,0 +1,33 @@
+# Fix: Suppress JIT provisioning output during concurrent Terraform runs
+
+**Date:** 2026-08-06
+
+## Summary
+
+Concurrent Terraform runs now suppress transient provisioner and step-hook UI, preventing spinner and line-clear control sequences from corrupting prefixed component output.
+
+## Context
+
+PR #2860 normalized child-process carriage returns and suppressed provisioner UI for Terraform output lookups. Normal scheduled Terraform execution marked its scheduler context as output-suppressed, but initial component resolution, `prepareInitExecution`, and post-init provisioners could lose that context. Backend provisioning and step hooks also retained global spinner and terminal-line UI paths while component output was streaming concurrently.
+
+## Changes
+
+- `pkg/scheduler/adapters/terraform.go`: mark the scheduler context as output-suppressed whenever Terraform concurrency exceeds one.
+- `internal/exec/`: preserve the process context through JIT component resolution and Terraform init preparation so source and workdir provisioners receive the suppression marker.
+- `pkg/provisioner/`: share the suppression marker across backend, source, and workdir provisioners; backend creation now runs without spinner/warning UI when concurrent.
+- `pkg/hooks/` and `pkg/runner/step/`: suppress `clear` and `spin` terminal UI for hooks that receive scheduler node writers.
+- `internal/exec/terraform_execute_helpers.go`: forward process context and writers to post-init provider-lock provisioners.
+- `pkg/scheduler/adapters/terraform_test.go`: verify concurrent nodes receive suppression and sequential nodes do not.
+- `internal/exec/terraform_execute_helpers_test.go`: verify JIT and pre-init provisioners receive output suppression.
+- `pkg/hooks/step_engine_test.go`: verify step hooks suppress transient UI when node writers are active.
+
+## Validation
+
+- Focused scheduler, hooks, runner-step, provisioner, and source/workdir provisioner tests passed.
+- Focused explicit-init dispatch tests passed; the full `internal/exec` suite exceeded five minutes.
+- `go build ./...` passed.
+- `atmos lint --changed` passed.
+
+## Follow-ups
+
+None.

internal/exec/shell_utils.go

@@ -91,6 +91,17 @@ func WithProcessContext(ctx context.Context) ShellCommandOption {
 	}
 }
 
+func shellCommandContext(opts ...ShellCommandOption) context.Context {
+	var cfg shellCommandConfig
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+	if cfg.ctx == nil {
+		return context.Background()
+	}
+	return cfg.ctx
+}
+
 // WithEnvironment provides a pre-sanitized process environment for subprocess execution.
 // When provided, ExecuteShellCommand uses this instead of re-reading os.Environ().
 // Pass nil to fall back to the default os.Environ() behavior.

internal/exec/terraform.go

@@ -157,7 +157,7 @@ func ExecuteTerraform(info schema.ConfigAndStacksInfo, opts ...ShellCommandOptio
 	}
 
 	// Resolve paths, install toolchain, write varfiles, validate, run hooks, and build env.
-	execCtx, err := prepareComponentExecution(&atmosConfig, &info, shouldProcess)
+	execCtx, err := prepareComponentExecution(shellCommandContext(opts...), &atmosConfig, &info, shouldProcess)
 	if err != nil {
 		return err
 	}

internal/exec/terraform_execute_helpers.go

@@ -236,7 +236,13 @@ func SetupComponentAuthForCLI(atmosConfig *schema.AtmosConfiguration, info *sche
 // resolveAndProvisionComponentPath resolves the filesystem path for a terraform component,
 // optionally auto-generates files, performs JIT source provisioning, and validates
 // that the resulting directory actually exists.
-func resolveAndProvisionComponentPath(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo) (string, error) {
+// The provision-and-resolve component function is a seam for testing JIT provisioning context propagation.
+var provisionAndResolveTerraformComponentPath = component.ProvisionAndResolveComponentPath
+
+// The before-init provisioner function is a seam for testing context propagation.
+var executeBeforeInitProvisioners = provisioner.ExecuteProvisioners
+
+func resolveAndProvisionComponentPath(ctx context.Context, atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo) (string, error) {
 	componentPath, err := u.GetComponentPath(atmosConfig, "terraform", info.ComponentFolderPrefix, info.FinalComponent)
 	if err != nil {
 		return "", fmt.Errorf("failed to resolve component path: %w", err)
@@ -245,9 +251,12 @@ func resolveAndProvisionComponentPath(atmosConfig *schema.AtmosConfiguration, in
 	// Provision source before generating files: when provision.workdir.enabled
 	// is true the resolved path is the workdir, and generated files must land
 	// there rather than in the base component directory.
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Minute)
 	defer cancel()
-	componentPath, componentPathExists, err := component.ProvisionAndResolveComponentPath(
+	componentPath, componentPathExists, err := provisionAndResolveTerraformComponentPath(
 		ctx, atmosConfig, info, cfg.TerraformComponentType, componentPath,
 	)
 	if err != nil {
@@ -891,17 +900,20 @@ func buildInitArgs(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAn
 // directories (terraform.tfstate.d/) but no .terraform/environment file and interprets the
 // situation as a backend migration, producing the "Do you want to migrate all workspaces?"
 // prompt on every apply.  Skipping the cleanup for workdir components avoids this.
-func prepareInitExecution(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string) (string, error) {
+func prepareInitExecution(ctx context.Context, atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string) (string, error) {
 	_, isWorkdir := info.ComponentSection[provWorkdir.WorkdirPathKey].(string)
 	if !isWorkdir {
 		cleanTerraformWorkspace(*atmosConfig, componentPath)
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	provisionCtx, cancel := context.WithTimeout(ctx, 5*time.Minute)
 	defer cancel()
 
-	if err := provisioner.ExecuteProvisioners(
-		ctx,
+	if err := executeBeforeInitProvisioners(
+		provisionCtx,
 		provisioner.HookEvent(beforeTerraformInitEvent),
 		atmosConfig,
 		info.ComponentSection,
@@ -928,7 +940,7 @@ func prepareInitExecution(atmosConfig *schema.AtmosConfiguration, info *schema.C
 // invocation via prepareInitExecution.  These two code paths must never both execute
 // in the same command invocation or provisioners will run twice.
 func executeTerraformInitPhase(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath, varFile string, opts ...ShellCommandOption) (string, error) {
-	newPath, err := prepareInitExecution(atmosConfig, info, componentPath)
+	newPath, err := prepareInitExecution(shellCommandContext(opts...), atmosConfig, info, componentPath)
 	if err != nil {
 		return componentPath, err
 	}
@@ -970,7 +982,7 @@ func executeTerraformInitCommand(atmosConfig *schema.AtmosConfiguration, info *s
 		return err
 	}
 
-	dispatchAfterInit(atmosConfig, info, componentPath)
+	dispatchAfterInit(atmosConfig, info, componentPath, opts...)
 
 	return nil
 }
@@ -981,7 +993,7 @@ func executeTerraformInitCommand(atmosConfig *schema.AtmosConfiguration, info *s
 // and working directory as init, so a `providers lock` runs against the already-warm cache.
 // Lock completion is best-effort: a failure is logged, not propagated, so it never fails the
 // user's plan/apply.
-func dispatchAfterInit(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string) {
+func dispatchAfterInit(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string, opts ...ShellCommandOption) {
 	execCtx := &provisioner.TerraformExecContext{
 		WorkingDir: componentPath,
 		Run: func(args []string) error {
@@ -993,11 +1005,12 @@ func dispatchAfterInit(atmosConfig *schema.AtmosConfiguration, info *schema.Conf
 				info.ComponentEnvList,
 				info.DryRun,
 				info.RedirectStdErr,
+				opts...,
 			)
 		},
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	ctx, cancel := context.WithTimeout(shellCommandContext(opts...), 5*time.Minute)
 	defer cancel()
 
 	if err := provisioner.ExecuteProvisioners(

internal/exec/terraform_execute_helpers_args.go

@@ -89,8 +89,9 @@ func buildInitSubcommandArgs(
 	allArgsAndFlags []string,
 	varFile string,
 	componentPath *string,
+	opts ...ShellCommandOption,
 ) ([]string, error) {
-	newPath, provErr := prepareInitExecution(atmosConfig, info, *componentPath)
+	newPath, provErr := prepareInitExecution(shellCommandContext(opts...), atmosConfig, info, *componentPath)
 	if provErr != nil {
 		return nil, provErr
 	}
@@ -135,6 +136,7 @@ func buildTerraformCommandArgs(
 	info *schema.ConfigAndStacksInfo,
 	varFile, planFile string,
 	componentPath *string,
+	opts ...ShellCommandOption,
 ) (allArgsAndFlags []string, uploadStatusFlag bool, err error) {
 	allArgsAndFlags = strings.Fields(info.SubCommand)
 
@@ -157,7 +159,7 @@ func buildTerraformCommandArgs(
 		allArgsAndFlags = buildApplySubcommandArgs(info, allArgsAndFlags, varFile)
 
 	case subcommandInit:
-		allArgsAndFlags, err = buildInitSubcommandArgs(atmosConfig, info, allArgsAndFlags, varFile, componentPath)
+		allArgsAndFlags, err = buildInitSubcommandArgs(atmosConfig, info, allArgsAndFlags, varFile, componentPath, opts...)
 		if err != nil {
 			return nil, false, err
 		}

internal/exec/terraform_execute_helpers_coverage_test.go

@@ -372,7 +372,7 @@ func TestPrepareInitExecution_WorkdirPath_ReturnsWorkdir(t *testing.T) {
 		},
 	}
 
-	result, err := prepareInitExecution(&atmosConfig, &info, tmpDir)
+	result, err := prepareInitExecution(t.Context(), &atmosConfig, &info, tmpDir)
 	require.NoError(t, err)
 	assert.Equal(t, customWorkdir, result)
 }
@@ -386,7 +386,7 @@ func TestPrepareInitExecution_NoWorkdirPath_ReturnsOriginalPath(t *testing.T) {
 		ComponentSection: map[string]any{},
 	}
 
-	result, err := prepareInitExecution(&atmosConfig, &info, tmpDir)
+	result, err := prepareInitExecution(t.Context(), &atmosConfig, &info, tmpDir)
 	require.NoError(t, err)
 	assert.Equal(t, tmpDir, result)
 }
@@ -402,7 +402,7 @@ func TestPrepareInitExecution_EmptyWorkdirPath_ReturnsOriginalPath(t *testing.T)
 		},
 	}
 
-	result, err := prepareInitExecution(&atmosConfig, &info, tmpDir)
+	result, err := prepareInitExecution(t.Context(), &atmosConfig, &info, tmpDir)
 	require.NoError(t, err)
 	assert.Equal(t, tmpDir, result)
 }

internal/exec/terraform_execute_helpers_exec.go

@@ -45,6 +45,7 @@ type componentExecContext struct {
 // OPA/JSON-schema validation, auth pre-hook, config file generation, and env assembly.
 // Extracting this reduces ExecuteTerraform's cyclomatic complexity by ~10 decision points.
 func prepareComponentExecution(
+	ctx context.Context,
 	atmosConfig *schema.AtmosConfiguration,
 	info *schema.ConfigAndStacksInfo,
 	shouldProcess bool,
@@ -53,7 +54,7 @@ func prepareComponentExecution(
 		return nil, err
 	}
 
-	componentPath, err := resolveAndProvisionComponentPath(atmosConfig, info)
+	componentPath, err := resolveAndProvisionComponentPath(ctx, atmosConfig, info)
 	if err != nil {
 		return nil, err
 	}
@@ -185,7 +186,7 @@ func executeCommandPipeline(
 	logTerraformContext(info, execCtx.workingDir)
 	addTerraformTestVarfileArg(info, execCtx.testVarFile)
 
-	allArgsAndFlags, uploadStatusFlag, err := buildTerraformCommandArgs(atmosConfig, info, execCtx.varFile, execCtx.planFile, &componentPath)
+	allArgsAndFlags, uploadStatusFlag, err := buildTerraformCommandArgs(atmosConfig, info, execCtx.varFile, execCtx.planFile, &componentPath, opts...)
 	if err != nil {
 		return err
 	}

internal/exec/terraform_execute_helpers_pipeline_test.go

@@ -84,7 +84,7 @@ func TestPrepareComponentExecution_NoComponentPath_ReturnsError(t *testing.T) {
 	// BasePath is empty → GetComponentPath returns an error.
 	info := schema.ConfigAndStacksInfo{}
 
-	_, err := prepareComponentExecution(&atmosConfig, &info, false)
+	_, err := prepareComponentExecution(t.Context(), &atmosConfig, &info, false)
 	// An empty BasePath causes checkTerraformConfig to return an error.
 	require.Error(t, err)
 }

internal/exec/terraform_execute_helpers_test.go

@@ -1,12 +1,14 @@
 package exec
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
 	osexec "os/exec"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"testing"
 
 	"github.com/hashicorp/terraform-config-inspect/tfconfig"
@@ -17,6 +19,7 @@ import (
 	cfg "github.com/cloudposse/atmos/pkg/config"
 	"github.com/cloudposse/atmos/pkg/degradation"
 	atmosio "github.com/cloudposse/atmos/pkg/io"
+	"github.com/cloudposse/atmos/pkg/provisioner"
 	provWorkdir "github.com/cloudposse/atmos/pkg/provisioner/workdir"
 	"github.com/cloudposse/atmos/pkg/schema"
 	u "github.com/cloudposse/atmos/pkg/utils"
@@ -423,7 +426,7 @@ func TestPrepareInitExecution_SkipsCleanWorkspaceForWorkdir(t *testing.T) {
 		},
 	}
 
-	_, err := prepareInitExecution(&atmosConfig, &info, tmpDir)
+	_, err := prepareInitExecution(t.Context(), &atmosConfig, &info, tmpDir)
 	require.NoError(t, err)
 
 	_, statErr := os.Stat(envFile)
@@ -444,13 +447,48 @@ func TestPrepareInitExecution_CleansWorkspaceForNonWorkdir(t *testing.T) {
 		ComponentSection: map[string]any{}, // no WorkdirPathKey
 	}
 
-	_, err := prepareInitExecution(&atmosConfig, &info, tmpDir)
+	_, err := prepareInitExecution(t.Context(), &atmosConfig, &info, tmpDir)
 	require.NoError(t, err)
 
 	_, statErr := os.Stat(envFile)
 	assert.True(t, os.IsNotExist(statErr), ".terraform/environment must be deleted for non-workdir components")
 }
 
+func TestPrepareInitExecutionPropagatesOutputSuppression(t *testing.T) {
+	originalExecuteProvisioners := executeBeforeInitProvisioners
+	t.Cleanup(func() { executeBeforeInitProvisioners = originalExecuteProvisioners })
+	var observedSuppression atomic.Bool
+	executeBeforeInitProvisioners = func(ctx context.Context, _ provisioner.HookEvent, _ *schema.AtmosConfiguration, _ map[string]any, _ *schema.AuthContext, _ ...*provisioner.TerraformExecContext) error {
+		observedSuppression.Store(provWorkdir.OutputSuppressed(ctx))
+		return nil
+	}
+
+	atmosConfig := schema.AtmosConfiguration{}
+	info := schema.ConfigAndStacksInfo{ComponentSection: map[string]any{}}
+
+	_, err := prepareInitExecution(provWorkdir.WithOutputSuppressed(t.Context()), &atmosConfig, &info, t.TempDir())
+	require.NoError(t, err)
+	require.True(t, observedSuppression.Load())
+}
+
+func TestResolveAndProvisionComponentPathPropagatesOutputSuppression(t *testing.T) {
+	originalProvisioner := provisionAndResolveTerraformComponentPath
+	t.Cleanup(func() { provisionAndResolveTerraformComponentPath = originalProvisioner })
+
+	var observedSuppression atomic.Bool
+	provisionAndResolveTerraformComponentPath = func(ctx context.Context, _ *schema.AtmosConfiguration, _ *schema.ConfigAndStacksInfo, _ string, componentPath string) (string, bool, error) {
+		observedSuppression.Store(provWorkdir.OutputSuppressed(ctx))
+		return componentPath, true, nil
+	}
+
+	atmosConfig := schema.AtmosConfiguration{BasePath: t.TempDir()}
+	info := schema.ConfigAndStacksInfo{FinalComponent: "component"}
+
+	_, err := resolveAndProvisionComponentPath(provWorkdir.WithOutputSuppressed(t.Context()), &atmosConfig, &info)
+	require.NoError(t, err)
+	require.True(t, observedSuppression.Load())
+}
+
 // ──────────────────────────────────────────────────────────────────────────────
 // handleDeploySubcommand
 // ──────────────────────────────────────────────────────────────────────────────

internal/exec/terraform_execute_helpers_workspace_test.go

@@ -223,7 +223,7 @@ func TestExecuteMainTerraformCommand_ExplicitInitDispatchesAfterInit(t *testing.
 	t.Cleanup(func() { dispatchAfterInitFn = originalDispatch })
 
 	var dispatched bool
-	dispatchAfterInitFn = func(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string) {
+	dispatchAfterInitFn = func(atmosConfig *schema.AtmosConfiguration, info *schema.ConfigAndStacksInfo, componentPath string, _ ...ShellCommandOption) {
 		dispatched = true
 		assert.Equal(t, "/tmp/component", componentPath)
 		assert.Equal(t, subcommandInit, info.SubCommand)
@@ -239,7 +239,7 @@ func TestExecuteMainTerraformCommand_FailedExplicitInitSkipsAfterInit(t *testing
 	originalDispatch := dispatchAfterInitFn
 	t.Cleanup(func() { dispatchAfterInitFn = originalDispatch })
 
-	dispatchAfterInitFn = func(*schema.AtmosConfiguration, *schema.ConfigAndStacksInfo, string) {
+	dispatchAfterInitFn = func(*schema.AtmosConfiguration, *schema.ConfigAndStacksInfo, string, ...ShellCommandOption) {
 		t.Fatal("failed init must not dispatch after.terraform.init provisioners")
 	}