fix(steps): resolve relative paths against step.WorkingDirectory

The archive, file, workdir, junit, and container build step handlers
resolved relative source/destination/path/glob/context fields via
template substitution only, then let filesystem calls resolve them
against the Atmos process's own cwd instead of step.WorkingDirectory.
This surfaced most visibly for `type: archive` hooks, since the hooks
engine correctly defaults working_directory to the component path but
the handler never read it back.

Add a shared BaseHandler.ResolveInWorkingDirectory helper that anchors
a relative resolved value to step.WorkingDirectory (falling back to
process cwd when unset, matching prior behavior), and apply it across
the five affected handlers. container_build.go additionally anchors
Dockerfile to the resolved Context rather than WorkingDirectory
directly, matching Docker's own convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: osterman

pkg/hooks/step_engine_test.go

@@ -1031,6 +1031,43 @@ func TestStepEngineRunsArchiveType(t *testing.T) {
 	assert.Equal(t, "handler.js", r.File[0].Name)
 }
 
+// TestStepEngineRunsArchiveTypeWithRelativeWorkingDirectory reproduces the
+// originally-reported regression: a `type: archive` hook step with relative
+// source/destination must resolve them against step.WorkingDirectory (either
+// explicitly set here, or defaulted by setDefaultStepWorkingDirectory to the
+// resolved component path), not against the Atmos process's own cwd.
+func TestStepEngineRunsArchiveTypeWithRelativeWorkingDirectory(t *testing.T) {
+	workDir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, "src"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(workDir, "src", "handler.js"), []byte("exports.handler = 1;"), 0o644))
+
+	// Process cwd differs from working_directory — this is the crux of the bug.
+	t.Chdir(t.TempDir())
+
+	hook := &Hook{
+		Kind: stepKindName,
+		Type: "archive",
+		With: map[string]any{
+			"source":            "src",
+			"destination":       "out/handler.zip",
+			"working_directory": workDir,
+		},
+	}
+
+	out, err := stepEngine{}.Run(stepExecContext(hook))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Summary)
+	assert.Equal(t, StatusSuccess, out.Summary.Status)
+
+	wantDest := filepath.Join(workDir, "out", "handler.zip")
+	r, err := zip.OpenReader(wantDest)
+	require.NoError(t, err)
+	defer r.Close()
+	require.Len(t, r.File, 1)
+	assert.Equal(t, "handler.js", r.File[0].Name)
+}
+
 func TestVerifyStepsHookTypes(t *testing.T) {
 	t.Run("known types", func(t *testing.T) {
 		hook := &Hook{

pkg/runner/step/archive.go

@@ -70,7 +70,7 @@ func (h *ArchiveHandler) Validate(step *schema.WorkflowStep) error {
 func (h *ArchiveHandler) Execute(ctx context.Context, step *schema.WorkflowStep, vars *Variables) (*StepResult, error) {
 	defer perf.Track(nil, "step.ArchiveHandler.Execute")()
 
-	opts, action, err := resolveArchiveOptions(step, vars)
+	opts, action, err := h.resolveArchiveOptions(step, vars)
 	if err != nil {
 		return nil, err
 	}
@@ -85,19 +85,19 @@ func (h *ArchiveHandler) Execute(ctx context.Context, step *schema.WorkflowStep,
 		WithMetadata("source", opts.Source), nil
 }
 
-func resolveArchiveOptions(step *schema.WorkflowStep, vars *Variables) (archive.PackOptions, archive.Action, error) {
+func (h *ArchiveHandler) resolveArchiveOptions(step *schema.WorkflowStep, vars *Variables) (archive.PackOptions, archive.Action, error) {
 	source, err := archiveSourceString(step)
 	if err != nil {
 		return archive.PackOptions{}, "", err
 	}
-	source, err = vars.Resolve(source)
+	source, err = h.ResolveInWorkingDirectory(step, vars, source, "source")
 	if err != nil {
-		return archive.PackOptions{}, "", fmt.Errorf("step '%s': failed to resolve source: %w", step.Name, err)
+		return archive.PackOptions{}, "", err
 	}
 
-	destination, err := vars.Resolve(step.Destination)
+	destination, err := h.ResolveInWorkingDirectory(step, vars, step.Destination, "destination")
 	if err != nil {
-		return archive.PackOptions{}, "", fmt.Errorf("step '%s': failed to resolve destination: %w", step.Name, err)
+		return archive.PackOptions{}, "", err
 	}
 	format, err := vars.Resolve(step.Format)
 	if err != nil {

pkg/runner/step/archive_test.go

@@ -107,6 +107,44 @@ func TestArchiveHandler_Execute(t *testing.T) {
 	assert.Equal(t, "exports.handler = 1;", string(content))
 }
 
+// TestArchiveHandler_Execute_ResolvesRelativePathsAgainstWorkingDirectory
+// reproduces the reported regression: a relative source/destination must
+// resolve against step.WorkingDirectory, not the Atmos process's own cwd
+// (e.g. when the step runs as a component lifecycle hook).
+func TestArchiveHandler_Execute_ResolvesRelativePathsAgainstWorkingDirectory(t *testing.T) {
+	workDir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(workDir, "src"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(workDir, "src", "handler.js"), []byte("exports.handler = 1;"), 0o644))
+
+	// Pin the process cwd to an unrelated scratch dir so this test actually
+	// distinguishes "resolved against WorkingDirectory" from "resolved
+	// against cwd" — the pre-fix behavior.
+	t.Chdir(t.TempDir())
+
+	handler := mustGetArchiveHandler(t)
+	step := &schema.WorkflowStep{
+		Name:             "pkg",
+		Type:             "archive",
+		Source:           "src",
+		Destination:      "out/handler.zip",
+		WorkingDirectory: workDir,
+	}
+	require.NoError(t, handler.Validate(step))
+
+	result, err := handler.Execute(context.Background(), step, NewVariables())
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	wantDest := filepath.Join(workDir, "out", "handler.zip")
+	assert.Equal(t, wantDest, result.Value)
+
+	r, err := zip.OpenReader(wantDest)
+	require.NoError(t, err)
+	defer r.Close()
+	require.Len(t, r.File, 1)
+	assert.Equal(t, "handler.js", r.File[0].Name)
+}
+
 func TestArchiveHandler_Execute_ResolvesTemplatedFields(t *testing.T) {
 	dir := t.TempDir()
 	src := filepath.Join(dir, "src")

pkg/runner/step/container_actions_extra_test.go

@@ -2,6 +2,7 @@ package step
 
 import (
 	"context"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -152,6 +153,44 @@ func TestBuildConfigResolutionErrors(t *testing.T) {
 	}
 }
 
+func TestBuildBuildConfigResolvesContextAndDockerfileAgainstWorkingDirectory(t *testing.T) {
+	h := &ContainerHandler{}
+	workDir := t.TempDir()
+
+	t.Run("relative context and dockerfile", func(t *testing.T) {
+		cfg, err := h.buildBuildConfig(&schema.WorkflowStep{
+			Name:             "build",
+			WorkingDirectory: workDir,
+			Build:            &schema.ContainerBuildStep{Context: "docker", Dockerfile: "Dockerfile.prod"},
+		}, NewVariables())
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(workDir, "docker"), cfg.Context)
+		assert.Equal(t, filepath.Join(workDir, "docker", "Dockerfile.prod"), cfg.Dockerfile)
+	})
+
+	t.Run("defaults: dockerfile lands inside context, not working directory directly", func(t *testing.T) {
+		cfg, err := h.buildBuildConfig(&schema.WorkflowStep{
+			Name:             "build",
+			WorkingDirectory: workDir,
+			Build:            &schema.ContainerBuildStep{Context: "docker"},
+		}, NewVariables())
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(workDir, "docker"), cfg.Context)
+		assert.Equal(t, filepath.Join(workDir, "docker", "Dockerfile"), cfg.Dockerfile)
+	})
+
+	t.Run("absolute dockerfile is not re-anchored to context", func(t *testing.T) {
+		absDockerfile := filepath.Join(t.TempDir(), "Dockerfile.custom")
+		cfg, err := h.buildBuildConfig(&schema.WorkflowStep{
+			Name:             "build",
+			WorkingDirectory: workDir,
+			Build:            &schema.ContainerBuildStep{Context: "docker", Dockerfile: absDockerfile},
+		}, NewVariables())
+		require.NoError(t, err)
+		assert.Equal(t, absDockerfile, cfg.Dockerfile)
+	})
+}
+
 func TestRunConfigResolutionErrors(t *testing.T) {
 	h := &ContainerHandler{}
 	vars := NewVariables()

pkg/runner/step/container_build.go

@@ -3,6 +3,7 @@ package step
 import (
 	"context"
 	"fmt"
+	"path/filepath"
 	"strings"
 
 	"github.com/cloudposse/atmos/pkg/container"
@@ -94,14 +95,17 @@ func buildSpinnerMessage(verb, image string) string {
 
 func (h *ContainerHandler) buildBuildConfig(step *schema.WorkflowStep, vars *Variables) (*container.BuildConfig, error) {
 	build := effectiveBuildStep(step)
-	contextDir, err := resolveOptional(vars, defaultString(build.Context, "."), "build.context", step.Name)
+	contextDir, err := h.ResolveInWorkingDirectory(step, vars, defaultString(build.Context, "."), "build.context")
 	if err != nil {
 		return nil, err
 	}
 	dockerfile, err := resolveOptional(vars, defaultString(build.Dockerfile, "Dockerfile"), "build.dockerfile", step.Name)
 	if err != nil {
 		return nil, err
 	}
+	if dockerfile != "" && !filepath.IsAbs(dockerfile) {
+		dockerfile = filepath.Join(contextDir, dockerfile)
+	}
 	target, err := resolveOptional(vars, build.Target, "build.target", step.Name)
 	if err != nil {
 		return nil, err

pkg/runner/step/container_runtime_fake_test.go

@@ -108,9 +108,12 @@ func TestContainerHandlerExecuteBuildPassesBuildxDriverAndCacheToDocker(t *testi
 	}, vars)
 	require.NoError(t, err)
 
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
 	args := fakeRuntimeArgs(t, argsPath)
 	assert.Contains(t, args, "buildx\tcreate\t--name\tatmos-test-builder\t--driver\tdocker-container\t--driver-opt\timage=mirror.gcr.io/moby/buildkit:buildx-stable-1")
-	assert.Contains(t, args, "buildx\tbuild\t--builder\tatmos-test-builder\t--cache-from\tref=registry.example.com/app:buildcache,type=registry\t--cache-to\tmode=max,ref=registry.example.com/app:buildcache,type=registry\t-t\tapp:local\t-f\tDockerfile\t.")
+	assert.Contains(t, args, "buildx\tbuild\t--builder\tatmos-test-builder\t--cache-from\tref=registry.example.com/app:buildcache,type=registry\t--cache-to\tmode=max,ref=registry.example.com/app:buildcache,type=registry\t-t\tapp:local\t-f\t"+filepath.Join(cwd, "Dockerfile")+"\t"+cwd)
 }
 
 func TestContainerHandlerExecutePushPassesResolvedTagsAndRuntimeEnvToDocker(t *testing.T) {

pkg/runner/step/container_test.go

@@ -149,9 +149,11 @@ func TestContainerHandlerActionBlocks(t *testing.T) {
 		},
 	}, vars)
 	require.NoError(t, err)
-	assert.Equal(t, ".", buildCfg.Context)
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+	assert.Equal(t, cwd, buildCfg.Context)
 	assert.Equal(t, "buildx", buildCfg.Engine)
-	assert.Equal(t, "Dockerfile", buildCfg.Dockerfile)
+	assert.Equal(t, filepath.Join(cwd, "Dockerfile"), buildCfg.Dockerfile)
 	assert.Equal(t, []string{"app:test"}, buildCfg.Tags)
 	assert.Equal(t, map[string]string{"VERSION": "1.0.0"}, buildCfg.Args)
 	assert.Equal(t, "runtime", buildCfg.Target)

pkg/runner/step/file.go

@@ -91,24 +91,14 @@ func (h *FileHandler) Execute(ctx context.Context, step *schema.WorkflowStep, va
 	return NewStepResult(fullPath), nil
 }
 
-// resolveStartPath resolves and validates the starting path for file scanning.
+// resolveStartPath resolves and validates the starting path for file scanning,
+// anchoring a relative path to step.WorkingDirectory.
 func (h *FileHandler) resolveStartPath(step *schema.WorkflowStep, vars *Variables) (string, error) {
 	startPath := step.Path
 	if startPath == "" {
 		startPath = "."
-	} else {
-		var err error
-		startPath, err = vars.Resolve(startPath)
-		if err != nil {
-			return "", fmt.Errorf("step '%s': failed to resolve path: %w", step.Name, err)
-		}
-	}
-
-	absPath, err := filepath.Abs(startPath)
-	if err != nil {
-		return "", fmt.Errorf("step '%s': failed to resolve path: %w", step.Name, err)
 	}
-	return absPath, nil
+	return h.ResolveInWorkingDirectory(step, vars, startPath, "path")
 }
 
 // collectFiles walks the directory and collects matching files.

pkg/runner/step/file_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	errUtils "github.com/cloudposse/atmos/errors"
 	"github.com/cloudposse/atmos/pkg/schema"
 )
 
@@ -70,7 +71,24 @@ func TestFileHandler_ResolveStartPath(t *testing.T) {
 
 		_, err := fileHandler.resolveStartPath(step, vars)
 		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "failed to resolve path")
+		assert.ErrorIs(t, err, errUtils.ErrTemplateEvaluation)
+	})
+
+	t.Run("relative path resolves against working directory, not cwd", func(t *testing.T) {
+		workDir := t.TempDir()
+		require.NoError(t, os.MkdirAll(filepath.Join(workDir, "sub"), 0o755))
+		t.Chdir(t.TempDir())
+
+		step := &schema.WorkflowStep{
+			Name:             "test",
+			Path:             "sub",
+			WorkingDirectory: workDir,
+		}
+		vars := NewVariables()
+
+		path, err := fileHandler.resolveStartPath(step, vars)
+		require.NoError(t, err)
+		assert.Equal(t, filepath.Join(workDir, "sub"), path)
 	})
 }
 

pkg/runner/step/handler_base.go

@@ -3,6 +3,8 @@ package step
 import (
 	"context"
 	"fmt"
+	"os"
+	"path/filepath"
 
 	errUtils "github.com/cloudposse/atmos/errors"
 	"github.com/cloudposse/atmos/pkg/perf"
@@ -194,3 +196,78 @@ func (h BaseHandler) ResolveCommand(ctx context.Context, step *schema.WorkflowSt
 	}
 	return resolved, nil
 }
+
+// ResolveInWorkingDirectory resolves a Go-template field, then anchors a
+// relative result to step.WorkingDirectory (itself template-resolved),
+// returning an absolute path. An empty raw value short-circuits to "" (no
+// resolve, no join) like the other Resolve* helpers. A value that resolves
+// to "" or to an already-absolute path passes through unchanged — it is
+// never re-anchored to WorkingDirectory.
+func (h BaseHandler) ResolveInWorkingDirectory(step *schema.WorkflowStep, vars *Variables, value, field string) (string, error) {
+	defer perf.Track(nil, "step.BaseHandler.ResolveInWorkingDirectory")()
+
+	if value == "" {
+		return "", nil
+	}
+	resolved, err := vars.Resolve(value)
+	if err != nil {
+		return "", errUtils.Build(errUtils.ErrTemplateEvaluation).
+			WithCause(err).
+			WithContext("step", step.Name).
+			WithContext("field", field).
+			Err()
+	}
+	if resolved == "" || filepath.IsAbs(resolved) {
+		return resolved, nil
+	}
+
+	workDir, err := h.resolveWorkingDirectory(step, vars)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(workDir, resolved), nil
+}
+
+// resolveWorkingDirectory resolves step.WorkingDirectory (itself a possible
+// template) to an absolute base directory, falling back to the process's
+// current working directory when unset — preserving the historical
+// filepath.Abs-against-cwd behavior for steps that never set
+// working_directory.
+func (h BaseHandler) resolveWorkingDirectory(step *schema.WorkflowStep, vars *Variables) (string, error) {
+	defer perf.Track(nil, "step.BaseHandler.resolveWorkingDirectory")()
+
+	workDir := step.WorkingDirectory
+	if workDir != "" {
+		resolved, err := vars.Resolve(workDir)
+		if err != nil {
+			return "", errUtils.Build(errUtils.ErrTemplateEvaluation).
+				WithCause(err).
+				WithContext("step", step.Name).
+				WithContext("field", "working_directory").
+				Err()
+		}
+		workDir = resolved
+	}
+	if workDir == "" {
+		cwd, err := os.Getwd()
+		if err != nil {
+			return "", errUtils.Build(errUtils.ErrPathResolution).
+				WithCause(err).
+				WithContext("step", step.Name).
+				Err()
+		}
+		workDir = cwd
+	}
+	if !filepath.IsAbs(workDir) {
+		abs, err := filepath.Abs(workDir)
+		if err != nil {
+			return "", errUtils.Build(errUtils.ErrPathResolution).
+				WithCause(err).
+				WithContext("step", step.Name).
+				WithContext("field", "working_directory").
+				Err()
+		}
+		workDir = abs
+	}
+	return workDir, nil
+}