fix(steps): resolve relative paths against step.WorkingDirectory

[Erik Osterman (Cloud Posse) (osterman)]

what

• Fix type: archive, file, workdir, junit, and container build step handlers to resolve relative source/destination/path/files/context/dockerfile fields against step.WorkingDirectory instead of the Atmos process's own cwd.
• Add a shared BaseHandler.ResolveInWorkingDirectory helper (pkg/runner/step/handler_base.go) used by all five handlers; container build additionally anchors Dockerfile to the resolved Context, matching Docker's own convention.
• Add regression tests for each fixed handler plus a hooks-integration test (TestStepEngineRunsArchiveTypeWithRelativeWorkingDirectory) reproducing the original bug end-to-end.
• Update two pre-existing container tests that had hardcoded the old (buggy) relative-path behavior to assert the corrected absolute-path behavior.

why

• type: archive steps run as component lifecycle hooks ignored step.WorkingDirectory, even though the hooks engine (pkg/hooks/step_engine.go) already correctly computes and sets it to the resolved component path before dispatch — the field was just never read back out by the handler.
• Auditing for the same defect class turned up four more handlers (file, workdir, junit, container build) with the identical bug: relative paths resolved via template substitution only, then silently anchored to process cwd instead of the step's configured working directory.

references

Summary by CodeRabbit

• Bug Fixes

  • Relative paths in archive, file, working-directory, JUnit, and container build steps now resolve against the configured working directory.
  • Dockerfiles, Bake files, build contexts, and local cache paths resolve correctly while preserving absolute, non-local, and fallback behavior.
  • Workflow-level working directories now apply to extended steps.
  • Improved error reporting preserves useful hints, context, and template-validation details.

• Documentation

  • Clarified working-directory behavior for hooks, workflows, and custom commands.

• Tests

  • Added regression and integration coverage for path resolution and workflow error handling.

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Step handlers now resolve relative filesystem paths against step.WorkingDirectory. The shared resolver supports templates, absolute paths, component-relative paths, dot-relative paths, tilde expansion, and process-CWD fallback. Workflow errors preserve nested context.

Changes

Working-directory path resolution

Layer / File(s)	Summary
Shared resolver and hook context pkg/runner/step/handler_base.go, pkg/runner/step/variables.go, pkg/hooks/step_engine.go, pkg/hooks/step_engine_test.go	Added shared path resolution with component-directory and process-CWD rules. Hook execution now supplies component context.
Filesystem handler integration pkg/runner/step/archive.go, pkg/runner/step/file.go, pkg/runner/step/workdir.go, pkg/runner/step/junit.go, pkg/runner/step/*_test.go, pkg/hooks/step_engine_test.go	Archive, file, workdir, and JUnit handlers use the shared resolver. Tests cover relative paths and template-error sentinels.
Container build integration pkg/runner/step/container_build.go, pkg/runner/step/container_actions_extra_test.go, pkg/runner/step/container_runtime_fake_test.go, pkg/runner/step/container_test.go	Build contexts, Dockerfiles, Bake files, and local cache paths resolve against WorkingDirectory.
Workflow execution and error context internal/exec/workflow_utils.go, pkg/provisioner/source/vendor.go, internal/exec/workflow_step_error_test.go, internal/exec/workflow_utils_test.go	Extended steps inherit workflow working directories. Local sources accept a base directory. Workflow errors preserve hints, context, sentinel matching, and exit codes.
Documentation and link-check configuration agent-skills/skills/*, website/docs/..., docs/fixes/*, lychee.toml, website/package.json	Documentation records path-resolution rules and validation. Lychee excludes reproducible-builds.org URLs. Website dependency overrides are updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• cloudposse/atmos#2730: Both changes modify archive-step path handling.
• cloudposse/atmos#2771: Both changes modify container Buildx cache resolution.
• cloudposse/atmos#2802: The related change sets default step working directories.

Suggested reviewers: aknysh, sgtoj, zack-is-cool

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 43.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: resolving relative step paths against step.WorkingDirectory.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch osterman/fix-archive-step-workdir

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• website/pnpm-lock.yaml

[github-actions]

Resource Changes Found for bucket in test

Plan: 4 to add, 0 to change, 0 to destroy.

To reproduce this locally, run:

atmos terraform plan bucket -s test

---

Create

+ aws_s3_bucket.checkov_target
+ aws_s3_bucket.this
+ aws_s3_bucket.trivy_target
+ aws_s3_bucket_public_access_block.trivy_target

Terraform Plan Summary

  # aws_s3_bucket.checkov_target will be created
  + resource "aws_s3_bucket" "checkov_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-checkov-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.this will be created
  + resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags                        = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + tags_all                    = {
          + "AtmosFixture" = "native-ci-e2e"
          + "Stage"        = "test"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket.trivy_target will be created
  + resource "aws_s3_bucket" "trivy_target" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "atmos-native-ci-e2e-trivy-test"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_public_access_block.trivy_target will be created
  + resource "aws_s3_bucket_public_access_block" "trivy_target" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = (known after apply)
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + bucket_name = "atmos-native-ci-e2e-test"

[codecov]

Codecov Report

❌ Patch coverage is 89.71963% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.76%. Comparing base (3ce4349) to head (4e2ce76).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/runner/step/handler_base.go	79.62%	9 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2880   +/-   ##
=======================================
  Coverage   82.76%   82.76%           
=======================================
  Files        1861     1861           
  Lines      180478   180551   +73     
=======================================
+ Hits       149380   149442   +62     
- Misses      23311    23321   +10     
- Partials     7787     7788    +1     

Flag	Coverage Δ
unittests	82.76% <89.71%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/exec/workflow_utils.go	75.92% <100.00%> (ø)
pkg/hooks/step_engine.go	87.35% <100.00%> (+0.05%)	⬆️
pkg/runner/step/archive.go	100.00% <100.00%> (ø)
pkg/runner/step/container_build.go	89.61% <100.00%> (+1.71%)	⬆️
pkg/runner/step/file.go	51.11% <100.00%> (-1.96%)	⬇️
pkg/runner/step/junit.go	88.11% <100.00%> (+1.98%)	⬆️
pkg/runner/step/variables.go	95.22% <100.00%> (+0.04%)	⬆️
pkg/runner/step/workdir.go	100.00% <100.00%> (+2.29%)	⬆️
pkg/runner/step/handler_base.go	92.71% <79.62%> (-7.29%)	⬇️

... and 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md`:
- Around line 7-10: Update the sentence in the documentation to add “that” after
“type: archive steps,” making the subject grammatically complete while
preserving the rest of the explanation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e889ec1-4f4c-4cc3-aeaa-28caf4c91da5

📥 Commits

Reviewing files that changed from the base of the PR and between d2b8e81 and 4142228.

📒 Files selected for processing (16)

• docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md
• pkg/hooks/step_engine_test.go
• pkg/runner/step/archive.go
• pkg/runner/step/archive_test.go
• pkg/runner/step/container_actions_extra_test.go
• pkg/runner/step/container_build.go
• pkg/runner/step/container_runtime_fake_test.go
• pkg/runner/step/container_test.go
• pkg/runner/step/file.go
• pkg/runner/step/file_test.go
• pkg/runner/step/handler_base.go
• pkg/runner/step/handler_base_test.go
• pkg/runner/step/junit.go
• pkg/runner/step/junit_test.go
• pkg/runner/step/workdir.go
• pkg/runner/step/workdir_test.go

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/runner/step/container_build.go (1)

98-108: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Preserve Buildx remote inputs before filesystem anchoring.

build.context, build.dockerfile, and build.bake.file can be remote references such as https://github.com/org/repo.git, while build.bake.files can be multiple remote definitions. These values are not absolute filesystem paths, but filepath.IsAbs treats them as relative and anchors them under ContextDir/WorkingDirectory, changing supported Docker Buildx inputs into invalid paths. Classify supported remote forms after template resolution and bypass working-directory anchoring for them; add regression cases covering remote context, Dockerfile, and Bake definitions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/runner/step/container_build.go` around lines 98 - 108, Update the
path-resolution flow in the container build handling around
ResolveInWorkingDirectory, resolveOptional, and the build.bake file resolution
so supported remote references such as HTTPS Git URLs remain unchanged after
template resolution instead of being anchored to ContextDir or WorkingDirectory.
Apply the same remote classification to build.context, build.dockerfile,
build.bake.file, and each entry in build.bake.files, while preserving filesystem
anchoring for local paths; add regression coverage for remote context,
Dockerfile, and Bake definitions.

🧹 Nitpick comments (1)

pkg/runner/step/container_actions_extra_test.go (1)

209-284: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use tables for the scenario variants.

Both tests enumerate multiple input and expected-output scenarios in separate t.Run blocks. Convert each set to a table and loop over the cases. This keeps future path variants consistent.

As per coding guidelines, “Use table-driven tests for testing multiple scenarios in Go.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/runner/step/container_actions_extra_test.go` around lines 209 - 284, The
tests covering bake path resolution and build-cache path resolution should use
table-driven scenarios instead of separate t.Run blocks. Refactor the cases in
the relevant test functions around buildBuildConfig and resolveBuildCache into
case tables containing inputs and expected outputs, then iterate over each table
entry with t.Run while preserving the existing assertions and distinct behavior
for relative, absolute, local, and non-local paths.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md`:
- Line 138: Remove the host-specific `/tmp/atmos-field-test/` reference from the
field-test repro note, replacing it with a relative fixture identifier or a
worktree-local reference while preserving the `container-bake-print` context.

In `@internal/exec/workflow_utils_test.go`:
- Around line 661-701: Move TestBuildWorkflowStepError and
TestBuildWorkflowStepErrorPreservesInnerHintsAndContext from
workflow_utils_test.go into a focused workflow-step-error test file, preserving
their setup and assertions. Keep related workflow-step-error tests together and
ensure workflow_utils_test.go remains below 600 lines.

---

Outside diff comments:
In `@pkg/runner/step/container_build.go`:
- Around line 98-108: Update the path-resolution flow in the container build
handling around ResolveInWorkingDirectory, resolveOptional, and the build.bake
file resolution so supported remote references such as HTTPS Git URLs remain
unchanged after template resolution instead of being anchored to ContextDir or
WorkingDirectory. Apply the same remote classification to build.context,
build.dockerfile, build.bake.file, and each entry in build.bake.files, while
preserving filesystem anchoring for local paths; add regression coverage for
remote context, Dockerfile, and Bake definitions.

---

Nitpick comments:
In `@pkg/runner/step/container_actions_extra_test.go`:
- Around line 209-284: The tests covering bake path resolution and build-cache
path resolution should use table-driven scenarios instead of separate t.Run
blocks. Refactor the cases in the relevant test functions around
buildBuildConfig and resolveBuildCache into case tables containing inputs and
expected outputs, then iterate over each table entry with t.Run while preserving
the existing assertions and distinct behavior for relative, absolute, local, and
non-local paths.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f96657a1-4197-4134-9bba-e825b0523697

📥 Commits

Reviewing files that changed from the base of the PR and between 4142228 and 1f72f48.

📒 Files selected for processing (6)

• docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md
• internal/exec/workflow_utils.go
• internal/exec/workflow_utils_test.go
• pkg/runner/step/container_actions_extra_test.go
• pkg/runner/step/container_build.go
• pkg/runner/step/container_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/runner/step/container_test.go

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/exec/workflow_step_error_test.go`:
- Around line 27-28: Update all table cases in the workflow path tests to create
an absolute root with t.TempDir(), then construct WorkflowPath and
WorkflowBasePath using filepath.Join instead of hard-coded Unix paths. Normalize
any expected nested-path suffix used in assertions with filepath.ToSlash,
applying the same construction consistently across every listed case.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fa40af1a-ee6d-4358-ae85-02a453f6f776

📥 Commits

Reviewing files that changed from the base of the PR and between 1f72f48 and 7aabbc2.

📒 Files selected for processing (4)

• docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md
• internal/exec/workflow_step_error_test.go
• internal/exec/workflow_utils_test.go
• pkg/runner/step/container_actions_extra_test.go

💤 Files with no reviewable changes (1)

• internal/exec/workflow_utils_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• docs/fixes/2026-08-05-step-handlers-ignore-working-directory.md
• pkg/runner/step/container_actions_extra_test.go

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

docs/fixes/2026-08-07-lychee-reproducible-builds-org-connection-refused.md (1)

28-30: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Scope the Lychee exclusion to the failing host.

reproducible-builds\.org has no ^https?:// or end anchor, so Lychee can exclude any URL containing that string—including subdomains and mirrored URLs. Use an exact URL or a host-bounded pattern if this CI failure affects only this link.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/fixes/2026-08-07-lychee-reproducible-builds-org-connection-refused.md`
around lines 28 - 30, Update the Lychee exclude regex entry for
reproducible-builds.org to match only the failing URL or exact host, using
protocol anchoring and host boundaries as appropriate; avoid an unbounded
substring pattern that also excludes subdomains or mirrored URLs, while
preserving the existing comment and placement.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/fixes/2026-08-07-hook-working-directory-bare-vs-dot-anchoring.md`:
- Around line 19-20: Fix the markdownlint MD018 warning in the paragraph
referencing PR `#2880` by escaping the leading hash or moving the PR reference to
the preceding line, while preserving the existing prose and meaning.

In `@website/docs/cli/configuration/commands/command/working-directory.mdx`:
- Around line 17-19: Update the relative-path documentation in the
working-directory section to state that paths are resolved against the process
working directory when no component anchor exists, matching
BaseHandler.resolveWorkingDirectory and the workflow/hook documentation; remove
the claim that every relative value uses the Atmos base_path.

---

Nitpick comments:
In `@docs/fixes/2026-08-07-lychee-reproducible-builds-org-connection-refused.md`:
- Around line 28-30: Update the Lychee exclude regex entry for
reproducible-builds.org to match only the failing URL or exact host, using
protocol anchoring and host boundaries as appropriate; avoid an unbounded
substring pattern that also excludes subdomains or mirrored URLs, while
preserving the existing comment and placement.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a45e742-24da-42a8-bd89-2746a0bf002c

📥 Commits

Reviewing files that changed from the base of the PR and between 7aabbc2 and 35685b1.

📒 Files selected for processing (13)

• agent-skills/skills/atmos-hooks/SKILL.md
• agent-skills/skills/atmos-steps/SKILL.md
• docs/fixes/2026-08-07-hook-working-directory-bare-vs-dot-anchoring.md
• docs/fixes/2026-08-07-lychee-reproducible-builds-org-connection-refused.md
• lychee.toml
• pkg/hooks/step_engine.go
• pkg/hooks/step_engine_test.go
• pkg/runner/step/handler_base.go
• pkg/runner/step/handler_base_test.go
• pkg/runner/step/variables.go
• website/docs/cli/configuration/commands/command/working-directory.mdx
• website/docs/stacks/hooks.mdx
• website/docs/workflows/workflows/workflow/steps/working-directory.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/runner/step/handler_base_test.go

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agent-skills/skills/atmos-steps/SKILL.md`:
- Around line 142-156: Document in agent-skills/skills/atmos-steps/SKILL.md
lines 142-156 and
website/docs/workflows/workflows/workflow/steps/working-directory.mdx lines
30-48 that relative handler fields source, destination, path, files, and context
resolve against the resolved step working directory; state separately that a
container Dockerfile resolves relative to the resolved context. Preserve the
existing workflow-default fallback wording in both locations.

In `@website/docs/workflows/workflows/workflow/steps/working-directory.mdx`:
- Around line 44-48: Update the working-directory resolution documentation in
the referenced workflow step section to explicitly state that an unset hook
working_directory defaults to the component’s working directory. Preserve the
existing rules for bare and dot-prefixed values, ensuring the documented
behavior matches the atmos-steps guidance.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a7e21712-aafb-4677-aae7-75ddf55c9070

📥 Commits

Reviewing files that changed from the base of the PR and between 35685b1 and d41591f.

⛔ Files ignored due to path filters (1)

• website/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (13)

• agent-skills/skills/atmos-steps/SKILL.md
• docs/fixes/2026-08-07-hook-working-directory-bare-vs-dot-anchoring.md
• internal/exec/workflow_utils.go
• internal/exec/workflow_utils_test.go
• pkg/hooks/step_engine_test.go
• pkg/provisioner/source/vendor.go
• pkg/runner/step/handler_base.go
• pkg/runner/step/handler_base_test.go
• pkg/runner/step/workdir.go
• pkg/runner/step/workdir_test.go
• website/docs/stacks/hooks.mdx
• website/docs/workflows/workflows/workflow/steps/working-directory.mdx
• website/package.json

🚧 Files skipped from review as they are similar to previous changes (5)

• website/docs/stacks/hooks.mdx
• docs/fixes/2026-08-07-hook-working-directory-bare-vs-dot-anchoring.md
• pkg/runner/step/workdir_test.go
• pkg/runner/step/handler_base.go
• pkg/hooks/step_engine_test.go