needs.<job>.outputs is empty despite writing to $GITHUB_OUTPUT

[Zenitugo]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Workflow Deployment

Discussion Details

Hi everyone,

I'm trying to pass an ECR repository URI from one GitHub Actions job to another using job outputs. In Job 1, terraform output -raw returns the correct value, it's successfully written to $GITHUB_OUTPUT, and steps.ecr-uris.outputs.backend_uri contains the expected URI. However, in Job 2, needs.deploy.outputs.backend_uri is always empty, causing my Docker tag command to fail with Error parsing reference: ":latest" is not a valid repository/tag. My job output is defined as:

Job 1

jobs:
  deploy:
    runs-on: ubuntu-latest
    outputs: 
      backend_uri: ${{ steps.ecr-uris.outputs.backend_uri }} 
    steps:

      # Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v4

      # Configure AWS credentials
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: "eu-central-1"
      
      # Setup Terraform
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
      

      - name: Mask AWS Account ID
        run: echo "::add-mask::${{ secrets.AWS_ACCOUNT_ID }}"


      # Create infrastructure
      - name: Creating infrastructure with Terraform
        run: |
          echo "Creating infrastructure with Terraform..."
          cd terraform/staging
          terraform init
          terraform plan -var-file="values.tfvars"
          terraform apply -auto-approve -var-file="values.tfvars"

      # Retrieve the ECR repository URIs from Terraform output
      - name: Retrieve ECR repository URI
        id: ecr-uris
        run: |
          cd terraform/staging
          BACKEND_URI=$(terraform output -raw backend_repository_url)
          echo "backend_uri=${BACKEND_URI}" >> $GITHUB_OUTPUT
          echo "✅ Backend URI: ${BACKEND_URI}"
 
      - name: Verify step output
        run: |
          echo "Step output = '${{ steps.ecr-uris.outputs.backend_uri }}'"

After job 1 successfuly ran
✅ Backend URI: ***.dkr.ecr.eu-central-1.amazonaws.com/staging-backend-repo
Step output = '***.dkr.ecr.eu-central-1.amazonaws.com/staging-backend-repo'

Job 2

 deploy-backend-to-ec2:
    name: Deploy backend to ec2
    needs: deploy
    runs-on: ubuntu-latest
    env:
      ECR_BACKEND_URI: ${{ needs.deploy.outputs.backend_uri }}
    steps:
      # Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: "eu-central-1"

      - name: Mask AWS Account ID
        run: echo "::add-mask::${{ secrets.AWS_ACCOUNT_ID }}"

      # Login to AWS ECR
      - name: Login to AWS ECR
        run: |
          aws ecr get-login-password --region eu-central-1 | \
          docker login --username AWS --password-stdin \
          ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-central-1.amazonaws.com

      - name: Verify job output
        run: |
          echo "Job output = '${{ needs.deploy.outputs.backend_uri }}'"

     # Build and Push Python Backend
      - name: Build and push backend
        run: |
          docker build -t fittrack-backend fitness/backend
          docker tag fittrack-backend:latest $ECR_BACKEND_URI:latest
          docker push $ECR_BACKEND_URI:latest
          echo "✅ Successfully pushed: $ECR_BACKEND_URI:latest"

Error showing up at job 2

echo "Job output = ''"
  shell: /usr/bin/bash -e {0}
  env:
    ECR_BACKEND_URI: 
    AWS_DEFAULT_REGION: eu-central-1
    AWS_REGION: eu-central-1
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***
Job output = ''

Error parsing reference: ":latest" is not a valid repository/tag: invalid reference format
Error: Process completed with exit code 1.

[nirav-gajera]

The ECR_BACKEND_URI environment variable is empty or not being passed correctly. When it's empty, the command docker tag fittrack-backend:latest $ECR_BACKEND_URI:latest becomes docker tag fittrack-backend:latest :latest, which is invalid.

This happens because the backend_uri output from the first job isn't being retrieved properly or the Terraform output is failing.

Fix
Update the workflow file at line 100-105 in .github/workflows/main.yml

- name: Build and push backend
  run: |
    if [ -z "$ECR_BACKEND_URI" ]; then
      echo "❌ Error: ECR_BACKEND_URI is empty"
      exit 1
    fi
    docker build -t fittrack-backend fitness/backend
    docker tag fittrack-backend:latest $ECR_BACKEND_URI:latest
    docker push $ECR_BACKEND_URI:latest
    echo "✅ Successfully pushed: $ECR_BACKEND_URI:latest"

Additional Issues to Address
Line 137: Missing cd command before terraform path:

cd terraform/staging
ALB_DNS=$(terraform output -raw alb_dns_name)

Line 159: Syntax error - missing closing quote:

echo "::add-mask::$BUCKET_URL"

Line 166: Wrong S3 URI format - should use s3:// not s3:/:

aws s3 sync fitness/frontend/dist s3://$S3_FRONTEND_BUCKET_URL --delete
Line 128: Using actions/checkout@v6 instead of actions/setup-node@v4 for Node.js setup.

[Zenitugo]

Thank you for your responses, but the if statement doesn't address the issue. I know that ECR_BACKEND_URI is empty. I don't want it to be empty. I want it to contain the repo URL from job 1.

[Zenitugo]

I am going to look into the other issues you flagged but I have to address job 2 before going on job 3

[Zenitugo]

After a lot of debugging, I found that the issue was with how I was passing outputs between jobs. I verified that Terraform was returning the correct ECR repository URL, that the value was written to $GITHUB_OUTPUT, and that the step output was correct. The problem was that the job output and the downstream reference weren't aligned correctly.

I simplified the workflow by passing only the ECR repository name between jobs instead of the full URI, then reconstructed the full ECR URI in the deployment job using the AWS account ID and the repository name. After fixing the output mapping, the downstream job received the value correctly and the Docker image pushed successfully to Amazon ECR.

Thanks again for taking the time to respond!

[Samielakkad]

Your output mapping is correct. The add-mask step is what makes the job output disappear.

You register ${{ secrets.AWS_ACCOUNT_ID }} as a masked value before creating backend_uri. The ECR URI contains that exact account ID:

<account-id>.dkr.ecr.eu-central-1.amazonaws.com/staging-backend-repo

A masked value is treated as a secret. Step outputs can still be used later inside the same job, which is why your verification step works, but GitHub redacts secret-looking job outputs and does not send them to downstream jobs. Near the end of the deploy job log you should find:

Skip output 'backend_uri' since it may contain secret.

GitHub documents both parts of this behavior: add-mask prevents a masked value from being set as an output, and job outputs containing secrets are not sent to GitHub Actions.

Two fixes:

1. If you do not need to hide the AWS account ID, remove the add-mask step. AWS account IDs identify accounts but are not credentials. Your existing backend_uri output will then work.

2. If you want to keep it masked, do not pass the full URI as a job output. Pass only the non-secret repository name, then reconstruct the URI in job 2 using the secret directly:

# job 1
outputs:
  backend_repo: ${{ steps.ecr-uris.outputs.backend_repo }}

- id: ecr-uris
  run: |
    cd terraform/staging
    BACKEND_REPO=$(terraform output -raw backend_repository_name)
    echo "backend_repo=$BACKEND_REPO" >> "$GITHUB_OUTPUT"

# job 2
env:
  ECR_BACKEND_URI: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-central-1.amazonaws.com/${{ needs.deploy.outputs.backend_repo }}

So the key distinction is: $GITHUB_OUTPUT is working at the step boundary; GitHub drops the value later at the job boundary because it contains a registered mask.

[Dasmat13]

This is one of the most common GitHub Actions gotchas. The issue is almost always one of three things:

Root Cause & Fix

1. Missing outputs: declaration on the job (most common)

You must declare the output on the job level, not just write to $GITHUB_OUTPUT. Both are required:

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      ecr_uri: ${{ steps.tf.outputs.ecr_uri }}   # <-- REQUIRED
    steps:
      - id: tf
        run: |
          URI=$(terraform output -raw ecr_repository_url)
          echo "ecr_uri=$URI" >> "$GITHUB_OUTPUT"

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: echo "URI is ${{ needs.build.outputs.ecr_uri }}"

Without the outputs: block on the job, needs.build.outputs.ecr_uri will always be empty.

2. Step ID missing or wrong

The outputs: mapping uses steps.<step-id>.outputs.<key>. Make sure:

• The step has id: tf (or whatever ID you reference)
• The key matches exactly (ecr_uri on both sides)

3. Writing to $GITHUB_OUTPUT incorrectly

The correct format is:

echo "key=value" >> "$GITHUB_OUTPUT"

Not > $GITHUB_OUTPUT (overwrites) and not echo "key value" (missing =).

Debugging tip

Add a step to dump all outputs:

- run: cat "$GITHUB_OUTPUT"

This shows exactly what was written, confirming whether the write succeeded before the job ended.