Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.devcontainer/Dockerfile:
- Line 1: The final image currently runs as root; update the Dockerfile's final
build stage by adding a non-root runtime user assignment (e.g., set USER vscode)
so containers start with non-root privileges; locate the final stage in the
Dockerfile (the stage labeled or ending with the runtime artifacts, after AS
confetty) and append the USER vscode directive (and ensure the vscode user
exists or is created earlier in the Dockerfile) to enforce the non-root runtime
user.

In `@NOTICE`:
- Around line 160-163: The NOTICE file is out of sync and must be regenerated
rather than edited manually; run the provided script
./scripts/generate-notice.sh to regenerate NOTICE (ensuring it captures the
github.com/aws/aws-sdk-go-v2/service/organizations entry and any other changes),
review the updated NOTICE for correctness, and commit the regenerated NOTICE
output to the branch before merging.

In `@pkg/aws/organization/organization_test.go`:
- Around line 16-42: Replace the manual mocks mockOrgGetter and
countingOrgGetter with the generated MockGetter from mock_organization.go:
remove types mockOrgGetter and countingOrgGetter, import/use MockGetter, and set
expectations in tests with MockGetter.EXPECT().GetOrganization(ctx, atmosConfig,
authContext).Return(<desired>, <err>).Times(n) to both supply return values and
verify call counts; update any test setup referencing mockOrgGetter or
countingOrgGetter to construct a *MockGetter and configure
EXPECT().GetOrganization(...) accordingly.

In `@pkg/aws/organization/organization.go`:
- Around line 55-58: The call to awsIdentity.LoadConfigWithAuth in
organization.go returns a raw error instead of being wrapped with the project
standard; replace the direct return of err with a wrapped error using
ErrAwsDescribeOrganization and ErrWrapFormat (the same pattern used later on
lines returning ErrAwsDescribeOrganization) so all organization lookup failures
are classified uniformly—wrap the error from awsIdentity.LoadConfigWithAuth with
fmt.Sprintf(ErrWrapFormat, ErrAwsDescribeOrganization, err) (or the project's
equivalent) before returning.

In `@pkg/function/aws_test.go`:
- Around line 315-326: Add a go:generate directive to the organization.Getter
interface declaration so mockgen can produce a mock for it (e.g., add
"//go:generate mockgen -destination=mock_organization.go -package=organization
<module>/pkg/aws/organization Organization" next to the interface in
organization.go), run mockgen to generate the mock, then remove the hand-written
mock type mockAWSOrgGetter and update the test to use the generated mock
(construct the generated mock struct, set its EXPECT() for GetOrganization(ctx,
atmosConfig, authContext) to return the desired (*awsOrg.OrganizationInfo,
error) values). Ensure references to the hand-rolled mockAWSOrgGetter and its
GetOrganization method are replaced with the generated mock's methods and
import.

In `@website/src/data/roadmap.js`:
- Line 378: The roadmap entry object with label '`!aws.organization_id` YAML
function' in website/src/data/roadmap.js is missing the required PR metadata;
add a pr: 2117 property to that object (the same object that has status:
'shipped', changelog: 'aws-organization-id-yaml-function') so shipped milestones
tied to minor/major PRs include the PR number, and after adding it, update the
related initiative's progress percentage to reflect this shipped milestone.

---

Nitpick comments:
In `@internal/exec/yaml_func_aws_test.go`:
- Around line 766-804: Add a failing-case row to TestProcessTagAwsOrganizationID
that sets mockErr to a non-nil error (e.g. errors.New("fetch error")) and
asserts the function's error-path output (typically an empty string) by adding a
test case named like "error fetching org info" to the tests slice; use the same
helpers (runAWSOrgYamlFuncTest, processTagAwsOrganizationID,
AWSOrganizationInfo) so the test verifies the function returns the
expectedResult when mockErr is returned.

In `@internal/exec/yaml_func_aws.go`:
- Around line 184-192: The code calls getAWSOrganizationCached and immediately
dereferences orgInfo.ID; add a defensive guard to check orgInfo for nil and
orgInfo.ID for empty before using it. Specifically, after the call to
getAWSOrganizationCached (in yaml_func_aws.go) check if orgInfo == nil ||
orgInfo.ID == "" and if so log an error via log.Error (include context like
"empty or nil orgInfo") and call errUtils.CheckErrorPrintAndExit (or return an
appropriate error) instead of proceeding to log.Debug and return orgInfo.ID, so
you never dereference a nil orgInfo or return an empty ID.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/exec/yaml_func_aws_test.go`:
- Around line 841-842: The -test.run argument passed to exec.Command uses an
unanchored regex which can match unintended tests; update the argument for the
subprocess invocation (the exec.Command call that uses os.Args[0] and
"-test.run=TestProcessTagAwsOrganizationID_ErrorHelper") to use an anchored
regex by changing the value to
"-test.run=^TestProcessTagAwsOrganizationID_ErrorHelper$" so only that exact
helper test is executed.
- Around line 731-743: Replace the handwritten mock type
mockAWSOrganizationGetter and its GetOrganization method with the generated
gomock MockGetter from pkg/aws/organization: remove the
mockAWSOrganizationGetter struct and its method, import the generated mock
package, create a mock via organization.NewMockGetter(ctrl) (using
gomock.NewController in the test setup), and replace uses of
mockAWSOrganizationGetter with the MockGetter and its
EXPECT().GetOrganization(...).Return(...) setup so tests follow the existing
gomock pattern.

In `@pkg/aws/organization/organization.go`:
- Around line 108-116: SetGetter currently allows setting a nil Getter which
will cause a panic later when getter.GetOrganization is called; update SetGetter
to guard against nil by checking if g == nil and either (a) reject it
immediately with a clear panic or error (e.g., panic("organization.SetGetter:
nil Getter provided")) or (b) substitute a safe no-op/default implementation so
future calls to getter.GetOrganization won't panic; implement the chosen
approach inside SetGetter and ensure the returned restore func still restores
the original getter. Refer to SetGetter, Getter, getter and GetOrganization when
making the change.
- Around line 76-78: The current nil-check for org returns (info, nil) which
hides an anomalous AWS response; instead when org == nil return a wrapped
ErrAwsDescribeOrganization error (including context such as the AWS account or
request ID if available) rather than nil error. Update the nil branch in the
function that inspects org (the org variable in
pkg/aws/organization/organization.go) to return the zero info and
fmt.Errorf("...: %w", ErrAwsDescribeOrganization) or errors.Wrap-style error so
callers get a clear, typed error instead of an empty ID.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/exec/yaml_func_aws_test.go`:
- Around line 747-752: The test uses gomock.AnyTimes() on the
awsOrg.NewMockGetter().GetOrganization expectation which can hide missed or
extra calls; replace AnyTimes() with a strict Times(n) (e.g., Times(1) if the
getter should be called once) so the test asserts the exact invocation count for
GetOrganization. Do the same change for the other occurrence of the same
expectation (the block around lines shown for the second test), keeping the same
mock (awsOrg.NewMockGetter / mock) and expectation setup but swapping AnyTimes()
for the appropriate Times(...) value.
- Around line 839-842: The test currently only checks for a non-nil error from
cmd.Run() when tt.wantErr is true; change this to assert that the error is an
*exec.ExitError and that its ExitCode() == 1. After calling cmd.Run() in the
test (the same spot where tt.wantErr is checked), use errors.As (or a type
assertion) to extract an *exec.ExitError from err and assert the extraction
succeeded, then assert exitErr.ExitCode() == 1; keep behavior unchanged when
tt.wantErr is false.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/aws/organization/organization.go`:
- Around line 162-169: getCacheKey currently builds a colon-joined key which can
collide when fields contain ":"; update getCacheKey to produce a collision-safe
key by canonicalizing the three fields (authContext.Profile,
authContext.CredentialsFile, authContext.ConfigFile) and hashing them (e.g.,
SHA-256) or JSON-marshaling the struct and using the result as the cache key;
keep the nil check and return a deterministic string (e.g., hex hash or
marshaled string) instead of fmt.Sprintf("%s:%s:%s", ...).
- Around line 83-99: The code currently dereferences output.Organization without
ensuring output is non-nil after calling orgClient.DescribeOrganization; update
the DescribeOrganization handling (the call to orgClient.DescribeOrganization
and subsequent uses of output) to first check if output == nil and return a
wrapped errUtils.ErrAwsDescribeOrganization with a clear message if so, then
proceed to check output.Organization for nil as before (referencing output,
output.Organization and the org variable) to avoid a potential panic on
anomalous SDK responses.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@pkg/aws/organization/organization_test.go`:
- Around line 185-192: In the goroutine calling GetOrganizationCached, avoid
potential nil dereference on info.ID by guarding after the assert: check the
returned err and/or info before accessing info.ID (e.g., after assert.NoError(t,
err) add if err != nil || info == nil { return } ), or use an early return when
err != nil; target the anonymous goroutine containing GetOrganizationCached, the
assert.NoError call, and the subsequent info.ID access to add this defensive
guard.