From e816972c4597e4e314c9df26aad126b872bbf7a4 Mon Sep 17 00:00:00 2001 From: Jun-te Kim Date: Mon, 6 Jul 2026 13:28:24 +0000 Subject: [PATCH] Move the fastapi Lambda zip-size gate into the PR test suite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit deploy_terraform.yml only triggers on push to dev/prod — by the time it runs, the change has already merged to main and rolled into dev. That's exactly how the size regression sat undetected for weeks: it only ever surfaced deep inside terraform apply on dev. Drop the fast_api_lambda_zip_size_check job from deploy_terraform.yml and instead add tests/test_lambda_zip_size.py, which runs backend/app/requirements/check_lambda_zip_size.py as part of the existing pytest tests/ suite. ddd_tests.yml already runs that suite on `pull_request: branches: ["**"]`, so this now fails the PR before anything merges to main, rather than failing the dev deploy after. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/deploy_terraform.yml | 17 +---------- tests/test_lambda_zip_size.py | 42 ++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 16 deletions(-) create mode 100644 tests/test_lambda_zip_size.py diff --git a/.github/workflows/deploy_terraform.yml b/.github/workflows/deploy_terraform.yml index 9907ebee3..5e469dc66 100644 --- a/.github/workflows/deploy_terraform.yml +++ b/.github/workflows/deploy_terraform.yml @@ -534,26 +534,11 @@ jobs: TF_VAR_social_housing_wave_3_sharepoint_id: ${{ secrets.SOCIAL_HOUSING_WAVE_3_SHAREPOINT_ID }} - # ============================================================ - # Check FastAPI Lambda package will fit AWS's unzipped size limit - # ============================================================ - fast_api_lambda_zip_size_check: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - uses: actions/setup-python@v5 - with: - python-version: "3.11" - - - name: Check projected unzipped Lambda size - run: python3 backend/app/requirements/check_lambda_zip_size.py - # ============================================================ # Deploy FastAPI Lambda # ============================================================ fast_api_lambda: - needs: [determine_stage, ara_engine_lambda, categorisation_lambda, postcodeSplitter_lambda, bulk_address2uprn_combiner_lambda, bulkUploadFinaliser_lambda, fast_api_lambda_zip_size_check] + needs: [determine_stage, ara_engine_lambda, categorisation_lambda, postcodeSplitter_lambda, bulk_address2uprn_combiner_lambda, bulkUploadFinaliser_lambda] uses: ./.github/workflows/_deploy_lambda.yml with: lambda_name: ara_fast_api diff --git a/tests/test_lambda_zip_size.py b/tests/test_lambda_zip_size.py new file mode 100644 index 000000000..a9cc89bca --- /dev/null +++ b/tests/test_lambda_zip_size.py @@ -0,0 +1,42 @@ +"""Guard against the fastapi Lambda's unzipped package exceeding AWS's +262144000 byte (250 MiB) limit. + +dev deployed with `InvalidParameterValueException: Unzipped size must be +smaller than 262144000 bytes` for several weeks (2026-06-15 to 2026-07-03) +before anyone noticed, because the failure only ever surfaced deep inside +`terraform apply` on a push to dev/prod — well after a PR to main had merged. +This runs the same check as part of the PR-gated test suite so a regression +(e.g. a large fixture or dependency landing outside the Lambda's zip_excludes) +fails the PR instead of the dev deploy. + +Runs the real `check_lambda_zip_size.py` script as a subprocess (not an +in-process import) so this exercises exactly what a human or CI would run +locally: `python3 backend/app/requirements/check_lambda_zip_size.py`. +""" +from __future__ import annotations + +import subprocess +import sys +from pathlib import Path + +REPO_ROOT = Path(__file__).resolve().parents[1] +CHECK_SCRIPT = REPO_ROOT / "backend/app/requirements/check_lambda_zip_size.py" + + +def test_fastapi_lambda_unzipped_size_within_aws_limit() -> None: + result = subprocess.run( + [sys.executable, str(CHECK_SCRIPT)], + cwd=REPO_ROOT, + capture_output=True, + text=True, + ) + print(result.stdout) + assert result.returncode == 0, ( + "fastapi Lambda's projected unzipped size exceeds (or is dangerously " + "close to) AWS's 250 MiB limit — see output above. If this is a real " + "new dependency/fixture, either trim it or extend `zip_excludes` in " + "deployment/terraform/modules/lambda_with_api_gateway/variables.tf " + "(only if it's not needed by the Lambda at runtime).\n" + + result.stdout + + result.stderr + )