From 24654f44cefa86d939231083026703295ce3ef81 Mon Sep 17 00:00:00 2001
From: Simon Thorley <simon.thorley@cdl.co.uk>
Date: Thu, 22 Oct 2026 11:33:25 +0100
Subject: [PATCH] fix(terraform): rebuild every Lambda that bundles
 lambda/shared

Nine esbuild-bundled Lambdas lacked hash_extra = local.shared_sources_hash:
sprints, tasks, questions, sprint-graph, timeline-events,
migrate-tracker-fields, building-blocks, seed-blocks and ws-connection. A
change only under lambda/shared/ left their package name unchanged, so the
plan kept the deployed source_code_hash and the apply failed with
"Provider produced inconsistent final plan" once the rebuilt zip differed.
Add the hash to those modules, and the same local to the realtime module.
---
 terraform/modules/api/lambda/main.tf | 16 ++++++++++++++++
 terraform/modules/realtime/lambda.tf | 10 ++++++++++
 2 files changed, 26 insertions(+)

diff --git a/terraform/modules/api/lambda/main.tf b/terraform/modules/api/lambda/main.tf
index 4ee91b5ab..b81a04d15 100644
--- a/terraform/modules/api/lambda/main.tf
+++ b/terraform/modules/api/lambda/main.tf
@@ -1528,6 +1528,8 @@ module "sprints_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_reader.arn
@@ -1645,6 +1647,8 @@ module "tasks_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_tasks.arn
@@ -1764,6 +1768,8 @@ module "questions_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_questions.arn
@@ -1801,6 +1807,8 @@ module "sprint_graph_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_reader.arn
@@ -2319,6 +2327,8 @@ module "timeline_events_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_reader.arn
@@ -2575,6 +2585,8 @@ module "migrate_tracker_fields_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.neptune_reader.arn
@@ -2613,6 +2625,8 @@ module "building_blocks_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.blocks.arn
@@ -2659,6 +2673,8 @@ module "seed_blocks_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.seed_blocks.arn
diff --git a/terraform/modules/realtime/lambda.tf b/terraform/modules/realtime/lambda.tf
index eea5f8e4e..ddc828e32 100644
--- a/terraform/modules/realtime/lambda.tf
+++ b/terraform/modules/realtime/lambda.tf
@@ -9,6 +9,14 @@ locals {
   realtime_partition  = data.aws_partition.realtime.partition
   realtime_dns_suffix = data.aws_partition.realtime.dns_suffix
   all_lambdas_in_vpc  = var.lambda_vpc_scope == "all"
+  # ws-connection bundles lambda/shared/** via esbuild, but the lambda module
+  # only hashes its own source_path. Fold the shared tree into hash_extra so a
+  # shared-file change rebuilds the package (same as modules/api/lambda).
+  shared_dir = "${path.module}/../../../lambda/shared"
+  shared_sources_hash = sha256(join("", [
+    for f in sort(fileset(local.shared_dir, "**/*.{js,mjs,cjs,json}")) :
+    filesha256("${local.shared_dir}/${f}")
+  ]))
 }
 
 # IAM Role for Lambda functions
@@ -96,6 +104,8 @@ module "connection_lambda" {
       ]
     }
   ]
+  # Force a rebuild when bundled lambda/shared/** changes (see local above).
+  hash_extra = local.shared_sources_hash
 
   create_role = false
   lambda_role = aws_iam_role.lambda.arn