From 8be19e8fdbb7ad346e59305061234affdb7b36f6 Mon Sep 17 00:00:00 2001
From: Alexander Amiri <alexander.amiri@piano.io>
Date: Tue, 10 Mar 2026 03:02:42 +0100
Subject: [PATCH] =?UTF-8?q?Fix=20Lambda=20hash=20instability=20=E2=80=94?=
 =?UTF-8?q?=20add=20output=5Ffile=5Fmode=20to=20all=20archive=5Ffile?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 terraform/platform/lambdas/main.tf | 41 +++++++++++++++++-------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/terraform/platform/lambdas/main.tf b/terraform/platform/lambdas/main.tf
index f92b902..cb4d8e0 100644
--- a/terraform/platform/lambdas/main.tf
+++ b/terraform/platform/lambdas/main.tf
@@ -16,8 +16,9 @@ locals {
 # Using explicit source blocks so shared/ is at the right path for imports.
 
 data "archive_file" "slack_alert" {
-  type        = "zip"
-  output_path = "${path.module}/builds/slack_alert.zip"
+  type             = "zip"
+  output_path      = "${path.module}/builds/slack_alert.zip"
+  output_file_mode = "0644"
 
   source {
     content  = file("${local.lambda_src_path}/slack_alert/handler.py")
@@ -42,8 +43,9 @@ data "archive_file" "slack_alert" {
 }
 
 data "archive_file" "cost_report" {
-  type        = "zip"
-  output_path = "${path.module}/builds/cost_report.zip"
+  type             = "zip"
+  output_path      = "${path.module}/builds/cost_report.zip"
+  output_file_mode = "0644"
 
   source {
     content  = file("${local.lambda_src_path}/cost_report/handler.py")
@@ -64,8 +66,9 @@ data "archive_file" "cost_report" {
 }
 
 data "archive_file" "daily_cost_check" {
-  type        = "zip"
-  output_path = "${path.module}/builds/daily_cost_check.zip"
+  type             = "zip"
+  output_path      = "${path.module}/builds/daily_cost_check.zip"
+  output_file_mode = "0644"
 
   source {
     content  = file("${local.lambda_src_path}/daily_cost_check/handler.py")
@@ -86,20 +89,23 @@ data "archive_file" "daily_cost_check" {
 }
 
 data "archive_file" "compliance_reporter" {
-  type        = "zip"
-  output_path = "${path.module}/builds/compliance_reporter.zip"
-  source_dir  = "${local.lambda_src_path}/compliance_reporter"
+  type             = "zip"
+  output_path      = "${path.module}/builds/compliance_reporter.zip"
+  output_file_mode = "0644"
+  source_dir       = "${local.lambda_src_path}/compliance_reporter"
 }
 
 data "archive_file" "override_cleanup" {
-  type        = "zip"
-  output_path = "${path.module}/builds/override_cleanup.zip"
-  source_dir  = "${local.lambda_src_path}/override_cleanup"
+  type             = "zip"
+  output_path      = "${path.module}/builds/override_cleanup.zip"
+  output_file_mode = "0644"
+  source_dir       = "${local.lambda_src_path}/override_cleanup"
 }
 
 data "archive_file" "team_provisioner" {
-  type        = "zip"
-  output_path = "${path.module}/builds/team_provisioner.zip"
+  type             = "zip"
+  output_path      = "${path.module}/builds/team_provisioner.zip"
+  output_file_mode = "0644"
 
   source {
     content  = file("${local.lambda_src_path}/team_provisioner/handler.py")
@@ -722,9 +728,10 @@ resource "aws_lambda_permission" "override_cleanup_schedule" {
 ################################################################################
 
 data "archive_file" "apply_gate" {
-  type        = "zip"
-  output_path = "${path.module}/builds/apply_gate.zip"
-  source_dir  = "${local.lambda_src_path}/apply_gate"
+  type             = "zip"
+  output_path      = "${path.module}/builds/apply_gate.zip"
+  output_file_mode = "0644"
+  source_dir       = "${local.lambda_src_path}/apply_gate"
 }
 
 resource "aws_iam_role" "apply_gate" {