Install uv so callers can package python Lambdas - #32
Merged
Conversation
terraform-server's queue sampler (kosli-dev/server#6561) is a python Lambda whose dependencies are declared in a pyproject.toml with a committed uv.lock. terraform-aws-modules/lambda/aws builds that package by shelling out to `uv export --no-dev --frozen` and `uv pip install --python python3.13 --system --target .` from the local-exec provisioner on `null_resource.archive`, so the tooling has to exist on this runner or the apply cannot produce a zip. Plans are unaffected either way: the module's prepare stage hashes pyproject.toml and uv.lock without running a resolver, which is why the absence only shows up at apply. And because the caller commits uv.lock, package.py skips its own "uv must be installed and available in PATH" branch and goes straight to check_call, so the failure surfaces as a bare FileNotFoundError from a provisioner rather than as advice. The step is unconditional rather than an input. It costs a couple of seconds on runs that do not need it, and threading a boolean through plan.yml, apply.yml and detect-drift.yml to save that would spread one caller's packaging choice across four files. uv's own version is deliberately unpinned while the action is SHA pinned. What ends up in a deployment package is decided by the caller's uv.lock and the hashes recorded in it, so a newer resolver reading the same frozen lock produces the same bytes. Pinning it here would add a bump chore to a workflow shared by every terraform repository. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jumboduck
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of kosli-dev/server#6561.
Adds a step to
base.ymlthat installsuvon the runner, so a caller can package a python Lambda whose dependencies are a pyproject.toml plus a committed uv.lock.Why
terraform-server is adding a python Lambda (a Celery queue sampler) built with
terraform-aws-modules/lambda/aws. That module packages it by shelling out touv exportanduv pip installfrom a local-exec provisioner during apply.ubuntu-latestdoes not shipuv, so without this step the apply fails with a bareFileNotFoundError. Plans are unaffected: the prepare stage only hashes pyproject.toml and uv.lock.What changed
base.ymlis the only place this repo runstf plan/tf apply—plan.yml,apply.yml,detect-drift.ymlall route through it — so one unconditional step covers every caller. It sits between thetfCLI PATH export andCheck formatting, pinned toastral-sh/setup-uv@20cfd1bf...(v10.0.1).Verification
uv export --python python3.13 --no-dev --frozenanduv pip install --python python3.13 --system --no-compile --target=.were run by hand against the consumer's real pyproject.toml and uv.lock: export resolves redis==6.4.0 with hashes and omits the dev-only fakeredis; install lands redis/ plus dist-info.test.ymlruns actionlint and pytest on PRs tomain, validating thatbase.ymlstill parses.🤖 Generated with Claude Code