Compare commits

...
Author SHA1 Message Date
Sonarly Claude Code ece30df76e fix: include yarn.lock in buildFileList for app install file uploads
https://sonarly.com/issue/33547?type=bug

When a third-party application is installed via the marketplace, the `buildFileList` method in `ApplicationInstallService` does not include `yarn.lock` in the files uploaded to S3, causing the yarn install Lambda to run without a lockfile and resolve all dependencies from scratch, which exceeds the 1024MB memory limit.

Fix: Added `yarn.lock` to the `buildFileList` method in `ApplicationInstallService`.

When commit `f3e0c12ce6a` ("Fix app install file upload #18593") refactored the file upload logic from a dynamic pattern-matching approach to an explicit manifest-based list, it accidentally dropped `yarn.lock` from the files uploaded to S3 during third-party app installation. The original code had:

```typescript
const FILE_FOLDER_MAPPING: Record<string, FileFolder> = {
  'package.json': FileFolder.Dependencies,
  'yarn.lock': FileFolder.Dependencies,  // ← This was lost
};
```

The refactored code only included `package.json`:

```typescript
files.push(
  { relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
  { relativePath: 'manifest.json', fileFolder: FileFolder.Source },
);
```

The fix adds `yarn.lock` back to the list:

```typescript
files.push(
  { relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
  { relativePath: 'yarn.lock', fileFolder: FileFolder.Dependencies },
  { relativePath: 'manifest.json', fileFolder: FileFolder.Source },
);
```

Without this, when a logic function from an installed app is executed, the Lambda driver's `copyDependenciesInMemory` finds no `yarn.lock` in S3, falls back to an empty lockfile stub, and the yarn install Lambda must resolve all dependencies from scratch — exceeding the 1024MB memory limit and crashing with `Runtime.OutOfMemory`.

**Note:** Workspaces that already have installed apps with missing `yarn.lock` files will need to re-install those apps for the fix to take effect. The `copyDependenciesInMemory` fallback (empty lockfile stub) will continue to be hit for already-installed apps until they are re-installed or upgraded.
2026-05-02 16:16:58 +00:00
@@ -482,6 +482,7 @@ export class ApplicationInstallService {
files.push(
{ relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
{ relativePath: 'yarn.lock', fileFolder: FileFolder.Dependencies },
{ relativePath: 'manifest.json', fileFolder: FileFolder.Source },
);