Q:

Building NodeJS Lambda - same source, different SHA hash

I'm having interesting issue and I can't point my finger on the cause. Here is the story.
My goal is to manage Lambda functions with Terraform, using CircleCI as orchestrator. Process looks like this:

GitHub repository -> CircleCI build (npm install && zip) -> aws s3 sync ZIP to S3 -> Terraform picks up ZIP from S3 -> if SHA is different, deploy to Lambda.

It all works pretty well with one little problem. If I run the whole process twice, with no change in GitHub repository, Terraform always reports new SHA hash:

source_code_hash: "mx56e7pMbBdftYHes+pETvjFZInvKsP92vtZ5URqyJY=" => "dhe66opfifDLEr7wI+Ie9UE6ioUiG8hTajuPhctA+W0="

It seems the issue lies somewhere around npm install process, which perhaps do always something slightly different, thus result is also different. I don't think, that ZIPing folder should cause troubles, it's simple zip -r file.zip *.
Any explanation of this behaviour, please?

A:

npm install with versions 4 or less is non-deterministic so there is no guarantee that your npm install in different builds will be the same.
npm solved it with version 5's package-lock.json. Try it again using the latest version of npm.
Or, you can try yarn or pnpm. Both are alternative package managers that aim to use deterministic installs.

