Add a separate route for submitting file upload answers

[stephencdaly]

What problem does this pull request solve?

We need to be able to exempy file upload requests from particular WAF rules:

• the file size rule so requests can include files >8KB in size
• the XSS rule, so that files that contain XML, such as PDFs are not blocked.

So that we don't need to allow these rules for submitting all answer types, make it so that file upload requests are submitted to a dedicated route.

For now, this still allows file uploads to be submitted to the standard save question route so we don't cause issues for users currently filling out forms, but this will be changed in a separate deployment.

Things to consider when reviewing

• Ensure that you consider the wider context.
• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Do the end to end tests need updating before these changes will pass?
• Has all relevant documentation been updated?

[Copilot]

Copilot review overview

🟡 Changes recommended

The key generated form-action behavior lacks end-to-end request coverage.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Add end-to-end coverage for file upload form routing · New

What changed in this PR

Adds a dedicated submission route for file-upload answers so WAF exemptions can be scoped appropriately.

Changes:

• Adds the upload route and controller action.
• Routes file-question forms to the new endpoint.
• Adds request coverage and corrects a spec description typo.

File	Description
config/​routes.rb	Defines the file-upload POST route.
app/​controllers/​forms/​step_controller.rb	Selects the upload route and shares save logic.
app/​models/​step.rb	Adds file-question detection.
spec/​requests/​forms/​step_controller_spec.rb	Tests the new endpoint’s behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 A review copy of this PR has been deployed! It is made of up two components

1. A review copy of forms-runner
2. A production copy of forms-admin

It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
to debug, or otherwise ask an infrastructure person.

For the sign in details and more information, see the review apps wiki page.