NHSDigital · thomasleese · Jan 22, 2026 · Jan 13, 2026 · Jan 13, 2026 · Jan 19, 2026
@@ -17,6 +17,7 @@ on:
           - sandbox-alpha
           - sandbox-beta
           - performance
+          - pentest
       server_types:
         description: Server types to deploy
         required: true

@@ -0,0 +1,35 @@
+name: Deploy Documentation
+
+on:
+  push:
+    branches:
+      - release
+      - next
+
+permissions:
+  contents: write
+
+jobs:
+  deploy-documentation:
+    name: Generate and Publish RDoc
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-documentation-${{ github.ref_name }}
+      cancel-in-progress: true
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
+      - name: Generate Documentation
+        run: bundle exec rake rdoc:generate
+
+      - name: Deploy to GitHub Pages
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          branch: gh-pages
+          folder: docs/rdoc
+          target-folder: docs/rdoc/${{ github.ref_name }}
+          clean: false
@@ -34,6 +34,7 @@ on:
           - sandbox-alpha
           - sandbox-beta
           - performance
+          - pentest
       server_types:
         description: Server types to deploy
         required: true

@@ -1,6 +1,6 @@
 GIT
   remote: https://github.com/alphagov/rubocop-govuk.git
-  revision: 58ff3290bf5c267d0228d0910fa0bc92a405ec81
+  revision: cb59fb73abfb010ea000ed53dcc84a3e20c28974
   branch: main
   specs:
     rubocop-govuk (5.1.20)
@@ -136,7 +136,7 @@ GEM
     ast (2.4.3)
     attr_required (1.0.2)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1206.0)
+    aws-partitions (1.1208.0)
     aws-sdk-accessanalyzer (1.85.0)
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sigv4 (~> 1.5)
@@ -148,7 +148,7 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-ec2 (1.591.0)
+    aws-sdk-ec2 (1.592.0)
       aws-sdk-core (~> 3, >= 3.241.4)
       aws-sigv4 (~> 1.5)
     aws-sdk-ecr (1.119.0)
@@ -243,7 +243,7 @@ GEM
     docile (1.4.1)
     domain_name (0.6.20240107)
     drb (2.2.3)
-    dry-cli (1.4.0)
+    dry-cli (1.4.1)
     email_validator (2.2.4)
       activemodel
     erb (6.0.1)
@@ -486,7 +486,7 @@ GEM
       date
       stringio
     public_suffix (7.0.2)
-    puma (7.1.0)
+    puma (7.2.0)
       nio4r (~> 2.0)
     pundit (2.5.2)
       activesupport (>= 3.0.0)
@@ -674,7 +674,7 @@ GEM
     sidekiq-scheduler (6.0.1)
       rufus-scheduler (~> 3.2)
       sidekiq (>= 7.3, < 9)
-    sidekiq-throttled (2.0.0)
+    sidekiq-throttled (2.1.0)
       concurrent-ruby (>= 1.2.0)
       redis-prescription (~> 2.2)
       sidekiq (>= 8.0)
@@ -786,7 +786,7 @@ GEM
     websocket-extensions (0.1.5)
     wicked (2.0.0)
       railties (>= 3.0.7)
-    with_advisory_lock (7.0.2)
+    with_advisory_lock (7.5.0)
       activerecord (>= 7.2)
       zeitwerk (>= 2.7)
     xpath (3.2.0)

@@ -13,6 +13,13 @@ This is a service used within the NHS for managing and recording school-aged vac
 | [Training](https://github.com/nhsuk/manage-vaccinations-in-schools/deployments/training)     | [training.manage-vaccinations-in-schools.nhs.uk](https://training.manage-vaccinations-in-schools.nhs.uk) | External training            | ❌                  | `release` branch               | manual     | [`staging`](config/environments/staging.rb)       |
 | [Production](https://github.com/nhsuk/manage-vaccinations-in-schools/deployments/production) | [www.manage-vaccinations-in-schools.nhs.uk](https://www.manage-vaccinations-in-schools.nhs.uk)           | Live service                 | ✅                  | `release` branch               | manual     | [`production`](config/environments/production.rb) |
 
+## Documentation
+
+We have two Rdoc versions:
+
+1. [next](https://nhsuk.github.io/manage-vaccinations-in-schools/rdoc/next) - useful for dev work (based off the `next` branch).
+2. [release](https://nhsuk.github.io/manage-vaccinations-in-schools/rdoc/release) - useful for ops to debug live issues (based off the `release` branch).
+
 ## Development
 
 ### Prerequisites

@@ -14,6 +14,7 @@
 @forward "session-banner";
 @forward "status";
 @forward "sticky-navigation";
+@forward "sub-navigation";
 @forward "summary-list";
 @forward "tables";
 @forward "tag";

@@ -0,0 +1,67 @@
+@use "../vendor/nhsuk-frontend" as *;
+
+$_current-indicator-width: 4px;
+
+.app-sub-navigation {
+  @include nhsuk-font(16);
+}
+
+.app-sub-navigation__section {
+  margin: 0 0 nhsuk-spacing(4);
+  padding: 0;
+  list-style-type: none;
+
+  @include nhsuk-font(16);
+}
+
+.app-sub-navigation__link {
+  padding-top: nhsuk-spacing(1);
+  padding-bottom: nhsuk-spacing(1);
+
+  @include nhsuk-link-style-default;
+  @include nhsuk-link-style-no-visited-state;
+
+  &:link {
+    text-decoration: none;
+  }
+
+  &:not(:focus):hover {
+    color: $nhsuk-link-colour;
+  }
+}
+
+.app-sub-navigation__section-item {
+  margin-bottom: nhsuk-spacing(1);
+  padding-top: nhsuk-spacing(1);
+  padding-bottom: nhsuk-spacing(1);
+}
+
+.app-sub-navigation__section-item--current {
+  margin-left: -(nhsuk-spacing(2) + $_current-indicator-width);
+  padding-left: nhsuk-spacing(2);
+  border-left: $_current-indicator-width solid $nhsuk-link-colour;
+}
+
+.app-sub-navigation__link[aria-current] {
+  font-weight: bold;
+}
+
+.app-sub-navigation__section--nested {
+  margin-top: nhsuk-spacing(2);
+  margin-bottom: 0;
+  padding-left: nhsuk-spacing(4);
+}
+
+.app-sub-navigation__section--nested .app-sub-navigation__section-item::before {
+  content: "—";
+  margin-left: nhsuk-spacing(-4);
+  color: $nhsuk-secondary-text-colour;
+}
+
+.app-sub-navigation__theme {
+  margin: 0;
+  padding: nhsuk-spacing(2) nhsuk-spacing(3) nhsuk-spacing(2) 0;
+  color: $nhsuk-secondary-text-colour;
+
+  @include nhsuk-font(19, $weight: bold);
+}
@@ -203,12 +203,12 @@ def expiration_events
 
       not_vaccinated_programmes =
         all_programmes.reject do |programme|
-          patient.vaccination_status(programme:, academic_year:).vaccinated?
+          patient.programme_status(programme, academic_year:).vaccinated?
         end
 
       vaccinated_but_seasonal_programmes =
         all_programmes.select do |programme|
-          patient.vaccination_status(programme:, academic_year:).vaccinated? &&
+          patient.programme_status(programme, academic_year:).vaccinated? &&
             programme.seasonal?
         end
 

@@ -20,11 +20,13 @@ def call
         selected: active == :imported
       )
 
-      nav.with_item(
-        href: imports_issues_path,
-        text: issues_text,
-        selected: active == :issues
-      )
+      if policy(%i[import issue]).index?
+        nav.with_item(
+          href: imports_issues_path,
+          text: issues_text,
+          selected: active == :issues
+        )
+      end
 
       if policy(ImportantNotice).index?
         nav.with_item(

@@ -49,10 +49,12 @@ def non_seasonal_programme_rows(programme:)
   end
 
   def build_row(programme:, academic_year:)
+    programme_type = programme.type
+
     [
       name_for_programme(programme:, academic_year:),
-      status_for_programme(programme:, academic_year:),
-      notes_for_programme(programme:, academic_year:)
+      status_for_programme(programme_type:, academic_year:),
+      notes_for_programme(programme_type:, academic_year:)
     ]
   end
 
@@ -64,25 +66,26 @@ def name_for_programme(programme:, academic_year:)
     end
   end
 
-  def status_for_programme(programme:, academic_year:)
-    hash = programme_status_hash(programme:, academic_year:)
+  def status_for_programme(programme_type:, academic_year:)
+    hash = programme_status_hash(programme_type:, academic_year:)
     tag.strong(hash[:text], class: "nhsuk-tag nhsuk-tag--#{hash[:colour]}")
   end
 
-  def notes_for_programme(programme:, academic_year:)
-    programme_status_hash(programme:, academic_year:)[:details_text].presence ||
-      ""
+  def notes_for_programme(programme_type:, academic_year:)
+    programme_status_hash(programme_type:, academic_year:)[
+      :details_text
+    ].presence || ""
   end
 
-  def programme_status_hash(programme:, academic_year:)
+  def programme_status_hash(programme_type:, academic_year:)
     @programme_status_hash ||= {}
-    @programme_status_hash[programme.type] ||= {}
-    @programme_status_hash[programme.type][
+    @programme_status_hash[programme_type] ||= {}
+    @programme_status_hash[programme_type][
       academic_year
-    ] ||= PatientStatusResolver.new(
+    ] ||= PatientProgrammeStatusResolver.call(
       patient,
-      programme:,
+      programme_type:,
       academic_year:
-    ).programme
+    )
   end
 end
@@ -11,8 +11,8 @@ def initialize(
     show_parents: false,
     show_postcode: false,
     show_programme_status: true,
-    show_vaccinated_programme_status_only: false,
     show_school: false,
+    show_vaccinated_programme_status_only: false,
     show_year_group: false
   )
     @patient = patient
@@ -26,9 +26,9 @@ def initialize(
     @show_parents = show_parents
     @show_postcode = show_postcode
     @show_programme_status = show_programme_status
+    @show_school = show_school
     @show_vaccinated_programme_status_only =
       show_vaccinated_programme_status_only
-    @show_school = show_school
     @show_year_group = show_year_group
   end
 
@@ -71,10 +71,11 @@ def call
             row.with_value { patient_parents(patient) }
           end
         end
-        if show_programme_status && academic_year && programme_status_tag
+        if show_programme_status && academic_year &&
+             (value = programme_status_tag)
           summary_list.with_row do |row|
             row.with_key { "Programme status" }
-            row.with_value { programme_status_tag }
+            row.with_value { value }
           end
         end
       end
@@ -92,9 +93,10 @@ def call
               :show_nhs_number,
               :show_parents,
               :show_postcode,
+              :show_programme_status,
               :show_school,
-              :show_year_group,
-              :show_programme_status
+              :show_vaccinated_programme_status_only,
+              :show_year_group
 
   delegate :govuk_summary_list,
            :patient_date_of_birth,
@@ -108,8 +110,11 @@ def programme_status_tag
     status_by_programme =
       programmes.each_with_object({}) do |programme, hash|
         resolved_status =
-          status_resolver_for(programme).programme(
-            only_if_vaccinated: @show_vaccinated_programme_status_only
+          PatientProgrammeStatusResolver.call(
+            patient,
+            programme_type: programme.type,
+            academic_year:,
+            only_if_vaccinated: show_vaccinated_programme_status_only
           )
 
         next unless resolved_status
@@ -121,13 +126,4 @@ def programme_status_tag
 
     render AppAttachedTagsComponent.new(status_by_programme)
   end
-
-  def status_resolver_for(programme)
-    @status_resolver_for ||= {}
-    @status_resolver_for[programme.type] ||= PatientStatusResolver.new(
-      patient,
-      programme:,
-      academic_year:
-    )
-  end
 end
@@ -3,19 +3,19 @@
 <%= render AppCardComponent.new(feature: true) do |card| %>
   <% card.with_heading(level: 4, colour:) { heading } %>
 
-  <% unless vaccination_status.vaccinated? %>
-    <% if consent_status.no_response? %>
+  <% unless programme_status.vaccinated? %>
+    <% if consent_status_value == :no_response %>
       <% if latest_consent_request %>
         <p>No-one responded to our requests for consent.</p>
         <p>A request was sent on <%= latest_consent_request.sent_at.to_fs(:long) %>.</p>
       <% else %>
         <p>No requests have been sent.</p>
       <% end %>
-    <% elsif consent_status.conflicts? %>
+    <% elsif consent_status_value == :conflicts %>
       <p>You can only vaccinate if all respondents give consent.</p>
-    <% elsif consent_status.refused? %>
+    <% elsif consent_status_value == :refused %>
       <p><%= who_refused %> refused to give consent.</p>
-    <% elsif consent_status.given? %>
+    <% elsif consent_status_generator.status == :given %>
       <p><%= patient.full_name %> is ready for the vaccinator.</p>
     <% end %>