Merge branch main into feature/CCM-13476_print-supplier-statuses

Author: Ian-Hodges

.coverage

@@ -8,7 +8,8 @@ runs:
       run: |
         components_exit_code=0
         modules_exit_code=0
-
+        asdf plugin add trivy || true
+        asdf install trivy || true
         ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
         ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
 

.github/actions/trivy-iac/action.yaml

@@ -7,7 +7,8 @@ runs:
       shell: bash
       run: |
         exit_code=0
-
+        asdf plugin add trivy || true
+        asdf install trivy || true
         ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
 
         if [ $exit_code -ne 0 ]; then

.github/actions/trivy-package/action.yaml

@@ -166,8 +166,6 @@ jobs:
         uses: actions/checkout@v4
       - name: "Setup ASDF"
         uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
-      - name: "Perform Setup"
-        uses: ./.github/actions/setup
       - name: "Trivy IaC Scan"
         uses: ./.github/actions/trivy-iac
   trivy-package:
@@ -185,8 +183,6 @@ jobs:
         uses: actions/checkout@v4
       - name: "Setup ASDF"
         uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
-      - name: "Perform Setup"
-        uses: ./.github/actions/setup
       - name: "Trivy Package Scan"
         uses: ./.github/actions/trivy-package
   count-lines-of-code:

.github/workflows/stage-1-commit.yaml

@@ -76,9 +76,10 @@ jobs:
         with:
           node-version: ${{ inputs.nodejs_version }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/setup-python@v6
+      - name: "Setup Python"
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.14'
+          python-version: ${{ inputs.python_version }}
       - name: "Run unit test suite"
         run: |
           make test-unit
@@ -98,7 +99,10 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: python-coverage-reports
-          path: "src/**/coverage.xml"
+          path: |
+            src/**/coverage.xml
+            utils/**/coverage.xml
+            lambdas/**/coverage.xml
   test-lint:
     name: "Linting"
     runs-on: ubuntu-latest
@@ -109,6 +113,10 @@ jobs:
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v5
+      - name: "Setup Python"
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ inputs.python_version }}
       - uses: ./.github/actions/node-install
         with:
           node-version: ${{ inputs.nodejs_version }}
@@ -172,7 +180,7 @@ jobs:
         uses: actions/download-artifact@v5
         with:
           name: python-coverage-reports
-          path: src/
+          path: .
       - name: "Perform static analysis"
         uses: ./.github/actions/perform-static-analysis
         with:

.github/workflows/stage-2-test.yaml

@@ -12,6 +12,15 @@ version.json
 
 # Please, add your custom content below!
 
+# Don't track ephemeral local build files
+target/
+
+# Python build artifacts
+*.egg-info/
+.eggs/
+build/
+dist/
+
 # dependencies
 node_modules
 .node-version
@@ -25,6 +34,7 @@ dist
 output
 /schemas
 .env
+**/__pycache__
 
 # Python
 __pycache__/

.gitignore

@@ -18,3 +18,4 @@ d1c0a37078cbed4fbedae044e5cbafac71717af0:utils/utils/src/__tests__/key-generatio
 d1c0a37078cbed4fbedae044e5cbafac71717af0:utils/utils/src/__tests__/key-generation/get-private-key.test.ts:private-key:46
 f0eebf1356a699213340a45f64c6b990afcbb869:infrastructure/terraform/components/dl/ssm_parameter_mesh.tf:hashicorp-tf-password:11
 f0eebf1356a699213340a45f64c6b990afcbb869:infrastructure/terraform/components/dl/ssm_parameter_mesh.tf:hashicorp-tf-password:16
+e75d9e202c1fad2c9591c4fe0e411194bf19c8f6:infrastructure/terraform/components/dl/ssm_parameter_mesh_config.tf:hashicorp-tf-password:11

.gitleaksignore

@@ -8,8 +8,6 @@ terraform 1.10.1
 terraform-docs 0.19.0
 trivy 0.61.0
 vale 3.6.0
-
-
 # ==============================================================================
 # The section below is reserved for Docker image versions.
 

.tool-versions

@@ -9,15 +9,27 @@ include scripts/init.mk
 
 quick-start: config clean build serve-docs # Quick start target to setup, build and serve docs @Pipeline
 
-dependencies: # Install dependencies needed to build and test the project @Pipeline
-	# TODO: Implement installation of your project dependencies
+dependencies:: # Install dependencies needed to build and test the project @Pipeline
+	$(MAKE) -C src/cloudevents install
+	$(MAKE) -C src/eventcatalogasyncapiimporter install
+	$(MAKE) -C lambdas/mesh-poll install
+	$(MAKE) -C lambdas/mesh-download install
+	$(MAKE) -C utils/metric-publishers install
+	$(MAKE) -C utils/event-publisher-py install
+	$(MAKE) -C utils/py-mock-mesh install
+	./scripts/set-github-token.sh
+	npm install --workspaces
+	$(MAKE) generate
 
-generate: # Generate any autogenerated output @Pipeline
-	npm run generate-dependencies
+dependencies-docs:: # Install documentation dependencies @Pipeline
+	$(MAKE) -C docs install
 
-build: # Build the project artefact @Pipeline
+build: dependencies-docs # Build the project artefact @Pipeline
 	$(MAKE) -C docs build
 
+generate: # Generate any autogenerated output @Pipeline
+	npm run generate-dependencies
+
 debug:
 	$(MAKE) -C docs debug
 
@@ -32,17 +44,16 @@ clean:: # Clean-up project resources (main) @Operations
 	$(MAKE) -C src/cloudevents clean && \
 	$(MAKE) -C src/eventcatalogasyncapiimporter clean && \
 	$(MAKE) -C src/eventcatalogasyncapiimporter clean-output && \
+	$(MAKE) -C lambdas/mesh-poll clean && \
+	$(MAKE) -C lambdas/mesh-download clean && \
+	$(MAKE) -C utils/metric-publishers clean && \
+	$(MAKE) -C utils/event-publisher-py clean && \
+	$(MAKE) -C utils/py-mock-mesh clean && \
 	$(MAKE) -C src/python-schema-generator clean && \
 	rm -f .version
 	npm run clean
 
-config:: _install-dependencies version # Configure development environment (main) @Configuration
-	$(MAKE) -C docs install
-	$(MAKE) -C src/cloudevents install
-	$(MAKE) -C src/eventcatalogasyncapiimporter install
-	./scripts/set-github-token.sh
-	npm install
-	$(MAKE) generate
+config:: _install-dependencies version dependencies # Configure development environment (main) @Configuration
 
 serve-docs:
 	$(MAKE) -C docs s

Makefile

@@ -17,6 +17,7 @@ No requirements.
 | <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
 | <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
 | <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
+| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
 | <a name="input_enable_pdm_mock"></a> [enable\_pdm\_mock](#input\_enable\_pdm\_mock) | Flag indicating whether to deploy PDM mock API (should be false in production environments) | `bool` | `true` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
 | <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Flag to force deletion of S3 buckets | `bool` | `false` | no |
@@ -25,7 +26,7 @@ No requirements.
 | <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
 | <a name="input_log_level"></a> [log\_level](#input\_log\_level) | The log level to be used in lambda functions within the component. Any log with a lower severity than the configured value will not be logged: https://docs.python.org/3/library/logging.html#levels | `string` | `"INFO"` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
-| <a name="input_mesh_poll_schedule"></a> [mesh\_poll\_schedule](#input\_mesh\_poll\_schedule) | Schedule to poll MESH for messages | `string` | `"cron(0,30 8-16 ? * MON-FRI *)"` | no |
+| <a name="input_mesh_poll_schedule"></a> [mesh\_poll\_schedule](#input\_mesh\_poll\_schedule) | Schedule to poll MESH for messages | `string` | `"rate(5 minutes)"` | no |
 | <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used, affects things like DNS zone. Useful for named dev environments | `string` | `"main"` | no |
 | <a name="input_pdm_mock_access_token"></a> [pdm\_mock\_access\_token](#input\_pdm\_mock\_access\_token) | Mock access token for PDM API authentication (used in local/dev environments) | `string` | `"mock-pdm-token"` | no |
 | <a name="input_pdm_use_non_mock_token"></a> [pdm\_use\_non\_mock\_token](#input\_pdm\_use\_non\_mock\_token) | Whether to use the shared APIM access token from SSM (/component/environment/apim/access\_token) instead of the mock token | `bool` | `false` | no |
@@ -42,15 +43,19 @@ No requirements.
 | <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-kms.zip | n/a |
 | <a name="module_lambda_apim_key_generation"></a> [lambda\_apim\_key\_generation](#module\_lambda\_apim\_key\_generation) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
+| <a name="module_mesh_download"></a> [mesh\_download](#module\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_pdm_mock"></a> [pdm\_mock](#module\_pdm\_mock) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_pdm_poll"></a> [pdm\_poll](#module\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_print_status_handler"></a> [print\_status\_handler](#module\_print\_status\_handler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
 | <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
+| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
+| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
 | <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
 | <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
+| <a name="module_sqs_mesh_download"></a> [sqs\_mesh\_download](#module\_sqs\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_sqs_pdm_poll"></a> [sqs\_pdm\_poll](#module\_sqs\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_sqs_pdm_uploader"></a> [sqs\_pdm\_uploader](#module\_sqs\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_sqs_print_status_handler"></a> [sqs\_print\_status\_handler](#module\_sqs\_print\_status\_handler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.30/terraform-sqs.zip | n/a |