Skip to content

Commit ab71631

Browse files
Ian-HodgesIan-Hodges
committed
Merge branch 'main' into feature/CCM-14615_unit-test-quickening
2 parents 2295237 + b69ddd2 commit ab71631

187 files changed

Lines changed: 2687 additions & 1256 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
- [ ] I have added tests to cover my changes
2626
- [ ] I have updated the documentation accordingly
2727
- [ ] This PR is a result of pair or mob programming
28-
- [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.
28+
<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
2929

3030
---
3131

‎.github/actions/acceptance-tests/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ runs:
6060
ENVIRONMENT: ${{ inputs.targetEnvironment }}
6161
- name: Archive integration test results
6262
if: ${{ inputs.testType == 'integration' }}
63-
uses: actions/upload-artifact@v4
63+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
6464
with:
6565
name: Integration test report
6666
path: "tests/playwright/playwright-report"

‎.github/actions/build-docs/action.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ runs:
1414
using: "composite"
1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v5
17+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
1818
- uses: ./.github/actions/node-install
1919
with:
2020
node-version: ${{ inputs.node-version }}
@@ -24,15 +24,15 @@ runs:
2424
run: npm ci
2525
shell: bash
2626
- name: Setup Ruby
27-
uses: ruby/setup-ruby@v1.267.0
27+
uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
2828
with:
2929
ruby-version: "3.4.7" # Not needed with a .ruby-version file
3030
bundler-cache: true # Enable automatic gem caching
3131
cache-version: 0 # Increment this number if you need to re-download cached gems
3232
working-directory: "./docs"
3333
- name: Setup Pages
3434
id: pages
35-
uses: actions/configure-pages@v5
35+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
3636
- name: Build with Jekyll
3737
working-directory: ./docs
3838
# Outputs to the './_site' directory by default
@@ -45,7 +45,7 @@ runs:
4545
VERSION: ${{ inputs.version }}
4646
- name: Upload artifact
4747
# Automatically uploads an artifact from the './_site' directory by default
48-
uses: actions/upload-pages-artifact@v3
48+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
4949
with:
5050
path: "docs/_site/"
5151
name: jekyll-docs-${{ inputs.version }}
@@ -55,7 +55,7 @@ runs:
5555
shell: bash
5656

5757
- name: Upload artifact
58-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
5959
with:
6060
path: "artifact.tar"
6161
name: schemas-${{ inputs.version }}

‎.github/actions/build-schemas/action.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1313
with:
1414
node-version: 18
1515

@@ -28,7 +28,7 @@ runs:
2828
shell: bash
2929

3030
- name: Upload artifact
31-
uses: actions/upload-artifact@v4
31+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
3232
with:
3333
path: "artifact.tar"
3434
name: schemas-${{ inputs.version }}

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ runs:
3333
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3434
- name: "Upload CLOC report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
36+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
3737
with:
3838
name: lines-of-code-report.json.zip
3939
path: ./lines-of-code-report.json.zip
@@ -45,7 +45,7 @@ runs:
4545
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4646
- name: "Authenticate to send the report"
4747
if: steps.check.outputs.secrets_exist == 'true'
48-
uses: aws-actions/configure-aws-credentials@v4
48+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
4949
with:
5050
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5151
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/node-install/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ runs:
1313
using: 'composite'
1414
steps:
1515
- name: 'Use Node.js'
16-
uses: actions/setup-node@v6
16+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
1717
with:
1818
node-version: '${{ inputs.node-version }}'
1919
cache: 'npm'

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ runs:
3333
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3434
- name: "Upload SBOM report as an artefact"
3535
if: ${{ !env.ACT }}
36-
uses: actions/upload-artifact@v4
36+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
3737
with:
3838
name: sbom-repository-report.json.zip
3939
path: ./sbom-repository-report.json.zip
@@ -49,7 +49,7 @@ runs:
4949
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
5050
- name: "Upload vulnerabilities report as an artefact"
5151
if: ${{ !env.ACT }}
52-
uses: actions/upload-artifact@v4
52+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
5353
with:
5454
name: vulnerabilities-repository-report.json.zip
5555
path: ./vulnerabilities-repository-report.json.zip
@@ -60,7 +60,7 @@ runs:
6060
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
6161
- name: "Authenticate to send the reports"
6262
if: steps.check.outputs.secrets_exist == 'true'
63-
uses: aws-actions/configure-aws-credentials@v4
63+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
6464
with:
6565
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6666
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
name: "Trivy IaC Scan"
2-
description: "Scan Terraform IaC using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Terraform IaC Scan"
7-
shell: bash
8-
run: |
9-
components_exit_code=0
10-
modules_exit_code=0
11-
asdf plugin add trivy || true
12-
asdf install trivy || true
13-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1516

16-
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17-
echo "Trivy misconfigurations detected."
18-
exit 1
19-
fi
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1-
name: "Trivy Package Scan"
2-
description: "Scan project packages using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Package Scan"
7-
shell: bash
8-
run: |
9-
exit_code=0
10-
asdf plugin add trivy || true
11-
asdf install trivy || true
12-
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy Package Scan"
3+
# description: "Scan project packages using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Package Scan"
8+
# shell: bash
9+
# run: |
10+
# exit_code=0
11+
# asdf plugin add trivy || true
12+
# asdf install trivy || true
13+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1314

14-
if [ $exit_code -ne 0 ]; then
15-
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16-
exit 1
17-
fi
15+
# if [ $exit_code -ne 0 ]; then
16+
# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
17+
# exit 1
18+
# fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,11 @@ jobs:
3636
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
3737
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3838
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
39-
skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
39+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
40+
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
4041
steps:
4142
- name: "Checkout code"
42-
uses: actions/checkout@v5
43+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
4344
- name: "Set CI/CD variables"
4445
id: variables
4546
run: |
@@ -76,26 +77,27 @@ jobs:
7677
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
7778
echo "pr_number=" >> $GITHUB_OUTPUT
7879
fi
79-
- name: "Determine if Trivy package scan should be skipped"
80-
id: skip_trivy
81-
env:
82-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83-
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
84-
run: |
85-
if [[ -z "$PR_NUMBER" ]]; then
86-
echo "No pull request detected; Trivy package scan will run."
87-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
88-
exit 0
89-
fi
80+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
81+
# - name: "Determine if Trivy package scan should be skipped"
82+
# id: skip_trivy
83+
# env:
84+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
# PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
86+
# run: |
87+
# if [[ -z "$PR_NUMBER" ]]; then
88+
# echo "No pull request detected; Trivy package scan will run."
89+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
90+
# exit 0
91+
# fi
9092

91-
labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
92-
echo "Labels on PR #$PR_NUMBER: $labels"
93+
# labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
94+
# echo "Labels on PR #$PR_NUMBER: $labels"
9395

94-
if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
95-
echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
96-
else
97-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
98-
fi
96+
# if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
97+
# echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
98+
# else
99+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
100+
# fi
99101
- name: "List variables"
100102
run: |
101103
export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
@@ -119,7 +121,8 @@ jobs:
119121
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
120122
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
121123
python_version: "${{ needs.metadata.outputs.python_version }}"
122-
skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
124+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
125+
# skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
123126
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
124127
version: "${{ needs.metadata.outputs.version }}"
125128
# secrets: inherit
@@ -160,7 +163,7 @@ jobs:
160163
id-token: write
161164
if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened'))
162165
steps:
163-
- uses: actions/checkout@v5.0.0
166+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
164167
- name: Trigger dynamic environment creation
165168
env:
166169
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}

0 commit comments

Comments
 (0)