Skip to content

Commit 21b2499

Browse files
m-houstonm-houston
committed
Merge branch 'main' into CCM-12869-excel-parser
# Conflicts: # AGENTS.md # README.md # package-lock.json # packages/event-builder/jest.config.ts # packages/event-builder/src/__tests__/pack-specification-event-builder.test.ts # packages/event-builder/src/letter-variant-event-builder.ts # packages/event-builder/src/pack-specification-event-builder.ts # packages/event-builder/src/supplier-allocation-event-builder.ts # packages/event-builder/src/supplier-event-builder.ts # packages/event-builder/src/supplier-pack-event-builder.ts # packages/event-builder/src/volume-group-event-builder.ts # packages/events/package.json # packages/events/src/cli/generate-erd.ts # packages/events/src/cli/generate-json.ts # packages/events/src/domain/__tests__/specification.test.ts # packages/events/src/domain/constraint.ts # packages/events/src/domain/pack-specification.ts # packages/events/src/examples/specification-examples.ts
2 parents 261a594 + 60fa864 commit 21b2499

118 files changed

Lines changed: 15112 additions & 6469 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@
2525
- [ ] I have added tests to cover my changes
2626
- [ ] I have updated the documentation accordingly
2727
- [ ] This PR is a result of pair or mob programming
28+
<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
29+
- [ ] This PR includes code generated by a coding agent
2830

2931
---
3032

‎.github/SECURITY.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ If you wish to notify us of a vulnerability via email, please include detailed i
2121

2222
You can reach us at:
2323

24-
- _[ A product team email address ]_
25-
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
24+
- [england.nhsnotify@nhs.net](mailto:england.nhsnotify@nhs.net)
25+
- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
2626

2727
### NCSC
2828

‎.github/actions/build-docs/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ runs:
88
using: "composite"
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v4
12-
- uses: actions/setup-node@v4
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1313
with:
1414
node-version: 18
1515
- name: Npm cli install

‎.github/actions/bundle-ddb-publish/action.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: "Bundle ddb-publish"
2+
description: "Build and package the ddb-publish release bundle (ddb-publish-bundle.tgz) from the workspace sources."
3+
4+
inputs:
5+
node-version:
6+
description: "Node.js version to use"
7+
required: true
8+
run-typecheck:
9+
description: "Run workspace typecheck before bundling"
10+
required: false
11+
default: "true"
12+
13+
outputs:
14+
tarball-path:
15+
description: "Path to the generated tarball"
16+
value: ${{ steps.bundle.outputs.tarball_path }}
17+
18+
runs:
19+
using: "composite"
20+
steps:
21+
- name: Set up Node.js
22+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
23+
with:
24+
node-version: "${{ inputs.node-version }}"
25+
cache: npm
26+
27+
- name: Install dependencies
28+
shell: bash
29+
run: |
30+
set -euo pipefail
31+
npm ci
32+
33+
- name: Generate dependencies
34+
shell: bash
35+
run: |
36+
set -euo pipefail
37+
npm run generate-dependencies --workspaces --if-present
38+
39+
- name: Typecheck
40+
if: inputs.run-typecheck == 'true'
41+
shell: bash
42+
run: |
43+
set -euo pipefail
44+
npm run typecheck --workspaces --if-present
45+
46+
- name: Build ddb-publish bundle
47+
shell: bash
48+
run: |
49+
set -euo pipefail
50+
npm run bundle:release --workspace @supplier-config/ddb-publisher
51+
52+
- name: Smoke-test bundle
53+
shell: bash
54+
run: |
55+
set -euo pipefail
56+
node packages/ddb-publisher/artifacts/ddb-publish/index.cjs --help > /dev/null
57+
58+
- name: Package tarball
59+
id: bundle
60+
shell: bash
61+
run: |
62+
set -euo pipefail
63+
tarball="ddb-publish-bundle.tgz"
64+
tar -czf "$tarball" -C packages/ddb-publisher/artifacts/ddb-publish .
65+
echo "tarball_path=$tarball" >> "$GITHUB_OUTPUT"

‎.github/actions/check-todo-usage/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Check Todo usage"
2+
description: "Check Todo usage"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Check Todo usage"
7+
shell: bash
8+
run: |
9+
export BRANCH_NAME=origin/${{ github.event.repository.default_branch }}
10+
check=branch ./scripts/githooks/check-todos.sh

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip
@@ -44,7 +44,7 @@ runs:
4444
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4545
- name: "Authenticate to send the report"
4646
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@v4
47+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
4848
with:
4949
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5050
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/lint-terraform/action.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,16 @@ inputs:
77
runs:
88
using: "composite"
99
steps:
10+
- name: "Install Terraform binary"
11+
shell: bash
12+
run: |
13+
asdf plugin add terraform || true
14+
asdf install terraform || true
1015
- name: "Check Terraform format"
1116
shell: bash
1217
run: |
1318
check_only=true scripts/githooks/check-terraform-format.sh
1419
- name: "Validate Terraform"
1520
shell: bash
1621
run: |
17-
stacks=${{ inputs.root-modules }}
18-
for dir in $(find infrastructure/environments -maxdepth 1 -mindepth 1 -type d; echo ${stacks//,/$'\n'}); do
19-
dir=$dir opts='-backend=false' make terraform-init
20-
dir=$dir make terraform-validate
21-
done
22+
make terraform-validate-all

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v4
35+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v4
50+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip
@@ -58,7 +58,7 @@ runs:
5858
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5959
- name: "Authenticate to send the reports"
6060
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@v4
61+
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6
6262
with:
6363
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6464
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
16+
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy Package Scan"
3+
# description: "Scan project packages using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Package Scan"
8+
# shell: bash
9+
# run: |
10+
# exit_code=0
11+
# asdf plugin add trivy || true
12+
# asdf install trivy || true
13+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
14+
15+
# if [ $exit_code -ne 0 ]; then
16+
# echo "Trivy has detected package vulnerabilities. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
17+
# exit 1
18+
# fi

0 commit comments

Comments
 (0)