Skip to content

Commit 5db1bda

Browse files
anthony-nhsanthony-nhs
committed
new qc
1 parent 2b085e0 commit 5db1bda

12 files changed

Lines changed: 88 additions & 28 deletions

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"args": {
77
"DOCKER_GID": "${env:DOCKER_GID:}",
88
"IMAGE_NAME": "node_24_python_3_14_java_24",
9-
"IMAGE_VERSION": "v1.2.0",
9+
"IMAGE_VERSION": "v1.4.4",
1010
"USER_UID": "${localEnv:USER_ID:}",
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
}

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# restrict access to approving workflow changes
2+
.github/workflows/ @NHSDigital/eps-admins

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,24 @@ on:
44
push:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
7+
permissions: {}
98

109
jobs:
1110
get_config_values:
12-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
11+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
12+
permissions:
13+
attestations: read
14+
contents: read
15+
packages: read
1316
with:
1417
verify_published_from_main_image: true
1518
quality_checks:
16-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
19+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
1720
needs: [get_config_values]
21+
permissions:
22+
contents: read
23+
id-token: write
24+
packages: read
1825
secrets:
1926
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2027
with:
@@ -32,20 +39,24 @@ jobs:
3239
3340
tag_release:
3441
needs: [quality_checks, get_commit_id, get_config_values]
35-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
42+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
3643
permissions:
3744
id-token: write
3845
contents: write
46+
packages: write
3947
with:
4048
dry_run: true
4149
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
4250
branch_name: main
4351
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
44-
secrets: inherit
4552

4653
package_code:
4754
needs: [tag_release, get_config_values]
4855
uses: ./.github/workflows/sam_package_code.yml
56+
permissions:
57+
contents: read
58+
id-token: write
59+
packages: read
4960
with:
5061
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
5162

‎.github/workflows/delete_old_cloudformation_stacks.yml‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,23 @@
11
name: "Delete old cloudformation stacks"
22

3-
# Controls when the action will run - in this case triggered manually
43
on:
54
workflow_dispatch:
65
schedule:
76
- cron: "0 0 * * *"
87

9-
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
8+
permissions: {}
109
jobs:
11-
# This workflow contains a single job called "combine-prs"
1210
delete-old-cloudformation-stacks:
13-
# The type of runner that the job will run on
1411
runs-on: ubuntu-22.04
1512
permissions:
1613
id-token: write
1714
contents: read
1815

19-
# Steps represent a sequence of tasks that will be executed as part of the job
2016
steps:
2117
- name: Checkout local github scripts
2218
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2319
with:
24-
ref: ${{ env.BRANCH_NAME }}
20+
persist-credentials: false
2521
sparse-checkout: |
2622
.github/scripts
2723

‎.github/workflows/pull_request.yml‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,42 @@ on:
44
pull_request:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
7+
permissions: {}
98

109
jobs:
1110
dependabot-auto-approve-and-merge:
1211
needs: quality_checks
13-
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@5ac2707dd9cd60ad127275179495b9c890d74711
12+
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
13+
permissions:
14+
contents: write
15+
pull-requests: write
1416
secrets:
1517
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1618
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1719
get_config_values:
18-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
20+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
21+
permissions:
22+
attestations: read
23+
contents: read
24+
packages: read
1925
with:
2026
verify_published_from_main_image: false
2127
quality_checks:
22-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
28+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
2329
needs: [get_config_values]
30+
permissions:
31+
contents: read
32+
id-token: write
33+
packages: read
2434
with:
2535
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2636
secrets:
2737
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2838

2939
pr_title_format_check:
30-
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@5ac2707dd9cd60ad127275179495b9c890d74711
40+
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
41+
permissions:
42+
pull-requests: write
3143

3244
get_issue_number:
3345
runs-on: ubuntu-22.04
@@ -58,16 +70,16 @@ jobs:
5870

5971
tag_release:
6072
needs: [get_config_values]
61-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
73+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
6274
permissions:
6375
id-token: write
6476
contents: write
77+
packages: write
6578
with:
6679
dry_run: true
6780
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
6881
branch_name: ${{ github.event.pull_request.head.ref }}
6982
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
70-
secrets: inherit
7183

7284
get_commit_id:
7385
runs-on: ubuntu-22.04
@@ -82,6 +94,10 @@ jobs:
8294
package_code:
8395
needs: [get_issue_number, get_config_values]
8496
uses: ./.github/workflows/sam_package_code.yml
97+
permissions:
98+
contents: read
99+
id-token: write
100+
packages: read
85101
with:
86102
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
87103

‎.github/workflows/release.yml‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,24 @@ name: deploy to environments
33
on:
44
workflow_dispatch:
55

6-
env:
7-
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
6+
permissions: {}
87

98
jobs:
109
get_config_values:
11-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
10+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
11+
permissions:
12+
attestations: read
13+
contents: read
14+
packages: read
1215
with:
1316
verify_published_from_main_image: true
1417
quality_checks:
15-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
18+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
1619
needs: [get_config_values]
20+
permissions:
21+
contents: read
22+
id-token: write
23+
packages: read
1724
secrets:
1825
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
1926
with:
@@ -31,10 +38,11 @@ jobs:
3138
3239
tag_release:
3340
needs: [quality_checks, get_commit_id, get_config_values]
34-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
41+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
3542
permissions:
3643
id-token: write
3744
contents: write
45+
packages: write
3846
with:
3947
dry_run: false
4048
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
@@ -49,6 +57,10 @@ jobs:
4957
package_code:
5058
needs: [tag_release, get_config_values]
5159
uses: ./.github/workflows/sam_package_code.yml
60+
permissions:
61+
contents: read
62+
id-token: write
63+
packages: read
5264
with:
5365
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
5466

‎.github/workflows/sam_package_code.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
pinned_image:
77
type: string
88
required: true
9+
permissions: {}
10+
911
jobs:
1012
sam_package_code:
1113
runs-on: ubuntu-22.04
@@ -26,7 +28,7 @@ jobs:
2628
- name: Checkout code
2729
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2830
with:
29-
ref: ${{ env.BRANCH_NAME }}
31+
persist-credentials: false
3032
- name: make install
3133
run: |
3234
make install

‎.github/workflows/sam_release_code.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ on:
4545
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
4646
required: false
4747

48+
permissions: {}
49+
4850
jobs:
4951
sam_release_code:
5052
runs-on: ubuntu-22.04
@@ -66,7 +68,7 @@ jobs:
6668
- name: Checkout local github actions
6769
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
6870
with:
69-
ref: ${{ env.BRANCH_NAME }}
71+
persist-credentials: false
7072
fetch-depth: 0
7173
sparse-checkout: |
7274
.github
@@ -102,6 +104,7 @@ jobs:
102104
- name: Checkout gh-pages
103105
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
104106
with:
107+
persist-credentials: true
105108
ref: gh-pages
106109
path: gh-pages
107110

‎.github/workflows/sync_copilot.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
workflow_dispatch:
55
schedule:
66
- cron: '0 6 * * 1'
7+
permissions: {}
78

89
jobs:
910
sync-copilot-instructions:

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,4 @@ node_modules/
4444
vendor
4545
cfn_guard_output/
4646
.trivy_out/
47+
.sbom/

0 commit comments

Comments
 (0)