fix build

Author: anthony-nhs

.github/workflows/build_multi_arch_image.yml

@@ -92,6 +92,7 @@ jobs:
           BASE_FOLDER: "${{ inputs.base_folder }}"
           NO_CACHE: '${{ inputs.NO_CACHE }}'
           BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Check docker vulnerabilities - json output
         run: |
           make scan-image-json

.github/workflows/ci.yml

@@ -17,6 +17,10 @@ jobs:
     uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
     needs:
       - get_config_values
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
     with:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
     secrets:

.github/workflows/pull_request.yml

@@ -28,6 +28,10 @@ jobs:
       - get_config_values
     with:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
     secrets:
       SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
   pr_title_format_check:

.github/workflows/release.yml

@@ -18,6 +18,10 @@ jobs:
     uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
     needs:
       - get_config_values
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
     with:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
     secrets:

Makefile

@@ -43,7 +43,7 @@ build-node-24-python-3-14-image:
 	CONTAINER_NAME=node_24_python_3_14 BASE_VERSION_TAG=local-build BASE_FOLDER=languages IMAGE_TAG=local-build $(MAKE) build-image
 
 build-eps-storage-terraform-image:
-	CONTAINER_NAME=eps_storage_terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
+	CONTAINER_NAME=eps-storage-terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
 
 build-eps-data-extract-image:
 	CONTAINER_NAME=eps_data_extract BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
@@ -72,7 +72,14 @@ build-grype:
 build-grant:
 	docker build -f src/base/.devcontainer/Dockerfile.grant --tag local_grant:latest src/base/.devcontainer/
 
-build-image: build-syft build-grype build-grant guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
+build-tflint:
+	docker buildx build \
+		--secret id=GH_TOKEN,env=GITHUB_TOKEN \
+		-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
+		--tag local_tflint:latest \
+		src/projects/eps-storage-terraform/.devcontainer/
+
+build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
 	workspace_folder="$${CONTAINER_NAME}"; \
 	case "$${CONTAINER_NAME}" in \
 		eps_*) workspace_folder="$$(printf '%s' "$${CONTAINER_NAME}" | tr '_' '-')" ;; \

src/projects/eps-storage-terraform/.devcontainer/Dockerfile

@@ -1,6 +1,7 @@
 ARG BASE_VERSION_TAG=latest
 ARG BASE_IMAGE=ghcr.io/nhsdigital/eps-devcontainers/node_24_python_3_13:${BASE_VERSION_TAG}
 
+FROM local_tflint:latest AS tflint-build
 FROM ${BASE_IMAGE}
 
 ARG SCRIPTS_DIR=/usr/local/share/eps
@@ -26,6 +27,7 @@ USER root
 COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
 WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
 RUN ./root_install.sh
+COPY --from=tflint-build /tflint /usr/local/bin/tflint
 
 USER vscode
 

src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint

@@ -0,0 +1,13 @@
+FROM serversideup/github-cli:2.89.0 AS build
+ARG TARGETARCH
+ARG TFLINT_VERSION="v0.61.0"
+COPY --chmod=755 scripts/install_tflint.sh /tmp/install_tflint.sh
+RUN --mount=type=secret,id=GH_TOKEN,env=GH_TOKEN \
+    INSTALL_DIR=/tmp/tflint/ \
+    ARCH="${TARGETARCH}" \
+    VERSION="${TFLINT_VERSION}" \
+    /tmp/install_tflint.sh
+
+FROM scratch
+COPY --from=build /tmp/tflint/tflint /tflint
+ENTRYPOINT ["/tflint"]

src/projects/eps-storage-terraform/.devcontainer/scripts/install_tflint.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+DEFAULT_INSTALL_DIR="/usr/local/bin"
+INSTALL_DIR="${INSTALL_DIR:-$DEFAULT_INSTALL_DIR}"
+
+case "${TARGETARCH:-}" in
+	amd64|arm64)
+		TFLINT_ARCH="${TARGETARCH}"
+		;;
+	*)
+		echo "Unsupported or missing TARGETARCH: '${TARGETARCH:-}'"
+		echo "Expected one of: amd64, arm64"
+		exit 1
+		;;
+esac
+
+if ! command -v curl >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
+	apt-get update
+	apt-get install -y --no-install-recommends curl unzip ca-certificates
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+	echo "GitHub CLI (gh) is required for attestation verification but was not found"
+	exit 1
+fi
+
+TFLINT_URL="https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_${TFLINT_ARCH}.zip"
+TFLINT_ASSET_NAME="tflint_linux_${TFLINT_ARCH}.zip"
+CHECKSUMS_URL="https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/checksums.txt"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "${tmp_dir}"' EXIT
+
+curl -fsSL "${CHECKSUMS_URL}" -o "${tmp_dir}/checksums.txt"
+gh attestation verify "${tmp_dir}/checksums.txt" -R terraform-linters/tflint
+
+curl -fsSL "${TFLINT_URL}" -o "${tmp_dir}/${TFLINT_ASSET_NAME}"
+(
+	cd "${tmp_dir}"
+	sha256sum --ignore-missing -c checksums.txt
+)
+
+unzip -q "${tmp_dir}/${TFLINT_ASSET_NAME}" -d "${tmp_dir}"
+
+mkdir -p "$INSTALL_DIR"
+install -m 0755 "$tmp_dir/tflint" "${INSTALL_DIR}/tflint"

src/projects/eps-storage-terraform/.devcontainer/scripts/root_install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
 # clean up
 apt-get clean