Merge branch 'main' into aea-6540-enable-notifications-boots

tstephen-nhs · web-flow · commit 47d26cc2637c · 2026-04-21T14:25:28.000+01:00
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
     "args": {
       "DOCKER_GID": "${env:DOCKER_GID:}",
       "IMAGE_NAME": "node_24_python_3_12",
-      "IMAGE_VERSION": "v1.4.4",
+      "IMAGE_VERSION": "v1.4.8",
       "USER_UID": "${localEnv:USER_ID:}",
       "USER_GID": "${localEnv:GROUP_ID:}"
     },
diff --git a/.gitallowed b/.gitallowed
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
diff --git a/.github/workflows/auto_approve_dependabot.yml b/.github/workflows/auto_approve_dependabot.yml
@@ -0,0 +1,21 @@
+name: Auto-approve dependency updates
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '*/30 * * * *'
+
+permissions: {}
+jobs:
+  auto-approve-dependabot:
+    runs-on: ubuntu-22.04
+    environment: create_pull_request
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Auto approve and enable auto-merge
+        uses: NHSDigital/eps-dependabot-approve@da0503449b218ccd99bc547e242007d5514e4d2f
+        with:
+          AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
+          AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
@@ -17,7 +17,7 @@ jobs:
       verify_published_from_main_image: true
 
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -40,7 +40,7 @@ jobs:
 
   tag_release:
     needs: [quality_checks, get_commit_id, get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/delete_old_cloudformation_stacks.yml b/.github/workflows/delete_old_cloudformation_stacks.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.PROXYGEN_PTL_ROLE }}
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
@@ -1,33 +1,19 @@
 name: deploy_pr
-
 on:
   pull_request:
     branches: [main]
-
 permissions: {}
-
 jobs:
-  dependabot-auto-approve-and-merge:
-    needs: quality_checks
-    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
-    permissions:
-      contents: write
-      pull-requests: write
-    secrets:
-      AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
-      AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
-
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
       packages: read
     with:
       verify_published_from_main_image: false
-
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -37,20 +23,17 @@ jobs:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
     secrets:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
   pr_title_format_check:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       pull-requests: write
-
   get_issue_number:
     runs-on: ubuntu-22.04
     needs: quality_checks
     outputs:
       issue_number: ${{steps.get_issue_number.outputs.result}}
-
     steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
         name: get issue number
         id: get_issue_number
         with:
@@ -69,10 +52,9 @@ jobs:
               ).data[0].number;
             }
           result-encoding: string
-
   tag_release:
     needs: [get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
@@ -82,7 +64,6 @@ jobs:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
       branch_name: ${{ github.event.pull_request.head.ref }}
       tag_format: ${{ needs.get_config_values.outputs.tag_format }}
-
   get_commit_id:
     runs-on: ubuntu-22.04
     outputs:
@@ -92,7 +73,6 @@ jobs:
         id: commit_id
         run: |
           echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-
   package_code:
     needs: [get_issue_number, get_config_values]
     uses: ./.github/workflows/run_package_code_and_api.yml
@@ -102,7 +82,6 @@ jobs:
       id-token: write
     with:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
-
   release_code:
     needs: [get_issue_number, package_code, get_commit_id, get_config_values]
     uses: ./.github/workflows/run_release_code_and_api.yml
@@ -151,7 +130,6 @@ jobs:
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
       PROXYGEN_ROLE: ${{ secrets.PROXYGEN_PTL_ROLE }}
       REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
-
   release_sandbox_code:
     needs: [get_issue_number, package_code, get_commit_id, get_config_values]
     uses: ./.github/workflows/run_release_code_and_api.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,15 +7,15 @@ permissions: {}
 
 jobs:
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
       packages: read
     with:
       verify_published_from_main_image: true
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -38,7 +38,7 @@ jobs:
 
   tag_release:
     needs: [quality_checks, get_commit_id, get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/run_package_code_and_api.yml b/.github/workflows/run_package_code_and_api.yml
@@ -55,7 +55,7 @@ jobs:
           cp packages/specification/dist/eps-prescription-status-update-api.resolved.json .aws-sam/build/specification/
           cp packages/specification/dist/eps-custom-prescription-status-update-api.resolved.json .aws-sam/build/specification/
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         name: Upload build artifact
         with:
           name: packaged_code
@@ -78,7 +78,7 @@ jobs:
           cp packages/specification/dist/eps-custom-prescription-status-update-api.resolved.json .aws-sam/build/specification/
 
       # Readme is included to stop the action flattening the folder structure of aws-sam/build when it is the only item to upload
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         name: Upload sandbox build artifact
         with:
           name: packaged_sandbox_code
diff --git a/.github/workflows/run_release_code_and_api.yml b/.github/workflows/run_release_code_and_api.yml
@@ -165,7 +165,7 @@ jobs:
             .github
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -254,7 +254,7 @@ jobs:
           AWS_MAX_ATTEMPTS: 20
 
       - name: Configure AWS Credentials for api release
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
diff --git a/.github/workflows/update_dev_container_version.yml b/.github/workflows/update_dev_container_version.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Update devcontainer version
-        uses: NHSDigital/eps-update-devcontainer@dc3a8c5f11e7226ee4f5f2bb35bd0d1265092306
+        uses: NHSDigital/eps-update-devcontainer@83f4b56f1942635f2c05b7fe569142459b8c3882
         with:
           calling_repo_base_branch: main
           CREATE_PULL_REQUEST_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_APP_ID }}
diff --git a/.gitleaksignore b/.gitleaksignore
@@ -0,0 +1,20 @@
+49ee7453e3f8aad31483888945a0af451cecca94:bruno/PSU/Pull_Request_Deployment/Apigee/Apigee_PULL_REQUEST_Notify_Callback.yml:generic-api-key:148
+49ee7453e3f8aad31483888945a0af451cecca94:bruno/PSU/Pull_Request_Deployment/Apigee/Apigee_PULL_REQUEST_Notify_Callback.yml:generic-api-key:198
+4202b41adcbac609aa626b5677dccb92c2141d14:bruno/PSU Collection/Pull Request Deployment/Apigee/Apigee PULL REQUEST Notify Callback.yml:generic-api-key:148
+4202b41adcbac609aa626b5677dccb92c2141d14:bruno/PSU Collection/Pull Request Deployment/Apigee/Apigee PULL REQUEST Notify Callback.yml:generic-api-key:198
+4c0318af471cb340e9f80f5b052bc9ffd96fc8a0:packages/nhsNotifyLambda/.jest/setEnvVars.js:generic-api-key:7
+c5a2eaf8199a2d63d11992703de5100f40e2441b:packages/nhsNotifyLambda/.jest/setEnvVars.js:generic-api-key:7
+06849808acb57396da9ee19ad49c9c7303285930:packages/nhsNotifyLambda/.jest/setEnvVars.js:generic-api-key:7
+2500c61930eda7dd415281cbf16f65db40afa29d:SAMtemplates/functions/main.yaml:generic-api-key:392
+0f940ea336b24c2d41a6612789f9263ff976a4b0:packages/nhsNotifyLambda/src/utils.ts:generic-api-key:17
+09519c4f2eac4d0275e645ff698ff095e0c8f607:packages/checkPrescriptionStatusUpdates/tests/testHander.test.ts:generic-api-key:67
+65004a5340565126d2309b28e4a2ffc49ff89216:packages/checkPrescriptionStatusUpdates/tests/testHander.test.ts:generic-api-key:67
+036ce12776ece652688e374c169d25cfb0c32be6:packages/checkPrescriptionStatusUpdates/tests/testHander.test.ts:generic-api-key:80
+036ce12776ece652688e374c169d25cfb0c32be6:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:136
+036ce12776ece652688e374c169d25cfb0c32be6:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:185
+8501c6774eaa45acf47777dc16233cda3cdff73f:packages/checkPrescriptionStatusUpdates/tests/testHander.test.ts:generic-api-key:119
+8501c6774eaa45acf47777dc16233cda3cdff73f:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:136
+8501c6774eaa45acf47777dc16233cda3cdff73f:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:185
+13c3d6d3754723fa2fa2fa47deac58d84844a285:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:131
+13c3d6d3754723fa2fa2fa47deac58d84844a285:packages/checkPrescriptionStatusUpdates/tests/testDynamoDBclient.test.ts:generic-api-key:176
+796fda23a4f8ab9c2100d414e90ba7a9390ff287:packages/specification/eps-prescription-status-update-api.yaml:generic-api-key:6
diff --git a/.grype.yaml b/.grype.yaml
@@ -1,3 +1,5 @@
 ignore:
   # path-to-regexp - dependency of aws-sdk-client-mock
   - vulnerability: GHSA-j3q9-mxjg-w52f
+  # protobufjs - dependency of @redocly/cli
+  - vulnerability: GHSA-xq3m-2v4x-88gg
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -179,15 +179,13 @@ repos:
         types_or: [sh, shell]
         pass_filenames: false
 
-  - repo: local
-    hooks:
-      - id: git-secrets
-        name: Git Secrets
-        description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
+      - id: gitleaks
+        name: Git Leaks
+        description: gitleaks scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
         entry: bash
         args:
           - -c
-          - 'git-secrets --pre_commit_hook'
+          - "gitleaks git --pre-commit --redact --staged --verbose"
         language: system
 fail_fast: true
 default_stages: [pre-commit]
diff --git a/SAMtemplates/functions/main.yaml b/SAMtemplates/functions/main.yaml
@@ -137,7 +137,7 @@ Resources:
           SQS_SALT: !Ref SQSSaltSecret
           # Remove this once we've confirmed that product ID based filtering is working as expected and we
           # no longer need the ability to switch back to the old filtering method
-          USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: false
+          USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: true
           ENABLED_SYSTEMS_PARAM: !Ref EnabledSystemsParam
           #
           ENABLED_APPLICATION_IDS_PARAM: !Ref EnabledSupplierApplicationIDsParam
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -40,7 +40,7 @@ pre-commit = "^4.5.1"
 black = "^26.3.1"
 flake8 = "^7.3.0"
 jinja2 = "^3.1.5"
-click = "^8.3.1"
+click = "^8.3.2"
 rich = "^14.3.3"
 
 [build-system]
diff --git a/zizmor.yml b/zizmor.yml
@@ -2,9 +2,9 @@ rules:
   unpinned-images:
     # these workflows use unpinned images because they are using a full image passed in that contains the tag
     ignore:
-      - run_release_code_and_api.yml:146:7
-      - run_regression_tests.yml:26:7
-      - run_package_code_and_api.yml:16:7
+      - run_release_code_and_api.yml:146:18
+      - run_regression_tests.yml:26:18
+      - run_package_code_and_api.yml:16:18
   secrets-outside-env:
     # these are ignored because they are using known secrets
     ignore:
