Skip to content

Commit 871eab2

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
Merge pull request #99 from NHSDigital/CCM-11345-Manual-Repo-Sync
CCM-11345 manual repo sync
2 parents 087a895 + df5b8f6 commit 871eab2

25 files changed

Lines changed: 763 additions & 30 deletions

File tree

‎.github/SECURITY.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ If you wish to notify us of a vulnerability via email, please include detailed i
2121

2222
You can reach us at:
2323

24-
- _[ A product team email address ]_
25-
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
24+
- [england.nhsnotify@nhs.net](mailto:england.nhsnotify@nhs.net)
25+
- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
2626

2727
### NCSC
2828

‎.github/actions/check-todo-usage/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Check Todo usage"
2+
description: "Check Todo usage"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Check Todo usage"
7+
shell: bash
8+
run: |
9+
export BRANCH_NAME=origin/${{ github.event.repository.default_branch }}
10+
check=branch ./scripts/githooks/check-todos.sh

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ runs:
4444
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
4545
- name: "Authenticate to send the report"
4646
if: steps.check.outputs.secrets_exist == 'true'
47-
uses: aws-actions/configure-aws-credentials@v2
47+
uses: aws-actions/configure-aws-credentials@v4
4848
with:
4949
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
5050
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ runs:
5858
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
5959
- name: "Authenticate to send the reports"
6060
if: steps.check.outputs.secrets_exist == 'true'
61-
uses: aws-actions/configure-aws-credentials@v2
61+
uses: aws-actions/configure-aws-credentials@v4
6262
with:
6363
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
6464
aws-region: ${{ inputs.idp_aws_report_upload_region }}

‎.github/actions/trivy/action.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ runs:
55
- name: "Trivy Terraform IAC Scan"
66
shell: bash
77
run: |
8+
components_exit_code=0
89
modules_exit_code=0
910
10-
./scripts/terraform/trivy.sh ./infrastructure/modules || modules_exit_code=$?
11+
./scripts/terraform/trivy.sh ./infrastructure/terraform/components || components_exit_code=$?
12+
./scripts/terraform/trivy.sh ./infrastructure/terraform/modules || modules_exit_code=$?
1113
1214
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
1315
echo "Trivy misconfigurations detected."

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ jobs:
4848
echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
4949
echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
5050
echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
51-
# TODO: Get the version, but it may not be the .version file as this should come from the CI/CD Pull Request Workflow
5251
echo "version=$(head -n 1 .version 2> /dev/null || echo unknown)" >> $GITHUB_OUTPUT
5352
# echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
5453
- name: "List variables"

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Repository Template Sync
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 1 * *'
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
checks: read
12+
13+
jobs:
14+
update-external-repo:
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Check out the repository
19+
uses: actions/checkout@v4
20+
21+
- name: Check out external repository
22+
uses: actions/checkout@v4
23+
with:
24+
repository: NHSDigital/nhs-notify-repository-template
25+
path: nhs-notify-repository-template
26+
token: ${{ github.token }}
27+
28+
- name: Run syncronisation script
29+
run: |
30+
./nhs-notify-repository-template/scripts/githooks/sync-template-repo.sh
31+
rm -Rf ./nhs-notify-repository-template
32+
33+
- name: Create Pull Request
34+
if: ${{ !env.ACT }}
35+
uses: peter-evans/create-pull-request@v7.0.8
36+
with:
37+
token: ${{ secrets.GITHUB_TOKEN }}
38+
commit-message: Drift from template
39+
branch: scheduledTemplateRepositorySync
40+
delete-branch: true
41+
title: '[Template Sync] Drift from template-repository remediation'
42+
body: |
43+
# Resultant drift from repository template
44+
45+
## Who should respond to this PR?
46+
The team which owns the responsibility for this component repository. You may want to consult other contributors.
47+
48+
## How to progress this PR
49+
The repositories guardians should review the contents of the PR and decide how to proceed, you may wish to back-out certain changes or accept them from the upstream `nhsdigital/nhs-notify-repository-template` repository.
50+
51+
If there are changes you do not wish to see again, it is recommended you add exclusions to `scripts/config/.repository-template-sync-ignore`.
52+
labels: |
53+
template
54+
automation
55+
draft: false

‎.github/workflows/scorecard.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,25 +27,25 @@ jobs:
2727
# Needed to publish results and get a badge (see publish_results below).
2828
id-token: write
2929
# Uncomment the permissions below if installing in a private repository.
30-
# contents: read
31-
# actions: read
30+
contents: read
31+
actions: read
3232

3333
steps:
3434
- name: "Checkout code"
35-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
3737
persist-credentials: false
3838

3939
- name: "Run analysis"
40-
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
40+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
4141
with:
4242
results_file: results.sarif
4343
results_format: sarif
4444
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
4545
# - you want to enable the Branch-Protection check on a *public* repository, or
4646
# - you are installing Scorecard on a *private* repository
4747
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
48-
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
48+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
4949

5050
# Public repositories:
5151
# - Publish results to OpenSSF REST API for easy access by consumers
@@ -59,7 +59,7 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
62+
uses: actions/upload-artifact@v4
6363
with:
6464
name: SARIF file
6565
path: results.sarif
@@ -68,6 +68,6 @@ jobs:
6868
# Upload the results to GitHub's code scanning dashboard (optional).
6969
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
71+
uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
7272
with:
7373
sarif_file: results.sarif

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,17 @@ jobs:
101101
fetch-depth: 0 # Full history is needed to compare branches
102102
- name: "Check English usage"
103103
uses: ./.github/actions/check-english-usage
104+
check-todo-usage:
105+
name: "Check TODO usage"
106+
runs-on: ubuntu-latest
107+
timeout-minutes: 5
108+
steps:
109+
- name: "Checkout code"
110+
uses: actions/checkout@v4
111+
with:
112+
fetch-depth: 0 # Full history is needed to compare branches
113+
- name: "Check TODO usage"
114+
uses: ./.github/actions/check-todo-usage
104115
detect-terraform-changes:
105116
name: "Detect Terraform Changes"
106117
runs-on: ubuntu-latest
@@ -145,7 +156,7 @@ jobs:
145156
- name: "Checkout code"
146157
uses: actions/checkout@v4
147158
- name: "Setup ASDF"
148-
uses: asdf-vm/actions/setup@v3
159+
uses: asdf-vm/actions/setup@v4
149160
- name: "Perform Setup"
150161
uses: ./.github/actions/setup
151162
- name: "Trivy Scan"

‎.github/workflows/stage-3-build.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
- name: "Upload artefact 1"
6161
run: |
6262
echo "Uploading artefact 1 ..."
63-
# TODO: Use either action/cache or action/upload-artifact
63+
# Use either action/cache or action/upload-artifact
6464
artefact-n:
6565
name: "Artefact n"
6666
runs-on: ubuntu-latest
@@ -77,4 +77,4 @@ jobs:
7777
- name: "Upload artefact n"
7878
run: |
7979
echo "Uploading artefact n ..."
80-
# TODO: Use either action/cache or action/upload-artifact
80+
# Use either action/cache or action/upload-artifact

0 commit comments

Comments
 (0)