Skip to content

Commit ee1dd0c

Browse files
github-actions[bot]github-actions[bot]
authored
Merge dependabot/github_actions/github/codeql-action-3.28.15 into dependabotCombined
2 parents 4c7d9e5 + 582ceda commit ee1dd0c

225 files changed

Lines changed: 9046 additions & 4759 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v3
50+
uses: actions/upload-artifact@v4
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip

‎.github/actions/tfsec/action.yaml‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,11 @@ runs:
66
- name: "TFSec Scan - Components"
77
shell: bash
88
run: |
9-
for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
10-
scripts/terraform/tfsec.sh $component
11-
done
12-
- name: "TFSec Scan - Modules"
13-
shell: bash
14-
run: |
15-
for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
16-
scripts/terraform/tfsec.sh $module
17-
done
9+
modules_exit_code=0
10+
11+
./scripts/terraform/tfsec.sh ./infrastructure/modules || modules_exit_code=$?
12+
13+
if [ $modules_exit_code -ne 0 ]; then
14+
echo "One or more TFSec scans failed."
15+
exit 1
16+
fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ jobs:
4040
echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
4141
echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
4242
echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
43-
echo "nodejs_version=$(grep "^nodejs" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
44-
echo "python_version=$(grep "^nodejs" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
45-
echo "terraform_version=$(grep "^terraform" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
43+
echo "nodejs_version=$(grep "^nodejs " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
44+
echo "python_version=$(grep "^python " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
45+
echo "terraform_version=$(grep "^terraform " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
4646
echo "version=$(echo $version)" >> $GITHUB_OUTPUT
4747
echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
4848

‎.github/workflows/cicd-3-deploy.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ jobs:
4545
echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
4646
echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
4747
echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
48-
echo "nodejs_version=$(grep "^nodejs" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
49-
echo "python_version=$(grep "^nodejs" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
50-
echo "terraform_version=$(grep "^terraform" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
48+
echo "nodejs_version=$(grep "^nodejs " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
49+
echo "python_version=$(grep "^python " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
50+
echo "terraform_version=$(grep "^terraform " .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
5151
# TODO: Get the version, but it may not be the .version file as this should come from the CI/CD Pull Request Workflow
5252
echo "version=$(head -n 1 .version 2> /dev/null || echo unknown)" >> $GITHUB_OUTPUT
5353
# echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT

‎.github/workflows/manual-combine-dependabot-prs.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Combine Dependabot PRs
2+
3+
on:
4+
workflow_dispatch:
5+
6+
permissions:
7+
contents: write
8+
pull-requests: write
9+
checks: read
10+
11+
jobs:
12+
combine-prs:
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: combine-prs
17+
id: combine-prs
18+
uses: github/combine-prs@v5.2.0
19+
with:
20+
ci_required: false
21+
labels: dependencies
22+
pr_title: Combined Dependabot PRs
23+
combine_branch_name: dependabotCombined
24+
pr_body_header: Combined Dependabot PRs

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,6 @@ jobs:
6868
# Upload the results to GitHub's code scanning dashboard (optional).
6969
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
71+
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
7272
with:
7373
sarif_file: results.sarif

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,30 @@ jobs:
6666
fetch-depth: 0 # Full history is needed to compare branches
6767
- name: "Check Markdown format"
6868
uses: ./.github/actions/check-markdown-format
69+
terraform-docs:
70+
name: "Run terraform-docs"
71+
runs-on: ubuntu-latest
72+
needs: detect-terraform-changes
73+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
74+
permissions:
75+
contents: write
76+
steps:
77+
- name: "Checkout code"
78+
uses: actions/checkout@v4
79+
with:
80+
fetch-depth: 0 # Full history is needed to compare branches
81+
- name: "Check to see if Terraform Docs are up-to-date"
82+
run: |
83+
make terraform-docs
84+
- name: "Stage changes"
85+
run: |
86+
git add infrastructure/modules/**/*.md
87+
- name: "Check for changes in Terraform Docs"
88+
run: |
89+
if git diff --cached --name-only | grep -qE '\.md$'; then
90+
echo "Markdown files have changed. Please run 'make terraform-docs' and commit the changes."
91+
exit 1
92+
fi
6993
check-english-usage:
7094
name: "Check English usage"
7195
runs-on: ubuntu-latest

‎.github/workflows/stage-5-publish.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ jobs:
104104
run: echo "secret_exist=${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL != '' }}" >> $GITHUB_OUTPUT
105105
- name: "Notify on publishing packages"
106106
if: steps.check.outputs.secret_exist == 'true'
107-
uses: nhs-england-tools/notify-msteams-action@v0.0.4
107+
uses: nhs-england-tools/notify-msteams-action@v1.0.0
108108
with:
109109
github-token: ${{ secrets.GITHUB_TOKEN }}
110110
teams-webhook-url: ${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL }}

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ version.json
1010
*.code-workspace
1111
!project.code-workspace
1212

13-
# Please, add your custom content below!
13+
infrastructure/modules/eventpub/lambda/*.zip

0 commit comments

Comments
 (0)