Merge remote-tracking branch 'origin/main' into allow_dependabot_vulns

Author: anthony-nhs

.gitallowed

@@ -7,3 +7,4 @@ self\.token = token
 token = os\.environ\.get\(\"GH_TOKEN\"\)
 poetry\.lock
 \-Dsonar\.token=\"\$SONAR_TOKEN\"
+token: "\${{ steps\.generate-token\.outputs\.token }}"

.github/dependabot.yaml

@@ -14,28 +14,28 @@ updates:
       prefix: "Upgrade: [dependabot] - "
 
   ###################################
-  # NPM workspace  ##################
+  # Poetry  #########################
   ###################################
-  - package-ecosystem: "npm"
+  - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "thursday"
-      time: "18:00" # UTC
+      time: "20:00" # UTC
     open-pull-requests-limit: 20
     versioning-strategy: increase
     commit-message:
       prefix: "Upgrade: [dependabot] - "
 
   ###################################
-  # Poetry  #########################
+  # NPM workspace  ##################
   ###################################
-  - package-ecosystem: "pip"
+  - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "thursday"
-      time: "18:00" # UTC
+      time: "22:00" # UTC
     open-pull-requests-limit: 20
     versioning-strategy: increase
     commit-message:

.github/workflows/quality-checks-devcontainer.yml

@@ -410,7 +410,7 @@ jobs:
           make cfn-guard-cdk
 
       - name: Download terraform plans
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           pattern: "*_terraform_plan"
           path: terraform_plans/

.github/workflows/quality-checks.yml

@@ -204,7 +204,7 @@ jobs:
           cd src
           go mod vendor
       - name: Check licenses
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -247,7 +247,7 @@ jobs:
       - name: Run unit tests
         run: make test
       - name: Generate SBOM
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -265,7 +265,7 @@ jobs:
       - name: Check python vulnerabilities
         if: ${{ always() && steps.check_languages.outputs.uses_poetry == 'true'}}
         continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           skip-files: "**/package-lock.json,**/go.mod,**/pom.xml"
@@ -279,7 +279,7 @@ jobs:
       - name: Check node vulnerabilities
         if: ${{ always() && steps.check_languages.outputs.uses_node == 'true' }}
         continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           skip-files: "**/poetry.lock,**/go.mod,**/pom.xml"
@@ -293,7 +293,7 @@ jobs:
       - name: Check go vulnerabilities
         if: ${{ always() && steps.check_languages.outputs.uses_go == 'true' }}
         continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           skip-files: "**/poetry.lock,**/package-lock.json,**/pom.xml"
@@ -306,7 +306,7 @@ jobs:
       - name: Check java vulnerabilities
         if: ${{ always() && steps.check_languages.outputs.uses_java == 'true' }}
         continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "fs"
           skip-files: "**/poetry.lock,**/package-lock.json,**/go.mod"
@@ -490,7 +490,7 @@ jobs:
           make docker-build
 
       - name: Check docker vulnerabilities
-        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         with:
           scan-type: "image"
           image-ref: ${{ matrix.docker_image }}
@@ -664,7 +664,7 @@ jobs:
           done
 
       - name: Download terraform plans
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           pattern: "*_terraform_plan"
           path: terraform_plans/

.github/workflows/tag-release-devcontainer.yml

@@ -122,7 +122,7 @@ jobs:
 
             - name: Download extra artifact
               if: ${{ inputs.extra_artifact_name != '' }}
-              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
               with:
                   artifact-ids: ${{ inputs.extra_artifact_id }}
                   github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tag-release.yml

@@ -190,7 +190,7 @@ jobs:
             next_version_tag: ${{ steps.output_version_tag.outputs.NEXT_VERSION_TAG }}
         steps:
             - name: Fetch asdf artifact
-              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
               with:
                   name: asdf_artifact
             - name: Install asdf
@@ -234,7 +234,7 @@ jobs:
                   BRANCH_NAME: ${{ inputs.branch_name }}
 
             - name: Fetch semantic-release config
-              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
               with:
                   name: config_artifact
 
@@ -264,7 +264,7 @@ jobs:
 
             - name: Download extra artifact
               if: ${{ inputs.extra_artifact_name != '' }}
-              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
               with:
                   artifact-ids: ${{ inputs.extra_artifact_id }}
                   github-token: ${{ secrets.GITHUB_TOKEN }}

.trivyignore.yaml

@@ -22,3 +22,6 @@ vulnerabilities:
   - id: CVE-2026-29786
     statement: tar vulnerability accepted as risk - dependency of npm (multiple)
     expired_at: 2026-06-01
+  - id: CVE-2026-31802
+    statement: tar vulnerability accepted as risk - dependency of npm (multiple)
+    expired_at: 2026-06-01