Merge branch 'main' into aea-5986-add-pypi-publish-to-tag-release-devcontainer-workflow

Author: originalphil

.gitallowed

@@ -8,3 +8,5 @@ token = os\.environ\.get\(\"GH_TOKEN\"\)
 poetry\.lock
 \-Dsonar\.token=\"\$SONAR_TOKEN\"
 token: "\${{ steps\.generate-token\.outputs\.token }}"
+id-token: 'write'
+id-token: "write"

.github/workflows/pull_request.yml

@@ -14,7 +14,7 @@ jobs:
     secrets:
       AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
       AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
-  
+
   pr_title_format_check:
     uses: ./.github/workflows/pr_title_check.yml
 
@@ -30,14 +30,14 @@ jobs:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
     secrets:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      
+
   tag_release:
     needs: get_config_values
     uses: ./.github/workflows/tag-release-devcontainer.yml
     permissions:
-      contents: read
       packages: read
-      attestations: read
+      id-token: write
+      contents: write
     with:
       dry_run: true
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

.github/workflows/release.yml

@@ -20,6 +20,9 @@ jobs:
   tag_release:
     needs: [quality_checks, get_config_values]
     uses: ./.github/workflows/tag-release-devcontainer.yml
+    permissions:
+      id-token: write
+      contents: write
     with:
       dry_run: false
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

.github/workflows/tag-release-devcontainer.yml

@@ -29,6 +29,16 @@ on:
                 required: false
                 type: string
                 default: "main"
+            update_jira:
+                description: "Whether to update Jira issues during semantic-release"
+                required: false
+                type: boolean
+                default: false
+            jira_release_prefix:
+                description: "Release prefix sent to Jira release tagging"
+                required: false
+                type: string
+                default: ""
             extra_artifact_name:
                 description: "An extra artifact to include in the release"
                 required: false
@@ -63,12 +73,17 @@ on:
             NPM_TOKEN:
                 required: false
                 description: "NPM token to publish packages"
-            
+            EXECUTE_JIRA_LAMBDA_ROLE:
+                required: false
+                description: "ARN of the role to assume when executing the Jira update lambda"
             PYPI_TOKEN:
                 required: false
                 description: "PyPI token to publish packages"
 jobs:
     tag_release:
+        permissions:
+            id-token: "write"
+            contents: "write"
         runs-on: ubuntu-22.04
         container:
             image: ${{ inputs.pinned_image }}
@@ -84,6 +99,16 @@ jobs:
             - name: copy .tool-versions
               run: |
                   cp /home/vscode/.tool-versions "$HOME/.tool-versions"
+
+            - name: connect to dev account to run release notes lambda
+              uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
+              if: ${{ inputs.update_jira }}
+              with:
+                  aws-region: eu-west-2
+                  role-to-assume: ${{ secrets.EXECUTE_JIRA_LAMBDA_ROLE }}
+                  role-session-name: execute-jira-lambda-session
+                  unset-current-credentials: true
+
             - name: Clone calling repo
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
               with:
@@ -101,6 +126,7 @@ jobs:
                       package-lock.json
                       release.config.cjs
                       releaseNotesTemplates/commit.hbs
+                      packages/
             - name: Install semantic release dependencies globally
               run: |
                   cd common_workflow_config
@@ -113,7 +139,9 @@ jobs:
                   cp release.config.cjs ../ 
                   mkdir -p ../releaseNotesTemplates 
                   cp releaseNotesTemplates/commit.hbs ../releaseNotesTemplates/
+                  cp -r packages/semantic_release_jira ../packages/
                   echo "Current dir is ${PWD}"
+                  echo "NODE_PATH=$(npm root --quiet -g)" >> "$GITHUB_ENV"
             - name: Setup Git branch for semantic-release
               run: |
                   # When running from a PR, GitHub checks out a merge commit
@@ -200,6 +228,8 @@ jobs:
                   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
                   MAIN_BRANCH: ${{ inputs.main_branch }}
                   EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
+                  UPDATE_JIRA: ${{ inputs.update_jira }}
+                  JIRA_RELEASE_PREFIX: ${{ inputs.jira_release_prefix }}
                   PYPI_PUBLISH: ${{ inputs.pypi_publish }}
                   PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
 
@@ -212,6 +242,8 @@ jobs:
                   TAG_FORMAT: ${{ inputs.tag_format }}
                   MAIN_BRANCH: ${{ inputs.main_branch }}
                   EXTRA_ASSET: ${{ inputs.extra_artifact_name }}
+                  UPDATE_JIRA: ${{ inputs.update_jira }}
+                  JIRA_RELEASE_PREFIX: ${{ inputs.jira_release_prefix }}
                   PYPI_PUBLISH: ${{ inputs.pypi_publish }}
                   PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
               run: |

.trivyignore.yaml

@@ -31,3 +31,6 @@ vulnerabilities:
   - id: CVE-2026-2229
     statement: undici vulnerability accepted as risk
     expired_at: 2026-06-01
+  - id: CVE-2026-33036
+    statement: fast-xml-parser vulnerability accepted as risk
+    expired_at: 2026-06-01