Merge branch 'main' into dependabot/npm_and_yarn/semantic-release-25.0.3

Author: anthony-nhs

.github/workflows/quality-checks.yml

@@ -180,7 +180,7 @@ jobs:
           fi
           touch trivy.yaml
       - name: Update trivy config to include dev dependencies
-        uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8
+        uses: mikefarah/yq@2be0094729a1006f61e8339ce9934bfb3cbb549f
         with:
           cmd: yq -i '.pkg.include-dev-deps = true' 'trivy.yaml'
       - name: convert python dependencies to requirements.txt
@@ -234,7 +234,7 @@ jobs:
         run: make lint
 
       - name: actionlint
-        uses: raven-actions/actionlint@963d4779ef039e217e5d0e6fd73ce9ab7764e493
+        uses: raven-actions/actionlint@e01d1ea33dd6a5ed517d95b4c0c357560ac6f518
 
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38

.github/workflows/tag-release.yml

@@ -352,11 +352,52 @@ jobs:
                   id: ${{ steps.get_release.outputs.id }}
                   body: |
                       ## Info
-                      [See code diff](${{ github.event.compare }})
                       [Release workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) - Workflow ID: ${{ github.run_id }}
 
                       It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }})
 
+            - name: Checkout gh-pages branch
+              if: ${{ !inputs.dry_run }}
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+              with:
+                  repository: ${{ github.repository }}
+                  ref: gh-pages
+                  path: gh-pages
+
+            - name: Publish release notes to gh-pages
+              if: ${{ !inputs.dry_run }}
+              working-directory: gh-pages
+              env:
+                  RELEASE_ID: ${{ steps.get_release.outputs.id }}
+                  VERSION_TAG: ${{ steps.output_version_tag.outputs.VERSION_TAG }}
+                  GH_REPO: ${{ github.repository }}
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              run: |
+                  set -euo pipefail
+                  notes_dir="release_notes"
+                  mkdir -p "$notes_dir"
+                  note_file="$notes_dir/${VERSION_TAG}.md"
+
+                  gh api "/repos/${GH_REPO}/releases/${RELEASE_ID}" | jq -r '.body // ""' > "$note_file"
+
+                  if [ ! -s "$note_file" ]; then
+                      echo "Release notes are empty; skipping gh-pages update."
+                      exit 0
+                  fi
+
+                  git config user.name "github-actions[bot]"
+                  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+                  git add -f "$note_file"
+                  if git diff --cached --quiet; then
+                      echo "No changes detected in release notes; skipping commit."
+                      exit 0
+                  fi
+
+                  git commit -m "docs: add release notes for ${VERSION_TAG}"
+                  parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"
+
             - name: Output Change Set Version
               id: output_change_set_version
               shell: bash

.trivyignore.yaml

@@ -7,3 +7,9 @@ vulnerabilities:
   - id: CVE-2026-25128
     statement: fast-xml-parser vulnerability accepted as risk - dependency of aws-sdk/client-dynamodb
     expired_at: 2026-03-01
+  - id: CVE-2026-25547
+    statement: isaacs/brace-expansion vulnerability accepted as risk - dependency of semantic-release
+    expired_at: 2026-03-01
+  - id: CVE-2026-0775 
+    statement: npm vulnerability accepted as risk - dependency of semantic-release
+    expired_at: 2026-03-01

poetry.lock

@@ -17,10 +17,12 @@ repository = "https://github.com/NHSDigital/eps-common-workflows"
 
 [tool.poetry.dependencies]
 python = "^3.14"
-pre-commit = "^4.5.1"
 requests = "^2.32.5"
 
-[tool.poetry.group.dev.dependencies]
-pip-licenses = "^5.0.0"
-
 [tool.poetry.scripts]
+
+
+[dependency-groups]
+dev = [
+    "pre-commit (>=4.5.1,<5.0.0)"
+]