Skip to content

Commit d942f04

Browse files
tstephen-nhststephen-nhs
authored
Merge branch 'main' into aea-0000-add-cdk-tips
2 parents 3ca9869 + f8e24af commit d942f04

8 files changed

Lines changed: 88 additions & 78 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"args": {
77
"DOCKER_GID": "${env:DOCKER_GID:}",
88
"IMAGE_NAME": "node_24_python_3_14",
9-
"IMAGE_VERSION": "v1.4.2",
9+
"IMAGE_VERSION": "v1.4.8",
1010
"USER_UID": "${localEnv:USER_ID:}",
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
},

‎.gitallowed‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎.github/workflows/auto_approve_dependabot.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Auto-approve dependency updates
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '*/30 * * * *'
7+
8+
permissions: {}
9+
jobs:
10+
auto-approve-dependabot:
11+
runs-on: ubuntu-22.04
12+
environment: create_pull_request
13+
permissions:
14+
contents: write
15+
pull-requests: write
16+
steps:
17+
- name: Auto approve and enable auto-merge
18+
uses: NHSDigital/eps-dependabot-approve@da0503449b218ccd99bc547e242007d5514e4d2f
19+
with:
20+
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
21+
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ name: ci
22

33
on:
44
push:
5-
branches: [main]
5+
branches: [ main ]
66

77
permissions: {}
88
jobs:
99
get_config_values:
10-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
10+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
1111
permissions:
1212
attestations: "read"
1313
contents: "read"
@@ -16,21 +16,24 @@ jobs:
1616
verify_published_from_main_image: false
1717

1818
quality_checks:
19-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
20-
needs: [get_config_values]
19+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
20+
needs: [ get_config_values ]
2121
permissions:
2222
contents: "read"
23+
packages: "read"
24+
id-token: "write"
2325
with:
2426
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2527
secrets:
2628
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2729

2830
tag_release:
29-
needs: [get_config_values]
30-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
31+
needs: [ get_config_values ]
32+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
3133
permissions:
3234
id-token: "write"
3335
contents: "write"
36+
packages: "write"
3437
with:
3538
dry_run: true
3639
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

‎.github/workflows/pull_request.yml‎

Lines changed: 37 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,41 @@
11
name: pull_request
2-
32
on:
4-
pull_request:
5-
branches: [main]
6-
3+
pull_request:
4+
branches: [main]
75
permissions: {}
8-
96
jobs:
10-
get_config_values:
11-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
12-
permissions:
13-
attestations: "read"
14-
contents: "read"
15-
packages: "read"
16-
with:
17-
verify_published_from_main_image: false
18-
19-
dependabot-auto-approve-and-merge:
20-
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
21-
permissions:
22-
contents: "write"
23-
pull-requests: "write"
24-
secrets:
25-
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
26-
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
27-
28-
quality_checks:
29-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
30-
permissions:
31-
contents: "read"
32-
needs: [get_config_values]
33-
with:
34-
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
35-
secrets:
36-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
37-
38-
pr_title_format_check:
39-
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
40-
permissions:
41-
pull-requests: "write"
42-
tag_release:
43-
needs: [get_config_values]
44-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
45-
permissions:
46-
id-token: "write"
47-
contents: "write"
48-
with:
49-
dry_run: true
50-
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
51-
branch_name: ${{ github.event.pull_request.head.ref }}
52-
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
7+
get_config_values:
8+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
9+
permissions:
10+
attestations: "read"
11+
contents: "read"
12+
packages: "read"
13+
with:
14+
verify_published_from_main_image: false
15+
quality_checks:
16+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
17+
permissions:
18+
contents: "read"
19+
packages: "read"
20+
id-token: "write"
21+
needs: [get_config_values]
22+
with:
23+
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
24+
secrets:
25+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
26+
pr_title_format_check:
27+
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
28+
permissions:
29+
pull-requests: "write"
30+
tag_release:
31+
needs: [get_config_values]
32+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
33+
permissions:
34+
id-token: "write"
35+
contents: "write"
36+
packages: "write"
37+
with:
38+
dry_run: true
39+
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
40+
branch_name: ${{ github.event.pull_request.head.ref }}
41+
tag_format: ${{ needs.get_config_values.outputs.tag_format }}

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ permissions: {}
99

1010
jobs:
1111
get_config_values:
12-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
12+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
1313
permissions:
1414
attestations: "read"
1515
contents: "read"
@@ -18,21 +18,24 @@ jobs:
1818
verify_published_from_main_image: false
1919

2020
quality_checks:
21-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
22-
needs: [get_config_values]
21+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
22+
needs: [ get_config_values ]
2323
permissions:
2424
contents: "read"
25+
packages: "read"
26+
id-token: "write"
2527
with:
2628
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2729
secrets:
2830
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2931

3032
tag_release:
31-
needs: [get_config_values]
32-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
33+
needs: [ get_config_values ]
34+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@8b259f4f2d2b8ff1345fb0d2f9b9f0fbb9d19845
3335
permissions:
3436
id-token: "write"
3537
contents: "write"
38+
packages: "write"
3639
with:
3740
dry_run: false
3841
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}

‎.pre-commit-config.yaml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,27 +26,27 @@ repos:
2626
- id: zizmor-action
2727
name: Check action.yml
2828
entry: zizmor
29-
args: ["action.yml"]
29+
args: [ "action.yml" ]
3030
language: system
3131
files: action.yml
3232
pass_filenames: false
3333

3434
- id: lint-githubactions
3535
name: Lint github actions
3636
entry: make
37-
args: ["actionlint"]
37+
args: [ "actionlint" ]
3838
language: system
3939
files: ^.github
40-
types_or: [yaml]
40+
types_or: [ yaml ]
4141
pass_filenames: false
4242

4343
- id: lint-githubaction-scripts
4444
name: Lint github action scripts
4545
entry: make
46-
args: ["shellcheck"]
46+
args: [ "shellcheck" ]
4747
language: system
4848
files: ^.github/scripts
49-
types_or: [sh, shell]
49+
types_or: [ sh, shell ]
5050
pass_filenames: false
5151

5252
- id: check-commit-signing
@@ -78,14 +78,15 @@ repos:
7878
pass_filenames: false
7979
always_run: true
8080

81-
- id: git-secrets
82-
name: Git Secrets
83-
description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
81+
- id: gitleaks
82+
name: Git Leaks
83+
description: gitleaks scans commits, commit messages, and --no-ff merges to
84+
prevent adding secrets into your git repositories.
8485
entry: bash
8586
args:
8687
- -c
87-
- "git-secrets --pre_commit_hook"
88+
- "gitleaks git --pre-commit --redact --staged --verbose"
8889
language: system
8990

9091
fail_fast: true
91-
default_stages: [pre-commit]
92+
default_stages: [ pre-commit ]

‎action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ runs:
6161
private-key: "${{ inputs.CREATE_PULL_REQUEST_PEM }}"
6262

6363
- name: Create Pull Request
64-
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
64+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
6565
with:
6666
token: "${{ steps.generate-token.outputs.token }}"
6767
commit-message: "Upgrade: [dependabot] - sync Copilot instructions"

0 commit comments

Comments
 (0)