Merge branch 'main' into aee-6055-enable-post-dated-tests

tstephen-nhs · web-flow · commit ad875e301470 · 2026-04-20T09:10:26.000+01:00
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
     "args": {
       "DOCKER_GID": "${env:DOCKER_GID:}",
       "IMAGE_NAME": "node_24_python_3_12",
-      "IMAGE_VERSION": "v1.4.4",
+      "IMAGE_VERSION": "v1.4.8",
       "USER_UID": "${localEnv:USER_ID:}",
       "USER_GID": "${localEnv:GROUP_ID:}"
     },
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
@@ -17,7 +17,7 @@ jobs:
       verify_published_from_main_image: true
 
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -40,7 +40,7 @@ jobs:
 
   tag_release:
     needs: [quality_checks, get_commit_id, get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/delete_old_cloudformation_stacks.yml b/.github/workflows/delete_old_cloudformation_stacks.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.PROXYGEN_PTL_ROLE }}
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   dependabot-auto-approve-and-merge:
     needs: quality_checks
-    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       contents: write
       pull-requests: write
@@ -18,7 +18,7 @@ jobs:
       AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
 
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
@@ -27,7 +27,7 @@ jobs:
       verify_published_from_main_image: false
 
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -39,7 +39,7 @@ jobs:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
   pr_title_format_check:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       pull-requests: write
 
@@ -50,7 +50,7 @@ jobs:
       issue_number: ${{steps.get_issue_number.outputs.result}}
 
     steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
         name: get issue number
         id: get_issue_number
         with:
@@ -72,7 +72,7 @@ jobs:
 
   tag_release:
     needs: [get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,15 +7,15 @@ permissions: {}
 
 jobs:
   get_config_values:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       attestations: read
       contents: read
       packages: read
     with:
       verify_published_from_main_image: true
   quality_checks:
-    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@8399c1f015c1304e40771cbd8ccc24c7ed48fdbc
     needs: [get_config_values]
     permissions:
       contents: read
@@ -38,7 +38,7 @@ jobs:
 
   tag_release:
     needs: [quality_checks, get_commit_id, get_config_values]
-    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
+    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
     permissions:
       id-token: write
       contents: write
@@ -415,7 +415,7 @@ jobs:
       ENABLE_POST_DATED_NOTIFICATIONS: false
       ENABLED_SYSTEMS: "CrxPatientApp"
       BLOCKED_SITE_ODS_CODES: "XXXXX" # Workaround empty string handling
-      ENABLED_SUPPLIER_APPLICATION_IDS: "XXXXX"
+      ENABLED_SUPPLIER_APPLICATION_IDS: "30c8d461-e875-4882-85d1-4d5d90f7f17b,f7a08809-09f5-4215-a5c8-e280705aba77,401b11d1-5608-4d6e-8359-9bbed6c90e7e,4b2d703f-d8bb-4c82-8340-b1a97481a46a,9331742d-ccc3-4081-b54b-22e8f946a1ce,ee353200-2b8f-47be-8b70-d0777e80d92f"
       NOTIFY_ROUTING_PLAN_ID: "e57fe5cc-0567-4854-abe2-b7dd9014a50c" # INT and PROD share a value
       NOTIFY_API_BASE_URL: "https://api.service.nhs.uk"
       MTLS_KEY: psu-mtls-1
diff --git a/.github/workflows/run_package_code_and_api.yml b/.github/workflows/run_package_code_and_api.yml
@@ -55,7 +55,7 @@ jobs:
           cp packages/specification/dist/eps-prescription-status-update-api.resolved.json .aws-sam/build/specification/
           cp packages/specification/dist/eps-custom-prescription-status-update-api.resolved.json .aws-sam/build/specification/
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         name: Upload build artifact
         with:
           name: packaged_code
@@ -78,7 +78,7 @@ jobs:
           cp packages/specification/dist/eps-custom-prescription-status-update-api.resolved.json .aws-sam/build/specification/
 
       # Readme is included to stop the action flattening the folder structure of aws-sam/build when it is the only item to upload
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         name: Upload sandbox build artifact
         with:
           name: packaged_sandbox_code
diff --git a/.github/workflows/run_release_code_and_api.yml b/.github/workflows/run_release_code_and_api.yml
@@ -165,7 +165,7 @@ jobs:
             .github
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -244,7 +244,7 @@ jobs:
           AWS_MAX_ATTEMPTS: 20
 
       - name: Configure AWS Credentials for api release
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
           aws-region: eu-west-2
           role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
diff --git a/.github/workflows/update_dev_container_version.yml b/.github/workflows/update_dev_container_version.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Update devcontainer version
-        uses: NHSDigital/eps-update-devcontainer@dc3a8c5f11e7226ee4f5f2bb35bd0d1265092306
+        uses: NHSDigital/eps-update-devcontainer@83f4b56f1942635f2c05b7fe569142459b8c3882
         with:
           calling_repo_base_branch: main
           CREATE_PULL_REQUEST_APP_ID: ${{ secrets.CREATE_PULL_REQUEST_APP_ID }}
diff --git a/.grype.yaml b/.grype.yaml
@@ -1,3 +1,5 @@
 ignore:
   # path-to-regexp - dependency of aws-sdk-client-mock
   - vulnerability: GHSA-j3q9-mxjg-w52f
+  # protobufjs - dependency of @redocly/cli
+  - vulnerability: GHSA-xq3m-2v4x-88gg
diff --git a/SAMtemplates/functions/main.yaml b/SAMtemplates/functions/main.yaml
@@ -137,7 +137,7 @@ Resources:
           SQS_SALT: !Ref SQSSaltSecret
           # Remove this once we've confirmed that product ID based filtering is working as expected and we
           # no longer need the ability to switch back to the old filtering method
-          USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: false
+          USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: true
           ENABLED_SYSTEMS_PARAM: !Ref EnabledSystemsParam
           #
           ENABLED_APPLICATION_IDS_PARAM: !Ref EnabledSupplierApplicationIDsParam
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -40,7 +40,7 @@ pre-commit = "^4.5.1"
 black = "^26.3.1"
 flake8 = "^7.3.0"
 jinja2 = "^3.1.5"
-click = "^8.3.1"
+click = "^8.3.2"
 rich = "^14.3.3"
 
 [build-system]
diff --git a/zizmor.yml b/zizmor.yml
@@ -2,9 +2,9 @@ rules:
   unpinned-images:
     # these workflows use unpinned images because they are using a full image passed in that contains the tag
     ignore:
-      - run_release_code_and_api.yml:146:7
-      - run_regression_tests.yml:26:7
-      - run_package_code_and_api.yml:16:7
+      - run_release_code_and_api.yml:146:18
+      - run_regression_tests.yml:26:18
+      - run_package_code_and_api.yml:16:18
   secrets-outside-env:
     # these are ignored because they are using known secrets
     ignore:

Original file line number	Diff line number	Diff line change
`@@ -137,7 +137,7 @@ Resources:`
`137`	`137`	`SQS_SALT: !Ref SQSSaltSecret`
`138`	`138`	`# Remove this once we've confirmed that product ID based filtering is working as expected and we`
`139`	`139`	`# no longer need the ability to switch back to the old filtering method`
`140`		`- USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: false`
	`140`	`+ USE_APP_ID_FOR_NOTIFICATIONS_FILTERING: true`
`141`	`141`	`ENABLED_SYSTEMS_PARAM: !Ref EnabledSystemsParam`
`142`	`142`	`#`
`143`	`143`	`ENABLED_APPLICATION_IDS_PARAM: !Ref EnabledSupplierApplicationIDsParam`