Skip to content

Commit af6f748

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-6424] - use new common workflows#4525 (#2951)
## Summary - Routine Change ### Details - move to latest qc - remove all trivy files - add CODEOWNERS to restrict updates to workflows - use least permissions on all workflows - add --ignore-scripts true to npm install
1 parent 95a6323 commit af6f748

17 files changed

Lines changed: 151 additions & 178 deletions

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"args": {
77
"DOCKER_GID": "${env:DOCKER_GID:}",
88
"IMAGE_NAME": "node_24_python_3_12",
9-
"IMAGE_VERSION": "v1.2.0",
9+
"IMAGE_VERSION": "v1.4.4",
1010
"USER_UID": "${localEnv:USER_ID:}",
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
},

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# restrict access to approving workflow changes
2+
.github/workflows/ @NHSDigital/eps-admins

‎.github/actions/mark_jira_released/action.yml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎.github/actions/update_confluence_jira/action.yml‎

Lines changed: 0 additions & 89 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,25 @@ on:
44
push:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
7+
permissions: {}
98

109
jobs:
1110
get_config_values:
12-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
11+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
12+
permissions:
13+
attestations: read
14+
contents: read
15+
packages: read
1316
with:
1417
verify_published_from_main_image: true
1518

1619
quality_checks:
17-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
20+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
1821
needs: [get_config_values]
22+
permissions:
23+
contents: read
24+
id-token: write
25+
packages: read
1926
with:
2027
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2128
secrets:
@@ -33,26 +40,33 @@ jobs:
3340
3441
tag_release:
3542
needs: [quality_checks, get_commit_id, get_config_values]
36-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
43+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
3744
permissions:
3845
id-token: write
3946
contents: write
47+
packages: write
4048
with:
4149
dry_run: true
4250
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
4351
branch_name: main
4452
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
45-
secrets: inherit
4653

4754
package_code:
4855
needs: [tag_release, get_config_values]
4956
uses: ./.github/workflows/run_package_code_and_api.yml
57+
permissions:
58+
contents: read
59+
packages: read
60+
id-token: write
5061
with:
5162
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
5263

5364
release_dev:
5465
needs: [tag_release, package_code, get_commit_id, get_config_values]
5566
uses: ./.github/workflows/run_release_code_and_api.yml
67+
permissions:
68+
contents: write
69+
id-token: write
5670
with:
5771
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
5872
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.version_tag}}
@@ -99,6 +113,9 @@ jobs:
99113
release_sandbox_dev:
100114
needs: [tag_release, package_code, get_commit_id, get_config_values]
101115
uses: ./.github/workflows/run_release_code_and_api.yml
116+
permissions:
117+
contents: write
118+
id-token: write
102119
with:
103120
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
104121
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.version_tag}}-sandbox
@@ -140,6 +157,9 @@ jobs:
140157
needs:
141158
[tag_release, release_dev, package_code, get_commit_id, get_config_values]
142159
uses: ./.github/workflows/run_release_code_and_api.yml
160+
permissions:
161+
contents: write
162+
id-token: write
143163
with:
144164
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
145165
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.version_tag}}

‎.github/workflows/delete_old_cloudformation_stacks.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
- cron: "0 1,13 * * *"
88
push:
99
branches: [main]
10+
permissions: {}
1011

1112
jobs:
1213
delete-old-cloudformation-stacks:
@@ -19,8 +20,8 @@ jobs:
1920
- name: Checkout local code
2021
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2122
with:
22-
ref: ${{ env.BRANCH_NAME }}
2323
fetch-depth: 0
24+
persist-credentials: false
2425

2526
- name: Configure AWS Credentials
2627
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
@@ -46,8 +47,8 @@ jobs:
4647
- name: Checkout local code
4748
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
4849
with:
49-
ref: ${{ env.BRANCH_NAME }}
5050
fetch-depth: 0
51+
persist-credentials: false
5152

5253
- name: Configure AWS Credentials
5354
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7

‎.github/workflows/pull_request.yml‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,32 +4,44 @@ on:
44
pull_request:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
7+
permissions: {}
98

109
jobs:
1110
dependabot-auto-approve-and-merge:
1211
needs: quality_checks
13-
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@5ac2707dd9cd60ad127275179495b9c890d74711
12+
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
13+
permissions:
14+
contents: write
15+
pull-requests: write
1416
secrets:
1517
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1618
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1719

1820
get_config_values:
19-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
21+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
22+
permissions:
23+
attestations: read
24+
contents: read
25+
packages: read
2026
with:
2127
verify_published_from_main_image: false
2228

2329
quality_checks:
24-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
30+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
2531
needs: [get_config_values]
32+
permissions:
33+
contents: read
34+
id-token: write
35+
packages: read
2636
with:
2737
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2838
secrets:
2939
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
3040

3141
pr_title_format_check:
32-
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@5ac2707dd9cd60ad127275179495b9c890d74711
42+
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
43+
permissions:
44+
pull-requests: write
3345

3446
get_issue_number:
3547
runs-on: ubuntu-22.04
@@ -60,16 +72,16 @@ jobs:
6072

6173
tag_release:
6274
needs: [get_config_values]
63-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
75+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
6476
permissions:
6577
id-token: write
6678
contents: write
79+
packages: write
6780
with:
6881
dry_run: true
6982
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
7083
branch_name: ${{ github.event.pull_request.head.ref }}
7184
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
72-
secrets: inherit
7385

7486
get_commit_id:
7587
runs-on: ubuntu-22.04
@@ -84,12 +96,19 @@ jobs:
8496
package_code:
8597
needs: [get_issue_number, get_config_values]
8698
uses: ./.github/workflows/run_package_code_and_api.yml
99+
permissions:
100+
contents: read
101+
packages: read
102+
id-token: write
87103
with:
88104
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
89105

90106
release_code:
91107
needs: [get_issue_number, package_code, get_commit_id, get_config_values]
92108
uses: ./.github/workflows/run_release_code_and_api.yml
109+
permissions:
110+
contents: write
111+
id-token: write
93112
with:
94113
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
95114
STACK_NAME: psu-pr-${{needs.get_issue_number.outputs.issue_number}}
@@ -136,6 +155,9 @@ jobs:
136155
release_sandbox_code:
137156
needs: [get_issue_number, package_code, get_commit_id, get_config_values]
138157
uses: ./.github/workflows/run_release_code_and_api.yml
158+
permissions:
159+
contents: write
160+
id-token: write
139161
with:
140162
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
141163
STACK_NAME: psu-pr-${{needs.get_issue_number.outputs.issue_number}}-sandbox

0 commit comments

Comments
 (0)