Skip to content

[GPCAPIM-336] Update GitHub Actions to use latest action versions and… #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
neil-sproston merged 2 commits into from
Apr 13, 2026
Merged

[GPCAPIM-336] Update GitHub Actions to use latest action versions and… #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd49bba
[GPCAPIM-336] Update GitHub Actions to use latest action versions and…
neil-sproston Apr 10, 2026
dced22a
Merge branch 'main' into GPCAPIM-336actionPinning
neil-sproston Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/check-python-format/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ runs:
steps:
# Temporarily install python and Ruff whilst GitHub actions are not running within the container.
- name: "Setup Python"
uses: actions/setup-python@v5
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- name: "Install Ruff"
Expand Down
4 changes: 2 additions & 2 deletions .github/actions/create-lines-of-code-report/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ runs:
run: zip lines-of-code-report.json.zip lines-of-code-report.json
- name: "Upload CLOC report as an artefact"
if: ${{ !env.ACT }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: lines-of-code-report.json.zip
path: ./lines-of-code-report.json.zip
Expand All @@ -46,7 +46,7 @@ runs:
echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
- name: "Authenticate to send the report"
if: steps.check.outputs.secrets_exist == 'true'
uses: aws-actions/configure-aws-credentials@v2
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
Copy link
Copy Markdown
Contributor

@ian-robinson-35 ian-robinson-35 Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bit of a picky point, but this is actually still within the 7 day "cooldown" that we ideally want to avoid. Probably worth just waiting until Monday before we merge. It's obviously unlikely to be a problem, but it's easy and means we're doing everything properly.

with:
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
aws-region: ${{ inputs.idp_aws_report_upload_region }}
Expand Down
6 changes: 3 additions & 3 deletions .github/actions/scan-dependencies/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ runs:
run: zip sbom-repository-report.json.zip sbom-repository-report.json
- name: "Upload SBOM report as an artefact"
if: ${{ !env.ACT }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: sbom-repository-report.json.zip
path: ./sbom-repository-report.json.zip
Expand All @@ -51,7 +51,7 @@ runs:
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
- name: "Upload vulnerabilities report as an artefact"
if: ${{ !env.ACT }}
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: vulnerabilities-repository-report.json.zip
path: ./vulnerabilities-repository-report.json.zip
Expand All @@ -62,7 +62,7 @@ runs:
run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
- name: "Authenticate to send the reports"
if: steps.check.outputs.secrets_exist == 'true'
uses: aws-actions/configure-aws-credentials@v2
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
aws-region: ${{ inputs.idp_aws_report_upload_region }}
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/setup-python-project/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ runs:
fi

- name: "Set up Python"
uses: actions/setup-python@v5
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python-version }}
cache: 'poetry'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/alpha-integration-env.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,12 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: alpha-integration

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@51635dbf418c2cdd8b3e1497529334d8db7e4063
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ secrets.DEV_AWS_CREDENTIALS }}
aws-region: ${{ env.AWS_REGION }}
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/cicd-1-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Set CI/CD variables"
id: variables
run: |
Expand Down Expand Up @@ -79,10 +79,10 @@ jobs:
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
version: "${{ needs.metadata.outputs.version }}"
secrets:
IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID: ${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}
IDP_AWS_REPORT_UPLOAD_REGION: ${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}
IDP_AWS_REPORT_UPLOAD_ROLE_NAME: ${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}
IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT: ${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}
IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID: ${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}
IDP_AWS_REPORT_UPLOAD_REGION: ${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}
IDP_AWS_REPORT_UPLOAD_ROLE_NAME: ${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}
IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT: ${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}
test-stage: # Recommended maximum execution time is 5 minutes
name: "Test stage"
needs: [metadata, commit-stage]
Expand Down
16 changes: 9 additions & 7 deletions .github/workflows/cicd-2-publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@
workflow_dispatch:
inputs:
tag:
description: 'Tag for the release'
description: "Tag for the release"
required: true
default: 'v0.0.0'
default: "v0.0.0"

jobs:
metadata:
Expand All @@ -29,7 +29,7 @@
version: ${{ steps.variables.outputs.version }}
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Set CI/CD variables"
id: variables
run: |
Expand Down Expand Up @@ -60,14 +60,15 @@
timeout-minutes: 3
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Get the artefacts"
run: |
echo "Getting the artefacts created by the build stage ..."
# TODO [GPCAPIM-283]: Use either action/cache or action/upload-artifact
- name: "Create release"
id: create_release
uses: actions/create-release@v1
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
# TODO: This action currently read-only and needs replacing. ++NAS++

Check warning on line 71 in .github/workflows/cicd-2-publish.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Complete the task associated to this "TODO" comment. 


See more on https://sonarcloud.io/project/issues?id=NHSDigital_clinical-data-gateway-api&issues=AZ13QWuBsRuiFYyCN1zP&open=AZ13QWuBsRuiFYyCN1zP&pullRequest=167
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
Expand All @@ -78,7 +79,8 @@
draft: false
prerelease: false
# - name: "Upload release asset"
# uses: actions/upload-release-asset@v1
# uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
# #TODO: This action is currently read-only and needs replacing. ++NAS++

Check warning on line 83 in .github/workflows/cicd-2-publish.yaml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Complete the task associated to this "TODO" comment. 


See more on https://sonarcloud.io/project/issues?id=NHSDigital_clinical-data-gateway-api&issues=AZ13QWuBsRuiFYyCN1zQ&open=AZ13QWuBsRuiFYyCN1zQ&pullRequest=167
# env:
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# with:
Expand All @@ -96,7 +98,7 @@
run: echo "secret_exist=${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL != '' }}" >> $GITHUB_OUTPUT
- name: "Notify on publishing packages"
if: steps.check.outputs.secret_exist == 'true'
uses: nhs-england-tools/notify-msteams-action@a9fbb9bb41ef7db9c74d4fdc893f12812094fecf
uses: nhs-england-tools/notify-msteams-action@a9fbb9bb41ef7db9c74d4fdc893f12812094fecf # v1.0.5
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
teams-webhook-url: ${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/cicd-3-deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
tag: ${{ steps.variables.outputs.tag }}
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Set CI/CD variables"
id: variables
run: |
Expand Down Expand Up @@ -56,7 +56,7 @@ jobs:
timeout-minutes: 10
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
# TODO [GPCAPIM-283]: More jobs or/and steps here
# success:
# name: "Success notification"
Expand All @@ -68,7 +68,7 @@ jobs:
# run: echo "secret_exist=${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL != '' }}" >> $GITHUB_OUTPUT
# - name: "Notify on deployment to an environment"
# if: steps.check.outputs.secret_exist == 'true'
Copy link
Copy Markdown
Contributor

@ian-robinson-35 ian-robinson-35 Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we just tidy this up by removing the commented out section instead? Always feels bad to keep commented out code since it's in git history anyway.

Copy link
Copy Markdown
Contributor Author

@neil-sproston neil-sproston Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is being done under the re-plumbing exercise that is on-going, this PR is solely to pin to SHA versions.

# uses: nhs-england-tools/notify-msteams-action@v0.0.4
# uses: nhs-england-tools/notify-msteams-action@a9fbb9bb41ef7db9c74d4fdc893f12812094fecf # v1.0.5
# with:
# github-token: ${{ secrets.GITHUB_TOKEN }}
# teams-webhook-url: ${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL }}
Expand Down
30 changes: 6 additions & 24 deletions .github/workflows/preview-env.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Select AWS role inputs
id: role-select
Expand All @@ -52,7 +52,7 @@ jobs:

# Configure AWS credentials (OIDC recommended)
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@51635dbf418c2cdd8b3e1497529334d8db7e4063
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
with:
role-to-assume: ${{ steps.role-select.outputs.aws_role }}
aws-region: ${{ env.AWS_REGION }}
Expand Down Expand Up @@ -444,25 +444,7 @@ jobs:
body: lines.join('\n'),
});

# desable trivy in light of attack https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
# # ---------- Security scanning ----------
# - name: Trivy IaC scan
# if: github.event.action != 'closed'
# uses: nhs-england-tools/trivy-action/iac-scan@289984b2f03034233a347d6dbadecd5ca9ea9634
# with:
# scan-ref: infrastructure/environments/preview
# artifact-name: trivy-iac-scan-${{ steps.meta.outputs.branch_name }}

# - name: Trivy image scan
# if: github.event.action != 'closed'
# uses: nhs-england-tools/trivy-action/image-scan@289984b2f03034233a347d6dbadecd5ca9ea9634
# with:
# image-ref: ${{steps.meta.outputs.ecr_url}}:${{steps.meta.outputs.branch_name}}
# artifact-name: trivy-image-scan-${{ steps.meta.outputs.branch_name }}

# - name: Generate SBOM
# if: github.event.action != 'closed'
# uses: nhs-england-tools/trivy-action/image-scan@289984b2f03034233a347d6dbadecd5ca9ea9634
# with:
# image-ref: ${{steps.meta.outputs.ecr_url}}:${{steps.meta.outputs.branch_name}}
# artifact-name: trivy-sbom-${{ steps.meta.outputs.branch_name }}
# ---------- Security scanning ----------
# - name: IaC vuln scan replacement here
# - name: Image vuln scan replacement here
# - name: Generate SBOM here
16 changes: 8 additions & 8 deletions .github/workflows/stage-1-commit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # Full history is needed to scan all commits
- name: "Scan secrets"
Expand All @@ -63,7 +63,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check file format"
Expand All @@ -74,7 +74,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Check Python format"
uses: ./.github/actions/check-python-format
with:
Expand All @@ -85,7 +85,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check Markdown format"
Expand All @@ -96,7 +96,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # Full history is needed to compare branches
- name: "Check English usage"
Expand All @@ -107,7 +107,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Lint Terraform"
uses: ./.github/actions/lint-terraform
count-lines-of-code:
Expand All @@ -119,7 +119,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Count lines of code"
uses: ./.github/actions/create-lines-of-code-report
with:
Expand All @@ -138,7 +138,7 @@ jobs:
timeout-minutes: 2
steps:
- name: "Checkout code"
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: "Scan dependencies"
uses: ./.github/actions/scan-dependencies
with:
Expand Down
Loading
Loading