Chore: [AEA-0000] - use new workflow to tag release in jira

[anthony-nhs]

Summary

• Routine Change

Details

• use new workflow to tag release in jira

[github-actions]

This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:

AEA-0000

[Copilot]

Pull request overview

This PR updates the repo’s GitHub Actions release/tagging process to use a new eps-common-workflows tagging workflow that can update Jira, and removes the previous in-repo Jira/Confluence release-note steps from the CDK release workflow.

Changes:

• Switch tag-release-devcontainer.yml reusable workflow reference to @update_jira in release/CI/PR workflows.
• Enable Jira updating during release.yml tagging via new update_jira + jira_release_prefix inputs.
• Remove CREATE_*_RELEASE_NOTES / MARK_JIRA_RELEASED inputs and the corresponding steps from cdk_release_code.yml.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yml	Points tag workflow at @update_jira and enables Jira update inputs; removes legacy release-notes/Jira flags passed into deploy jobs.
.github/workflows/pull_request.yml	Points PR tag workflow at @update_jira.
.github/workflows/ci.yml	Points CI tag workflow at @update_jira and removes legacy release-notes flags passed into deploy jobs.
.github/workflows/cdk_release_code.yml	Removes workflow-call inputs and steps for Confluence release notes + Jira “mark released”.

Comments suppressed due to low confidence (3)

.github/workflows/ci.yml:41

• The reusable workflow reference was changed from a pinned commit SHA to the mutable ref @update_jira. Please pin this to a specific commit SHA (or immutable tag) to avoid supply-chain risk and keep CI reproducible; the other eps-common-workflows usages in this file are pinned to a SHA.

  tag_release:
    needs: [quality_checks, get_commit_id, get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@update_jira
    with:
      dry_run: true
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: main
      tag_format: ${{ needs.get_config_values.outputs.tag_format }}
    secrets: inherit

.github/workflows/pull_request.yml:90

• The reusable workflow reference was changed from a pinned commit SHA to the mutable ref @update_jira. Please pin this to a specific commit SHA (or immutable tag) to keep PR CI reproducible and reduce supply-chain risk.

  tag_release:
    if: github.event_name != 'merge_group'
    needs: [get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@update_jira
    with:
      dry_run: true
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: ${{ github.event.pull_request.head.ref }}
      tag_format: ${{ needs.get_config_values.outputs.tag_format }}

.github/workflows/cdk_release_code.yml:30

• workflow_call inputs related to release notes / Jira marking were removed. This is a breaking change for any workflows (including potential external callers) that still pass CREATE_*_RELEASE_NOTES or MARK_JIRA_RELEASED. If the workflow is intended to remain reusable, consider either keeping the inputs (even if deprecated/no-op) for backward compatibility or bumping/communicating the change explicitly (e.g., in PR description / release notes).

  workflow_call:
    inputs:
      STACK_NAME:
        required: true
        type: string
      ARTIFACT_BUCKET_PREFIX:
        required: true
        type: string
      TARGET_ENVIRONMENT:
        required: true
        type: string
      BUILD_ARTIFACT:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      pinned_image:
        type: string
        required: true
      IS_PULL_REQUEST:
        type: boolean
        required: true
    secrets:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[sonarqubecloud]

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarQube Cloud