Skip to content

Commit fc58060

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-6242] - move to new quality checks (#997)
## Summary - Routine Change ### Details - move to new quality checks
1 parent a17de99 commit fc58060

File tree

13 files changed

+101
-31
lines changed

13 files changed

+101
-31
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"args": {
77
"DOCKER_GID": "${env:DOCKER_GID:}",
88
"IMAGE_NAME": "node_24_python_3_14",
9-
"IMAGE_VERSION": "v1.2.0",
9+
"IMAGE_VERSION": "v1.4.4",
1010
"USER_UID": "${localEnv:USER_ID:}",
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
}

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# restrict access to approving workflow changes
2+
.github/workflows/ @NHSDigital/eps-admins

‎.github/workflows/cdk_package_code.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ on:
1313
type: string
1414
required: true
1515

16+
permissions: {}
1617
jobs:
1718
package_code:
1819
runs-on: ubuntu-22.04
@@ -33,7 +34,7 @@ jobs:
3334
- name: Checkout code
3435
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
3536
with:
36-
ref: ${{ env.BRANCH_NAME }}
37+
persist-credentials: false
3738
- name: Setting up .npmrc
3839
env:
3940
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/cdk_release_code.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ on:
4141
CDK_DEPLOY_ROLE:
4242
required: true
4343

44+
permissions: {}
45+
4446
jobs:
4547
deploy_cdk_code:
4648
runs-on: ubuntu-22.04
@@ -217,6 +219,7 @@ jobs:
217219
with:
218220
ref: gh-pages
219221
path: gh-pages
222+
persist-credentials: true
220223

221224
- name: Update release tag in github pages
222225
if: ${{ inputs.DEPLOY_CDK_CODE == true }}

‎.github/workflows/ci.yml‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,22 @@ on:
44
push:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
7+
permissions: {}
98

109
jobs:
1110
get_config_values:
1211
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
13-
12+
permissions:
13+
attestations: read
14+
contents: read
15+
packages: read
1416
quality_checks:
15-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
17+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
1618
needs: [get_config_values]
19+
permissions:
20+
contents: read
21+
id-token: write
22+
packages: read
1723
with:
1824
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
1925
secrets:
@@ -31,20 +37,24 @@ jobs:
3137
3238
tag_release:
3339
needs: [quality_checks, get_commit_id, get_config_values]
34-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
40+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
3541
permissions:
3642
id-token: write
3743
contents: write
44+
packages: write
3845
with:
3946
dry_run: true
4047
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
4148
branch_name: main
4249
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
43-
secrets: inherit
4450

4551
package_code:
4652
needs: [tag_release, get_commit_id, get_config_values]
4753
uses: ./.github/workflows/cdk_package_code.yml
54+
permissions:
55+
contents: write
56+
id-token: write
57+
packages: read
4858
with:
4959
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
5060
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
@@ -53,6 +63,9 @@ jobs:
5363
release_dev:
5464
needs: [tag_release, package_code, get_commit_id, get_config_values]
5565
uses: ./.github/workflows/cdk_release_code.yml
66+
permissions:
67+
contents: write
68+
id-token: write
5669
with:
5770
TARGET_ENVIRONMENT: dev
5871
VERSION: ${{needs.tag_release.outputs.version_tag}}
@@ -70,6 +83,9 @@ jobs:
7083
release_qa:
7184
needs: [tag_release, release_dev, package_code, get_commit_id, get_config_values]
7285
uses: ./.github/workflows/cdk_release_code.yml
86+
permissions:
87+
contents: write
88+
id-token: write
7389
with:
7490
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
7591
TARGET_ENVIRONMENT: qa

‎.github/workflows/pull_request.yml‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,41 @@ on:
44
pull_request:
55
branches: [main]
66

7-
env:
8-
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
7+
permissions: {}
98

109
jobs:
1110
get_config_values:
1211
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
13-
12+
permissions:
13+
attestations: read
14+
contents: read
15+
packages: read
1416
dependabot-auto-approve-and-merge:
1517
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
18+
permissions:
19+
contents: write
20+
pull-requests: write
1621
secrets:
1722
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1823
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1924

2025

2126
quality_checks:
22-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
27+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
2328
needs: [get_config_values]
29+
permissions:
30+
contents: read
31+
id-token: write
32+
packages: read
2433
with:
2534
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
2635
secrets:
2736
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2837

2938
pr_title_format_check:
3039
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
31-
40+
permissions:
41+
pull-requests: write
3242
get_issue_number:
3343
runs-on: ubuntu-22.04
3444
outputs:
@@ -57,16 +67,16 @@ jobs:
5767

5868
tag_release:
5969
needs: [get_config_values]
60-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
70+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
6171
permissions:
6272
id-token: write
6373
contents: write
74+
packages: write
6475
with:
6576
dry_run: true
6677
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
6778
branch_name: ${{ github.event.pull_request.head.ref }}
6879
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
69-
secrets: inherit
7080

7181
get_commit_id:
7282
runs-on: ubuntu-22.04
@@ -81,6 +91,10 @@ jobs:
8191
package_code:
8292
needs: [quality_checks, get_issue_number, get_commit_id, get_config_values]
8393
uses: ./.github/workflows/cdk_package_code.yml
94+
permissions:
95+
contents: read
96+
id-token: write
97+
packages: read
8498
with:
8599
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
86100
VERSION_NUMBER: ${{needs.get_issue_number.outputs.issue_number}}
@@ -89,6 +103,9 @@ jobs:
89103
show_dev_changes:
90104
needs: [quality_checks, get_issue_number, package_code, get_commit_id, get_config_values]
91105
uses: ./.github/workflows/cdk_release_code.yml
106+
permissions:
107+
contents: write
108+
id-token: write
92109
with:
93110
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
94111
TARGET_ENVIRONMENT: dev

‎.github/workflows/release.yml‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,22 @@ name: deploy to environments
33
on:
44
workflow_dispatch:
55

6-
env:
7-
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
6+
permissions: {}
87

98
jobs:
109
get_config_values:
1110
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
12-
11+
permissions:
12+
attestations: read
13+
contents: read
14+
packages: read
1315
quality_checks:
14-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
16+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
1517
needs: [get_config_values]
18+
permissions:
19+
contents: read
20+
id-token: write
21+
packages: read
1622
with:
1723
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
1824
secrets:
@@ -30,10 +36,11 @@ jobs:
3036
3137
tag_release:
3238
needs: [quality_checks, get_commit_id, get_config_values]
33-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
39+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
3440
permissions:
3541
id-token: write
3642
contents: write
43+
packages: write
3744
with:
3845
dry_run: false
3946
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
@@ -46,6 +53,10 @@ jobs:
4653
package_code:
4754
needs: [tag_release, get_commit_id, get_config_values]
4855
uses: ./.github/workflows/cdk_package_code.yml
56+
permissions:
57+
contents: read
58+
id-token: write
59+
packages: read
4960
with:
5061
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
5162
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
@@ -54,6 +65,9 @@ jobs:
5465
release_dev:
5566
needs: [tag_release, package_code, get_commit_id, get_config_values]
5667
uses: ./.github/workflows/cdk_release_code.yml
68+
permissions:
69+
contents: write
70+
id-token: write
5771
with:
5872
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
5973
TARGET_ENVIRONMENT: dev
@@ -71,6 +85,9 @@ jobs:
7185
release_ref:
7286
needs: [tag_release, package_code, get_commit_id, release_dev, get_config_values]
7387
uses: ./.github/workflows/cdk_release_code.yml
88+
permissions:
89+
contents: write
90+
id-token: write
7491
with:
7592
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
7693
TARGET_ENVIRONMENT: ref
@@ -88,6 +105,9 @@ jobs:
88105
release_qa:
89106
needs: [tag_release, package_code, get_commit_id, release_dev, get_config_values]
90107
uses: ./.github/workflows/cdk_release_code.yml
108+
permissions:
109+
contents: write
110+
id-token: write
91111
with:
92112
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
93113
TARGET_ENVIRONMENT: qa
@@ -113,6 +133,9 @@ jobs:
113133
get_config_values,
114134
]
115135
uses: ./.github/workflows/cdk_release_code.yml
136+
permissions:
137+
contents: write
138+
id-token: write
116139
with:
117140
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
118141
TARGET_ENVIRONMENT: int
@@ -130,6 +153,9 @@ jobs:
130153
release_prod:
131154
needs: [tag_release, package_code, get_commit_id, release_int, get_config_values]
132155
uses: ./.github/workflows/cdk_release_code.yml
156+
permissions:
157+
contents: write
158+
id-token: write
133159
with:
134160
pinned_image: "${{ needs.get_config_values.outputs.pinned_image }}"
135161
TARGET_ENVIRONMENT: prod

‎.github/workflows/sync_copilot.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
workflow_dispatch:
55
schedule:
66
- cron: '0 6 * * 1'
7+
permissions: {}
78

89
jobs:
910
sync-copilot-instructions:

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ cdk.out/
3333
.npmrc
3434
.cfn_guard_out/
3535
.trivy_out/
36+
.sbom/

‎.pre-commit-config.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ repos:
2323

2424
- repo: local
2525
hooks:
26+
- id: grype-scan-local
27+
name: Grype scan local changes
28+
entry: make
29+
args: ["grype-scan-local"]
30+
language: system
31+
pass_filenames: false
32+
always_run: true
33+
2634
- id: check-commit-signing
2735
name: Check commit signing
2836
description: Ensures that commits are GPG signed

0 commit comments

Comments
 (0)