[PRM-691] Introduction of strict tagging when releasing by oliverbeumkes-nhs · Pull Request #202 · NHSDigital/orphaned-record-continuity-infrastructure

oliverbeumkes-nhs · 2026-02-24T14:43:21Z

No description provided.

…k definitions using the spicific tag specified

github-actions · 2026-03-06T09:34:29Z

Report for deductions

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
- deductions-core in modules/deductions-core
Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 5.5.2 for deductions-core.vpc...
- deductions-core.vpc in .terraform/modules/deductions-core.vpc
- deductions-private in modules/deductions-private
- deductions-private.mq-admin in modules/deductions-private/mq-admin
Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 5.5.2 for deductions-private.vpc...
- deductions-private.vpc in .terraform/modules/deductions-private.vpc
Downloading registry.terraform.io/terraform-aws-modules/dynamodb-table/aws 4.0.0 for ehr_transfer_tracker_dynamodb_table...
- ehr_transfer_tracker_dynamodb_table in .terraform/modules/ehr_transfer_tracker_dynamodb_table
- repo in modules/mhs
- repo.cluster in modules/mhs/cluster-network
- test-harness in modules/mhs
- test-harness.cluster in modules/mhs/cluster-network
- utils in modules/utils
Initializing provider plugins...
- Finding latest version of hashicorp/archive...
- Finding hashicorp/aws versions matching ">= 5.20.0, >= 5.21.0, 5.37.0"...
- Installing hashicorp/archive v2.7.1...
- Installed hashicorp/archive v2.7.1 (signed by HashiCorp)
- Installing hashicorp/aws v5.37.0...
- Installed hashicorp/aws v5.37.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (0 to add, 1 to change, 0 to destroy)



Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_lambda_function.generate_cost_report_lambda will be updated in-place
  ~ resource "aws_lambda_function" "generate_cost_report_lambda" {
        id                             = "dev-generate-cost-report-lambda"
      ~ last_modified                  = "2026-03-04T11:26:50.000+0000" -> (known after apply)
      ~ source_code_hash               = "3dVLoBm2bx1Ta2E2sOVlM5F9sM/om26m3tpjuVHcfsc=" -> "PZPUzRCdOSYEMGhYL0i7o0bfzS5Ty92vcNxz91ObGG4="
        tags                           = {
            "CreatedBy"   = "orphaned-record-continuity-infrastructure"
            "Environment" = "dev"
        }
        # (26 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

github-actions · 2026-03-06T09:34:55Z

Report for deductions-dashboard

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
- error_count_widgets in widgets/error_count_widget
- health_lb_widgets in widgets/health_lb_widget
- health_widgets in widgets/health_widget
- queue_metrics_widgets in widgets/queue_metrics_widget
- repo_error_count_widgets in widgets/error_count_widget
- repo_health_lb_widgets in widgets/health_lb_widget
- repo_health_network_lb_widgets in widgets/health_network_lb_widget
- repo_health_widgets in widgets/health_widget
- repo_mq_metrics_widgets in widgets/mq_metrics_widget
- repo_queue_metrics_widgets in widgets/queue_metrics_widget
- repo_task_widgets in widgets/task_widget
- task_widgets in widgets/task_widget
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 3.0"...
- Installing hashicorp/aws v3.76.1...
- Installed hashicorp/aws v3.76.1 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (no changes)



No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

github-actions · 2026-03-06T09:35:01Z

Report for deductions-cross-account

Terraform Initialization ⚙️`success`

Initialization Output


Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
- ci_roles in iam-ci
- environment_roles in iam-environment
- environment_strict_roles in iam-strict-environment
Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 3.0"...
- Installing hashicorp/aws v3.76.1...
- Installed hashicorp/aws v3.76.1 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Terraform Validation 🤖`success`

Validation Output


Success! The configuration is valid.

Terraform Plan 📖`success`

Show Plan (no changes)



No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

github-actions · 2026-03-16T15:15:15Z

Checkov issues found

View full details here.

github-actions · 2026-03-16T15:18:41Z

Checkov issues found

View full details here.

github-actions · 2026-03-16T15:20:22Z

Checkov issues found

View full details here.

github-actions · 2026-03-16T15:32:14Z

Checkov issues found

View full details here.

github-actions · 2026-03-16T15:37:19Z

Checkov issues found

View full details here.

.github/workflows/tool-create-release.yml

github-actions · 2026-03-16T16:28:22Z

Checkov issues found

View full details here.

github-actions · 2026-03-17T08:25:25Z

Checkov issues found

View full details here.

.github/workflows/tool-create-release.yml

github-actions · 2026-03-17T08:29:04Z

Checkov issues found

View full details here.

.github/workflows/tool-create-release.yml

github-actions · 2026-03-17T08:30:28Z

Checkov issues found

View full details here.

github-actions · 2026-03-17T10:22:03Z

Checkov issues found

View full details here.

sonarqubecloud · 2026-03-17T10:22:04Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

oliverbeumkes-nhs added 6 commits February 24, 2026 14:43

[PRM-691] Introduction of strict tagging when releasing

5dbb986

[PRM-691] Introduction of strict tagging when releasing

a6ad6fc

Added the is_deployment missing on deploy - full

b5e424b

Renamed Deploy Full to Deploy - Tagged Version

be98883

Renamed Deploy Full to Deploy - Tagged Version

6293d10

Refactored to check if image exists prior to promotion and deploy tas…

50fe661

…k definitions using the spicific tag specified

oliverbeumkes-nhs marked this pull request as ready for review February 24, 2026 16:03

oliverbeumkes-nhs requested a review from a team as a code owner February 24, 2026 16:03

Merge branch 'main' into PRM-691

86c92ef

AndyFlintAnswerDigital previously approved these changes Mar 5, 2026

View reviewed changes

oliverbeumkes-nhs added 2 commits March 5, 2026 16:05

Merge branch 'main' into PRM-691

a0d8aab

Updated name of base-deploy-stack on paths

f951a55

oliverbeumkes-nhs dismissed AndyFlintAnswerDigital’s stale review via f951a55 March 5, 2026 16:28

oliverbeumkes-nhs added 3 commits March 5, 2026 16:31

Re-named deploy-tagged-version back to deploy-full

2140957

Removed EOF space

19912ad

Updated name of base-deploy-stack on paths

162cf74

oliverbeumkes-nhs temporarily deployed to dev March 6, 2026 09:33 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to dev March 6, 2026 09:34 — with GitHub Actions Inactive

oliverbeumkes-nhs temporarily deployed to dev March 6, 2026 09:35 — with GitHub Actions Inactive

use $tag in bash instead of env.tag

2e29726

Use SHA instave of v3

e24d334

Merge branch 'main' into PRM-691

558281c

Make all permission default read-all

4c32cf4

Remove the read-all permissions

20dc690

samfallowfield previously approved these changes Mar 16, 2026

View reviewed changes

Changed permissions from contents: write to contents: read

d106726

oliverbeumkes-nhs dismissed samfallowfield’s stale review via d106726 March 16, 2026 16:27

github-advanced-security bot found potential problems Mar 16, 2026

View reviewed changes

.github/workflows/tool-create-release.yml Fixed Show fixed Hide fixed

Attempt to set permissions back to action defaults

9067a16

github-advanced-security bot found potential problems Mar 17, 2026

View reviewed changes

.github/workflows/tool-create-release.yml Fixed Show fixed Hide fixed

.github/workflows/tool-create-release.yml Fixed Show fixed Hide fixed

Moving default actions permissions to job level

0687126

github-advanced-security bot found potential problems Mar 17, 2026

View reviewed changes

.github/workflows/tool-create-release.yml Fixed Show fixed Hide fixed

Setting to just contents read to see if it satisfies warning

079837d

github-advanced-security bot found potential problems Mar 17, 2026

View reviewed changes

.github/workflows/tool-create-release.yml Fixed Show fixed Hide fixed

Set top-level permission to contents read

6d51919

samfallowfield approved these changes Mar 17, 2026

View reviewed changes

oliverbeumkes-nhs merged commit fd141c4 into main Mar 17, 2026
25 of 26 checks passed

oliverbeumkes-nhs deleted the PRM-691 branch March 17, 2026 10:46

Conversation

oliverbeumkes-nhs commented Feb 24, 2026

Uh oh!

github-actions bot commented Mar 6, 2026

Report for deductions

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Mar 6, 2026

Report for deductions-dashboard

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Mar 6, 2026

Report for deductions-cross-account

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Terraform Plan 📖success

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

Uh oh!

github-actions bot commented Mar 16, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 17, 2026

Checkov issues found

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Checkov issues found

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Checkov issues found

Uh oh!

github-actions bot commented Mar 17, 2026

Checkov issues found

Uh oh!

sonarqubecloud bot commented Mar 17, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`

Terraform Initialization ⚙️`success`

Terraform Validation 🤖`success`

Terraform Plan 📖`success`