Merge branch 'main' into dependabot/pip/docs/adr/assets/ADR-003/examples/python/pyjwt-2.12.0

Author: neil-sproston

.github/workflows/preview-env.yaml

@@ -17,6 +17,7 @@ env:
   AWS_REGION: eu-west-2
   PREVIEW_PREFIX: pr-
   MOCK_PREFIX: mock-
+  PREVIEW_INT_PREFIX: int-
   PYTHON_VERSION: 3.14
   LAMBDA_RUNTIME: python3.14
   LAMBDA_HANDLER: lambda_handler.handler
@@ -25,7 +26,8 @@ env:
   PROXYGEN_KEY_ID: ${{ vars.PREVIEW_ENV_PROXYGEN_KEY_ID }}
   PROXYGEN_CLIENT_ID: ${{ vars.PREVIEW_ENV_PROXYGEN_CLIENT_ID }}
   PROXYGEN_API_NAME: ${{ vars.PROXYGEN_API_NAME }}
-  BASE_URL: 'https://internal-dev.api.service.nhs.uk/${{ vars.PROXYGEN_API_NAME }}-pr-${{ github.event.pull_request.number }}'
+  BASE_URL: "https://internal-dev.api.service.nhs.uk/${{ vars.PROXYGEN_API_NAME }}-pr-${{ github.event.pull_request.number }}"
+  INT_BASE_URL: "https://internal-dev.api.service.nhs.uk/${{ vars.PROXYGEN_API_NAME }}-pri-${{ github.event.pull_request.number }}"
   ENV: "remote"
   PR_NUMBER: ${{ github.event.pull_request.number }}
   HOST: "internal-dev.api.service.nhs.uk"
@@ -93,7 +95,13 @@ jobs:
         run: |
           branch=$RAW_BRANCH_NAME
           if [ -z "$branch" ]; then branch="${{ github.ref_name }}"; fi
-          safe=$(echo "$branch" | sed -E 's/[^a-zA-Z0-9._-]+/-/g' | tr '[:upper:]' '[:lower:]')
+
+          if [ "${{ github.actor }}" = "dependabot[bot]" ]; then
+            safe="dependabot-${{ github.event.pull_request.number }}"
+          else
+            safe=$(echo "$branch" | sed -E 's/[^a-zA-Z0-9._-]+/-/g' | tr '[:upper:]' '[:lower:]')
+          fi
+
           echo "branch=$branch" >> $GITHUB_OUTPUT
           echo "safe=$safe" >> $GITHUB_OUTPUT
 
@@ -103,6 +111,7 @@ jobs:
           SAFE=${{ steps.branch.outputs.safe }}
           PREFIX=${{ env.PREVIEW_PREFIX }}
           MOCK_PREFIX=${{ env.MOCK_PREFIX }}
+          INT_PREFIX=${{ env.PREVIEW_INT_PREFIX }}
           MAX_FN_LEN=62
           MAX_PREFIX_LEN=${#PREFIX}
           if [ ${#MOCK_PREFIX} -gt "$MAX_PREFIX_LEN" ]; then
@@ -114,20 +123,24 @@ jobs:
           fi
           FN="${PREFIX}${SAFE}"
           MFN="${MOCK_PREFIX}${SAFE}"
+          IFN="${INT_PREFIX}${SAFE}"
           echo "function_name=$FN" >> "$GITHUB_OUTPUT"
           echo "mock_function_name=$MFN" >> "$GITHUB_OUTPUT"
+          echo "int_function_name=$IFN" >> "$GITHUB_OUTPUT"
           URL="https://${SAFE}.dev.endpoints.${{ env.PROXYGEN_API_NAME }}.national.nhs.uk"
           MOCK_URL="https://${SAFE}.m.dev.endpoints.${{ env.PROXYGEN_API_NAME }}.national.nhs.uk"
+          INT_URL="https://${SAFE}.i.dev.endpoints.${{ env.PROXYGEN_API_NAME }}.national.nhs.uk"
           echo "preview_url=$URL" >> "$GITHUB_OUTPUT"
           echo "mock_preview_url=$MOCK_URL" >> "$GITHUB_OUTPUT"
+          echo "int_preview_url=$INT_URL" >> "$GITHUB_OUTPUT"
 
-      # ---------- Handle application ----------
-      - name: Create or update preview Lambda (on open/sync/reopen)
+      # ---------- Handle application with mock ----------
+      - name: Create or update preview Lambda with mock (on open/sync/reopen)
         if: github.event.action != 'closed'
         env:
           MOCK_URL: ${{ steps.names.outputs.mock_preview_url }}
-          EXPIRY_THRESHOLD: ${{ secrets.APIM_TOKEN_EXPIRY_THRESHOLD }}
-          JWKS_SECRET: ${{ secrets.JWKS_SECRET }}
+          TOKEN_EXPIRY_THRESHOLD: ${{ secrets.APIM_TOKEN_EXPIRY_THRESHOLD }}
+          JWKS_SECRET_NAME: ${{ secrets.JWKS_SECRET }}
           APIM_PRIVATE_KEY: ${{ secrets.APIM_PRIVATE_KEY }}
           APIM_APIKEY: ${{ secrets.APIM_APIKEY }}
           API_MTLS_CERT: ${{ secrets.API_MTLS_CERT }}
@@ -194,18 +207,104 @@ jobs:
             wait_for_lambda_ready
           fi
 
-      - name: Delete preview Lambda (on PR closed)
+      - name: Delete preview Lambda with mock (on PR closed)
         if: github.event.action == 'closed'
         run: |
           FN="${{ steps.names.outputs.function_name }}"
           echo "Deleting preview function:  $FN"
           aws lambda delete-function --function-name "$FN" || true
 
-      - name: Output function name
+      - name: Output function name with mock
         run: |
           echo "function = ${{ steps.names.outputs.function_name }}"
           echo "url      = ${{ steps.names.outputs.preview_url }}"
 
+      # ---------- Handle application with integration----------
+      - name: Create or update preview Lambda with integration (on open/sync/reopen)
+        if: github.event.action != 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
+        env:
+          MOCK_URL: ${{ steps.names.outputs.mock_preview_url }}
+          TOKEN_EXPIRY_THRESHOLD: ${{ secrets.APIM_TOKEN_EXPIRY_THRESHOLD }}
+          JWKS_SECRET_NAME: ${{ secrets.JWKS_SECRET }}
+          APIM_PRIVATE_KEY: ${{ secrets.APIM_PRIVATE_KEY }}
+          APIM_APIKEY: ${{ secrets.APIM_APIKEY }}
+          API_MTLS_CERT: ${{ secrets.API_MTLS_CERT }}
+          API_MTLS_KEY: ${{ secrets.API_MTLS_KEY }}
+        run: |
+          cd pathology-api/target/
+          FN="${{ steps.names.outputs.int_function_name }}"
+          EXPIRY_THRESHOLD="${TOKEN_EXPIRY_THRESHOLD:-30s}"
+          JWKS_SECRET="${JWKS_SECRET_NAME:-/cds/pathology/dev/jwks/secret}"
+          PRIVATE_KEY="${APIM_PRIVATE_KEY:-/cds/pathology/dev/apim/private-key}"
+          API_KEY="${APIM_APIKEY:-/cds/pathology/dev/apim/api-key}"
+          MTLS_CERT="${API_MTLS_CERT:-/cds/pathology/dev/mtls/client1-key-public}"
+          MTLS_KEY="${API_MTLS_KEY:-/cds/pathology/dev/mtls/client1-key-secret}"
+          echo "Deploying preview function: $FN"
+          wait_for_lambda_ready() {
+            while true; do
+            status=$(aws lambda get-function-configuration --function-name "$FN" \
+                        --query 'LastUpdateStatus' \
+                        --output text 2>/dev/null || echo "Unknown")
+            if [ "$status" = "Successful" ] || [ "$status" = "Unknown" ]; then
+              break
+            fi
+            if [ "$status" = "Failed" ]; then
+              echo "Lambda is in Failed state; check logs." >&2
+              exit 1
+            fi
+            echo "Lambda update status: $status — waiting..."
+            sleep 5
+          done
+          }
+          if aws lambda get-function --function-name "$FN" >/dev/null 2>&1; then
+            wait_for_lambda_ready
+            aws lambda update-function-configuration --function-name "$FN" \
+              --handler "${{ env.LAMBDA_HANDLER }}" \
+              --environment "Variables={APIM_TOKEN_EXPIRY_THRESHOLD=$EXPIRY_THRESHOLD, \
+                                        APIM_PRIVATE_KEY_NAME=$PRIVATE_KEY, \
+                                        APIM_API_KEY_NAME=$API_KEY, \
+                                        APIM_MTLS_CERT_NAME=$MTLS_CERT, \
+                                        APIM_MTLS_KEY_NAME=$MTLS_KEY, \
+                                        APIM_TOKEN_URL=$MOCK_URL/apim, \
+                                        PDM_BUNDLE_URL=$MOCK_URL/pdm, \
+                                        MNS_EVENT_URL=$MOCK_URL/mns, \
+                                        JWKS_SECRET_NAME=$JWKS_SECRET}" || true
+            wait_for_lambda_ready
+            aws lambda update-function-code --function-name "$FN" \
+              --zip-file "fileb://artifact.zip" \
+              --publish
+          else
+            aws lambda create-function --function-name "$FN" \
+              --runtime "${{ env.LAMBDA_RUNTIME }}" \
+              --handler "${{ env.LAMBDA_HANDLER }}" \
+              --zip-file "fileb://artifact.zip" \
+              --role "${{ steps.role-select.outputs.lambda_role }}" \
+              --environment "Variables={APIM_TOKEN_EXPIRY_THRESHOLD=$EXPIRY_THRESHOLD, \
+                                        APIM_PRIVATE_KEY_NAME=$PRIVATE_KEY, \
+                                        APIM_API_KEY_NAME=$API_KEY, \
+                                        APIM_MTLS_CERT_NAME=$MTLS_CERT, \
+                                        APIM_MTLS_KEY_NAME=$MTLS_KEY, \
+                                        APIM_TOKEN_URL=$MOCK_URL/apim, \
+                                        PDM_BUNDLE_URL=$MOCK_URL/pdm, \
+                                        MNS_EVENT_URL=$MOCK_URL/mns, \
+                                        JWKS_SECRET_NAME=$JWKS_SECRET}" \
+              --publish
+            wait_for_lambda_ready
+          fi
+
+      - name: Delete preview Lambda with integration (on PR closed)
+        if: github.event.action == 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
+        run: |
+          FN="${{ steps.names.outputs.int_function_name }}"
+          echo "Deleting preview function:  $FN"
+          aws lambda delete-function --function-name "$FN" || true
+
+      - name: Output function name with integration
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
+        run: |
+          echo "function = ${{ steps.names.outputs.int_function_name }}"
+          echo "url      = ${{ steps.names.outputs.int_preview_url }}"
+
       # ---------- Handle mock endpoints ----------
       - name: Create or update mock Lambda (on open/sync/reopen)
         if: github.event.action != 'closed'
@@ -378,6 +477,57 @@ jobs:
           echo "http_result=unexpected-status" >> "$GITHUB_OUTPUT"
           exit 0
 
+      - name: Smoke test int URL
+        if: github.event.action != 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
+        id: smoke-int
+        env:
+          PREVIEW_URL: ${{ steps.names.outputs.int_preview_url }}
+        run: |
+          if [ -z "$PREVIEW_URL" ] || [ "$PREVIEW_URL" = "null" ]; then
+            echo "Int URL missing"
+            echo "http_status=missing" >> "$GITHUB_OUTPUT"
+            echo "http_result=missing-url" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Reachability check: allow 404 (app routes might not exist yet) but fail otherwise
+          printf '%s' "$_cds_pathology_dev_mtls_client1_key_secret" > /tmp/client1-key.pem
+          printf '%s' "$_cds_pathology_dev_mtls_client1_key_public" > /tmp/client1-cert.pem
+          STATUS=$(curl \
+                      --cert /tmp/client1-cert.pem \
+                      --key /tmp/client1-key.pem \
+                      --silent \
+                      --output /tmp/preview.headers \
+                      --write-out '%{http_code}' \
+                      --head \
+                      --max-time 30 \
+                      -X GET "$PREVIEW_URL"/_status || true)
+          rm -f /tmp/client1-key.pem
+          rm -f /tmp/client1-cert.pem
+
+          if [ "$STATUS" = "404" ]; then
+            echo "Int responded with expected 404"
+            echo "http_status=404" >> "$GITHUB_OUTPUT"
+            echo "http_result=allowed-404" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "$STATUS" =~ ^[0-9]{3}$ ]] && [ "$STATUS" -ge 200 ] && [ "$STATUS" -lt 400 ]; then
+            echo "Int responded with status $STATUS"
+            echo "http_status=$STATUS" >> "$GITHUB_OUTPUT"
+            echo "http_result=success" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Int responded with unexpected status $STATUS"
+          if [ -f /tmp/preview.headers ]; then
+            echo "Response headers:"
+            cat /tmp/preview.headers
+          fi
+          echo "http_status=$STATUS" >> "$GITHUB_OUTPUT"
+          echo "http_result=unexpected-status" >> "$GITHUB_OUTPUT"
+          exit 0
+
       - name: Get proxygen machine user details
         id: proxygen-machine-user
         uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802
@@ -397,6 +547,18 @@ jobs:
           proxygen-client-id: ${{ env.PROXYGEN_CLIENT_ID }}
           proxygen-api-name: ${{ env.PROXYGEN_API_NAME }}
 
+      - name: Deploy int preview API proxy
+        if: github.event.action != 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
+        uses: ./.github/actions/proxy/deploy-proxy
+        with:
+          mtls-secret-name: ${{ env.MTLS_SECRET_NAME }}
+          target-url: ${{ steps.names.outputs.int_preview_url }}
+          proxy-base-path: "${{ env.PROXYGEN_API_NAME }}-pri-${{ github.event.pull_request.number }}"
+          proxygen-key-secret: ${{ env._cds_pathology_dev_proxygen_proxygen_key_secret }}
+          proxygen-key-id: ${{ env.PROXYGEN_KEY_ID }}
+          proxygen-client-id: ${{ env.PROXYGEN_CLIENT_ID }}
+          proxygen-api-name: ${{ env.PROXYGEN_API_NAME }}
+
       - name: Tear down preview API proxy
         if: github.event.action == 'closed'
         uses: ./.github/actions/proxy/tear-down-proxy
@@ -407,6 +569,16 @@ jobs:
           proxygen-client-id: ${{ env.PROXYGEN_CLIENT_ID }}
           proxygen-api-name: ${{ env.PROXYGEN_API_NAME }}
 
+      - name: Tear down int preview API proxy
+        if: github.event.action == 'closed' && github.event.pull_request.user.login != 'dependabot[bot]'
+        uses: ./.github/actions/proxy/tear-down-proxy
+        with:
+          proxy-base-path: "${{ env.PROXYGEN_API_NAME }}-pri-${{ github.event.pull_request.number }}"
+          proxygen-key-secret: ${{ env._cds_pathology_dev_proxygen_proxygen_key_secret }}
+          proxygen-key-id: ${{ env.PROXYGEN_KEY_ID }}
+          proxygen-client-id: ${{ env.PROXYGEN_CLIENT_ID }}
+          proxygen-api-name: ${{ env.PROXYGEN_API_NAME }}
+
       - name: Retrieve Apigee Token
         id: apigee-token
         shell: bash
@@ -495,7 +667,7 @@ jobs:
           name: ${{ steps.create-name.outputs.artefact-name }}
           path: coverage-reports/
       - name: "SonarCloud Scan"
-        if: always() && github.event.action != 'closed'
+        if: always() && github.event.action != 'closed' && github.actor != 'dependabot[bot]'
         uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 #7.0.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -510,18 +682,24 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         with:
           script: |
-            const fn = '${{ steps.names.outputs.function_name }}';
-            const mock_fn = '${{ steps.names.outputs.mock_function_name }}';
+            const fn = '${{ steps.names.outputs.function_name }}' || 'not-set';
+            const mock_fn = '${{ steps.names.outputs.mock_function_name }}' || 'not-set';
+            const int_fn = '${{ steps.names.outputs.int_function_name }}' || 'not-set';
             const url = '${{ steps.names.outputs.preview_url }}';
             const mock_url = '${{ steps.names.outputs.mock_preview_url }}';
+            const int_url = '${{ steps.names.outputs.int_preview_url }}';
             const proxy_url = '${{ env.BASE_URL }}';
+            const int_proxy_url = '${{ env.INT_BASE_URL}}';
+            const isDependabotPr = '${{ github.event.pull_request.user.login }}' === 'dependabot[bot]';
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const issueNumber = context.issue.number;
             const smokeStatus = '${{ steps.smoke-test.outputs.http_status }}' || 'n/a';
             const smokeResult = '${{ steps.smoke-test.outputs.http_result }}' || 'not-run';
             const smokeMockStatus = '${{ steps.smoke-mock.outputs.http_status }}' || 'n/a';
             const smokeMockResult = '${{ steps.smoke-mock.outputs.http_result }}' || 'not-run';
+            const smokeIntStatus = '${{ steps.smoke-int.outputs.http_status }}' || 'n/a';
+            const smokeIntResult = '${{ steps.smoke-int.outputs.http_result }}' || 'not-run';
 
             const smokeLabels = {
               success: ':white_check_mark: Passed',
@@ -532,6 +710,19 @@ jobs:
 
             const smokeReadable = smokeLabels[smokeResult] ?? smokeResult;
             const smokeMockReadable = smokeLabels[smokeMockResult] ?? smokeMockResult;
+            const smokeIntReadable = smokeLabels[smokeIntResult] ?? smokeIntResult;
+            const intUrlDisplay = isDependabotPr
+              ? 'Skipped for Dependabot PR'
+              : `[${int_url}](${int_url}) — [Status](${int_url}/_status)`;
+            const intSmokeDisplay = isDependabotPr
+              ? 'Skipped for Dependabot PR'
+              : `${smokeIntReadable} (HTTP ${smokeIntStatus})`;
+            const intProxyDisplay = isDependabotPr
+              ? 'Skipped for Dependabot PR'
+              : `[${int_proxy_url}](${int_proxy_url})`;
+            const intLambdaDisplay = isDependabotPr
+              ? 'Skipped for Dependabot PR'
+              : int_fn;
             const { data: comments } = await github.rest.issues.listComments({
               owner,
               repo,
@@ -554,13 +745,20 @@ jobs:
 
             const lines = [
               '**Deployment Complete**',
-              `- Preview URL: [${url}](${url}) — [Status](${url}/_status)`,
-              `  - Smoke Test: ${smokeReadable} (HTTP ${smokeStatus})`,
-              `- Mock URL: [${mock_url}](${mock_url})`,
-              `  - Smoke Mock Test: ${smokeMockReadable} (HTTP ${smokeMockStatus})`,
-              `- Proxy URL: [${proxy_url}](${proxy_url})`,
-              `- Lambda Function: ${fn}`,
-              `- Mock Lambda Function: ${mock_fn}`,
+              `- Preview with mock:`,
+              `  - URL: [${url}](${url}) — [Status](${url}/_status)`,
+              `    - Smoke test result: ${smokeReadable} (HTTP ${smokeStatus})`,
+              `  - Proxy URL: [${proxy_url}](${proxy_url})`,
+              `  - Lambda function: ${fn}`,
+              `- Mock endpoints:`,
+              `  - URL: [${mock_url}](${mock_url})`,
+              `    - Smoke test result: ${smokeMockReadable} (HTTP ${smokeMockStatus})`,
+              `  - Lambda function: ${mock_fn}`,
+              `- Preview with integration:`,
+              `  - URL: ${intUrlDisplay}`,
+              `    - Smoke test result: ${intSmokeDisplay}`,
+              `  - Proxy URL: ${intProxyDisplay}`,
+              `  - Lambda function: ${intLambdaDisplay}`,
             ];
 
             await github.rest.issues.createComment({