Skip to content

Commit 16274f7

Browse files
aidenvaines-cgigithub-actions[bot]
aidenvaines-cgi
authored and
github-actions[bot]
committed
Drift from template
1 parent 45bdb8e commit 16274f7

8 files changed

Lines changed: 37 additions & 51 deletions

File tree

‎.github/scripts/dispatch_internal_repo_workflow.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
# All arguments are required except terraformAction, and internalRef.
2121
# Example:
2222
# ./dispatch_internal_repo_workflow.sh \
23-
# --infraRepoName "nhs-notify-web-template-management" \
23+
# --infraRepoName "nhs-notify-dns" \
2424
# --releaseVersion "v1.2.3" \
2525
# --targetWorkflow "deploy.yaml" \
2626
# --targetEnvironment "prod" \
@@ -86,7 +86,7 @@ while [[ $# -gt 0 ]]; do
8686
;;
8787
esac
8888
done
89-
# Validate required parameters
89+
9090
if [[ -z "$APP_PEM_FILE" ]]; then
9191
echo "[ERROR] PEM_FILE environment variable is not set or is empty."
9292
exit 1
@@ -140,7 +140,6 @@ PR_TRIGGER_PAT=$(curl --request POST \
140140
-H "Authorization: Bearer ${JWT}" \
141141
-H "X-GitHub-Api-Version: 2022-11-28" | jq -r '.token')
142142

143-
144143
# Set default values if not provided
145144
if [[ -z "$PR_TRIGGER_PAT" ]]; then
146145
echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ jobs:
1616

1717
steps:
1818
- name: Check out the repository
19-
uses: actions/checkout@v5.0.0
19+
uses: actions/checkout@v4
2020

2121
- name: Check out external repository
22-
uses: actions/checkout@v5.0.0
22+
uses: actions/checkout@v4
2323
with:
2424
repository: NHSDigital/nhs-notify-repository-template
2525
path: nhs-notify-repository-template

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,12 @@ jobs:
3232

3333
steps:
3434
- name: "Checkout code"
35-
uses: actions/checkout@v5.0.0
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
3737
persist-credentials: false
3838

3939
- name: "Run analysis"
40-
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
40+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
4141
with:
4242
results_file: results.sarif
4343
results_format: sarif
@@ -68,6 +68,6 @@ jobs:
6868
# Upload the results to GitHub's code scanning dashboard (optional).
6969
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9
71+
uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
7272
with:
7373
sarif_file: results.sarif

‎scripts/config/pre-commit.yaml‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,6 @@ repos:
33
rev: v5.0.0 # Use the ref you want to point at
44
hooks:
55
- id: trailing-whitespace
6-
exclude: |
7-
(?x)^(
8-
frontend/src/__tests__/.*\.tsx\.snap |
9-
frontend/src/__tests__/utils/markdownit/fixtures/index\.ts
10-
)$
116
- id: detect-aws-credentials
127
args: [--allow-missing-credentials]
138
- id: check-added-large-files
@@ -17,12 +12,8 @@ repos:
1712
- id: forbid-new-submodules
1813
- id: mixed-line-ending
1914
- id: pretty-format-json
20-
exclude: |
21-
(?x)^(
22-
.*/?package-lock.json |
23-
packages/event-schemas/schemas/[^/]+/[^/]+\.json
24-
)$
2515
args: ['--autofix']
16+
exclude: '(^|/)package(-lock)?\.json$'
2617
# - id: ...
2718
- repo: local
2819
hooks:
@@ -42,7 +33,7 @@ repos:
4233
hooks:
4334
- id: check-file-format
4435
name: Check file format
45-
entry: /usr/bin/env check=branch exclude=frontend/src/__tests__/utils/markdownit/fixtures/index.ts ./scripts/githooks/check-file-format.sh
36+
entry: /usr/bin/env check=branch ./scripts/githooks/check-file-format.sh
4637
language: script
4738
pass_filenames: false
4839
- repo: local

‎scripts/githooks/check-file-format.sh‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,8 @@ function main() {
6767
esac
6868

6969
if command -v editorconfig-checker > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
70-
echo "Running editorconfig-checker natively"
7170
filter="$filter" dry_run_opt="${dry_run_opt:-}" run-editorconfig-natively
7271
else
73-
echo "Running editorconfig-checker in Docker"
7472
filter="$filter" dry_run_opt="${dry_run_opt:-}" run-editorconfig-in-docker
7573
fi
7674
}

‎scripts/githooks/check-markdown-format.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,21 +52,21 @@ function main() {
5252
esac
5353

5454
if [ -n "$files" ]; then
55-
if command -v markdownlint-cli > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
55+
if command -v markdownlint > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
5656
files="$files" run-markdownlint-natively
5757
else
5858
files="$files" run-markdownlint-in-docker
5959
fi
6060
fi
6161
}
6262

63-
# Run markdownlint-cli natively.
63+
# Run markdownlint natively.
6464
# Arguments (provided as environment variables):
6565
# files=[files to check]
6666
function run-markdownlint-natively() {
6767

6868
# shellcheck disable=SC2086
69-
markdownlint-cli \
69+
markdownlint \
7070
$files \
7171
--config "$PWD/scripts/config/markdownlint.yaml"
7272
}

‎scripts/githooks/check-todos.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ EXCLUDED_FILES=(
3333
"Makefile"
3434
"project.code-workspace"
3535
"src/jekyll-devcontainer/src/.devcontainer/devcontainer.json"
36-
".eslintrc.json"
3736
)
3837

3938
EXCLUDED_DIRS=(

‎scripts/lambda-container-build/docker.sh‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -34,29 +34,21 @@ GHCR_LOGIN_TOKEN="${GITHUB_TOKEN}"
3434
GHCR_LOGIN_USER="${GITHUB_ACTOR}"
3535
LAMBDA_NAME="${LAMBDA_NAME:-$(basename "$PWD")}"
3636

37-
## Set image tag suffix based on git metadata.
38-
# Publish exactly one suffix:
39-
# - release-<semver>-<shortsha> when HEAD is tagged
40-
# - sha-<shortsha> otherwise
41-
echo "Checking git metadata for image tag suffixes..."
42-
SHORT_SHA="$(git rev-parse --short HEAD)"
43-
SHA_SUFFIX="sha-${SHORT_SHA}"
37+
## Set IMAGE_TAG_SUFFIX based on git tag or short SHA for unique lambda image tagging in ECR.
38+
#This ensures that each build produces a uniquely identifiable image, and tagged releases are easily traceable.
39+
echo "Checking if current commit is a tag..."
4440
GIT_TAG="$(git describe --tags --exact-match 2>/dev/null || true)"
45-
4641
if [ -n "$GIT_TAG" ]; then
47-
RELEASE_VERSION="${GIT_TAG#v}"
48-
RELEASE_SUFFIX="release-${RELEASE_VERSION}-${SHORT_SHA}"
49-
FINAL_SUFFIX="${RELEASE_SUFFIX}"
50-
echo "On tag: $GIT_TAG"
51-
echo "Publishing suffix: $FINAL_SUFFIX"
42+
TAGGED="tag-$GIT_TAG"
43+
echo "On tag: $GIT_TAG, exporting IMAGE_TAG_SUFFIX as tag: $TAGGED"
44+
export IMAGE_TAG_SUFFIX="$TAGGED"
45+
5246
else
53-
echo "Not on a tag"
54-
FINAL_SUFFIX="${SHA_SUFFIX}"
55-
echo "Publishing suffix: $FINAL_SUFFIX"
47+
SHORT_SHA="sha-$(git rev-parse --short HEAD)"
48+
echo "Not on a tag, exporting IMAGE_TAG_SUFFIX as short SHA: $SHORT_SHA"
49+
export IMAGE_TAG_SUFFIX="$SHORT_SHA"
5650
fi
5751

58-
export IMAGE_TAG_SUFFIX="$FINAL_SUFFIX"
59-
6052
## Check if we are running in the context of a Terraform apply or plan, and set PUBLISH_LAMBDA_IMAGE accordingly. We only want to push images to ECR on apply, not on plan.
6153
echo "Checking if ACTION is 'apply' to set PUBLISH_LAMBDA_IMAGE..."
6254
if [ "$ACTION" = "apply" ]; then
@@ -89,7 +81,6 @@ if [ -n "${GHCR_LOGIN_USER:-}" ] && [ -n "${GHCR_LOGIN_TOKEN:-}" ]; then
8981
echo "GHCR login successful."
9082
else
9183
echo "GHCR login failed!" >&2
92-
exit 1
9384
fi
9485
fi
9586

@@ -99,10 +90,14 @@ IMAGE_TAG="${CSI}-${LAMBDA_NAME}"
9990
# Compose the full ECR image references.
10091
ECR_REPO_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPO}"
10192

102-
# Final tag name we will produce.
103-
IMAGE_TAG_FINAL="${ECR_REPO_URI}:${IMAGE_TAG}-${FINAL_SUFFIX}"
93+
# Final tag names we will produce
10494

105-
echo "Will build and tag image: ${IMAGE_TAG_FINAL}"
95+
IMAGE_TAG_LATEST="${ECR_REPO_URI}:${IMAGE_TAG}-latest"
96+
IMAGE_TAG_SUFFIXED="${ECR_REPO_URI}:${IMAGE_TAG}-${IMAGE_TAG_SUFFIX}"
97+
98+
echo "Will build and tag images:"
99+
echo " LATEST -> ${IMAGE_TAG_LATEST}"
100+
echo " SUFFIXED -> ${IMAGE_TAG_SUFFIXED}"
106101

107102
# Build and tag the Docker image for the lambda.
108103
# --load makes the built image available to the local docker daemon (single-platform).
@@ -112,16 +107,20 @@ docker buildx build \
112107
--provenance=false \
113108
--sbom=false \
114109
--build-arg BASE_IMAGE="${BASE_IMAGE}" \
115-
-t "${IMAGE_TAG_FINAL}" \
110+
-t "${IMAGE_TAG_LATEST}" \
111+
-t "${IMAGE_TAG_SUFFIXED}" \
116112
--load \
117113
.
118114

119-
# Push the image tag to ECR on apply only. The Terraform configuration references the deterministic suffixed tag.
115+
# Push the image tag(s) to ECR on apply only. The Terraform configuration will reference image digest.
120116
if [ "${PUBLISH_LAMBDA_IMAGE:-false}" = "true" ]; then
121117
echo "PUBLISH_LAMBDA_IMAGE is set to true. Pushing Docker images to ECR..."
122118

123-
echo "Pushing ${IMAGE_TAG_FINAL}..."
124-
docker push "${IMAGE_TAG_FINAL}"
119+
120+
for TAG in "${IMAGE_TAG_LATEST}" "${IMAGE_TAG_SUFFIXED}"; do
121+
echo "Pushing ${TAG}..."
122+
docker push "${TAG}"
123+
done
125124

126125
echo "Push complete."
127126
else

0 commit comments

Comments
 (0)